diff --git a/crdSchemas/api_v1alpha1.json b/crdSchemas/api_v1alpha1.json index 02f3396..85a3e02 100644 --- a/crdSchemas/api_v1alpha1.json +++ b/crdSchemas/api_v1alpha1.json @@ -218,6 +218,10 @@ } ] }, + "validateRequestBodySchema": { + "description": "ValidateRequestBodySchema validates the request body against the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", + "type": "boolean" + }, "validateRequestMethodAndPath": { "description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", "type": "boolean" diff --git a/crdSchemas/apiauth_v1alpha1.json b/crdSchemas/apiauth_v1alpha1.json index 01337bd..4d8c5c5 100644 --- a/crdSchemas/apiauth_v1alpha1.json +++ b/crdSchemas/apiauth_v1alpha1.json @@ -17,8 +17,36 @@ "properties": { "apiKey": { "description": "APIKey configures API key authentication.", + "properties": { + "keySource": { + "description": "KeySource defines where to extract the API key from requests.\nWhen not specified, defaults to \"Authorization\" header with \"Bearer\" scheme and \"api_key\" query parameter.\nWhen specified, it completely overrides defaults - fields left empty will disable that extraction method.", + "minProperties": 1, + "properties": { + "header": { + "description": "Header is the name of the header containing the API key.", + "type": "string" + }, + "headerAuthScheme": { + "description": "HeaderAuthScheme is the authentication scheme prefix in the header value.\nThe scheme is used to parse headers in the format \" \".\nOnly applies when header is \"Authorization\".", + "type": "string" + }, + "query": { + "description": "Query is the name of the query parameter containing the API key.", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "headerAuthScheme can only be used when header is 'Authorization'", + "rule": "!has(self.headerAuthScheme) || self.header == 'Authorization'" + } + ], + "additionalProperties": false + } + }, "type": "object", - "x-kubernetes-preserve-unknown-fields": true + "additionalProperties": false }, "isDefault": { "description": "IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.\nOnly one APIAuth per namespace should have isDefault set to true.", @@ -43,7 +71,7 @@ "type": "string" }, "jwksUrl": { - "description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.", + "description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\n\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.", "type": "string", "x-kubernetes-validations": [ { diff --git a/crdSchemas/apiversion_v1alpha1.json b/crdSchemas/apiversion_v1alpha1.json index 903fed2..e20bb0f 100644 --- a/crdSchemas/apiversion_v1alpha1.json +++ b/crdSchemas/apiversion_v1alpha1.json @@ -218,6 +218,10 @@ } ] }, + "validateRequestBodySchema": { + "description": "ValidateRequestBodySchema validates the request body against the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", + "type": "boolean" + }, "validateRequestMethodAndPath": { "description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", "type": "boolean" diff --git a/crdSchemas/clusterkeycloakinstance_v1beta1.json b/crdSchemas/clusterkeycloakinstance_v1beta1.json index ecd0bba..b1a03e4 100644 --- a/crdSchemas/clusterkeycloakinstance_v1beta1.json +++ b/crdSchemas/clusterkeycloakinstance_v1beta1.json @@ -13,73 +13,172 @@ "type": "object" }, "spec": { - "description": "ClusterKeycloakInstanceSpec defines the desired state of ClusterKeycloakInstance\nIt mirrors KeycloakInstanceSpec but is cluster-scoped", + "description": "ClusterKeycloakInstanceSpec defines the desired state of ClusterKeycloakInstance.\nIt mirrors KeycloakInstanceSpec but is cluster-scoped: secret references must\nspecify a namespace explicitly.", "properties": { - "baseUrl": { - "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", - "type": "string" - }, - "client": { - "description": "Client contains optional service account client configuration", + "auth": { + "description": "Auth selects how the operator authenticates to Keycloak.\nExactly one of auth.passwordGrant or auth.clientCredentials must be set.", "properties": { - "id": { - "description": "ID is the client ID for service account authentication", - "type": "string" - }, - "secret": { - "description": "Secret is the client secret (optional for public clients)", - "type": "string" - } - }, - "required": [ - "id" - ], - "type": "object", - "additionalProperties": false - }, - "credentials": { - "description": "Credentials contains the reference to the admin credentials secret", - "properties": { - "secretRef": { - "description": "SecretRef contains the reference to the secret with credentials", + "clientCredentials": { + "description": "ClusterClientCredentialsSpec configures OAuth2 client_credentials\nauthentication for cluster-scoped instances.", "properties": { - "name": { - "description": "Name is the name of the secret", + "clientId": { + "description": "ClientID, when set, overrides secretRef.clientIdKey.", "type": "string" }, - "namespace": { - "description": "Namespace is the namespace of the secret (required for cluster-scoped resources)", - "type": "string" + "secretRef": { + "description": "ClusterClientCredentialsSecretRefSpec references a client-credentials Secret.\nNamespace is required because the resource is cluster-scoped.", + "properties": { + "clientIdKey": { + "default": "client-id", + "type": "string" + }, + "clientSecretKey": { + "default": "client-secret", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "secretRef" + ], + "type": "object", + "additionalProperties": false + }, + "passwordGrant": { + "description": "ClusterPasswordGrantSpec configures password-grant authentication\nfor cluster-scoped instances.", + "properties": { + "secretRef": { + "description": "ClusterPasswordGrantSecretRefSpec references an admin-credentials Secret.\nNamespace is required because the resource is cluster-scoped.", + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + }, + "passwordKey": { + "default": "password", + "type": "string" + }, + "usernameKey": { + "default": "username", + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false }, - "passwordKey": { - "default": "password", - "description": "PasswordKey is the key in the secret for the password (defaults to \"password\")", - "type": "string" - }, - "usernameKey": { - "default": "username", - "description": "UsernameKey is the key in the secret for the username (defaults to \"username\")", + "username": { + "description": "Username, when set, overrides secretRef.usernameKey.", "type": "string" } }, "required": [ - "name", - "namespace" + "secretRef" ], "type": "object", "additionalProperties": false } }, - "required": [ - "secretRef" - ], "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of auth.passwordGrant or auth.clientCredentials must be set", + "rule": "has(self.passwordGrant) != has(self.clientCredentials)" + } + ], "additionalProperties": false }, + "baseUrl": { + "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", + "type": "string" + }, "realm": { "description": "Realm is the admin realm (defaults to \"master\")", "type": "string" }, + "tls": { + "description": "TLS configures how the operator verifies the Keycloak server certificate.", + "properties": { + "caCert": { + "description": "ClusterCACertSource references a Secret or ConfigMap key containing a\nPEM-encoded CA bundle. Exactly one of secretRef or configMapRef must be set.", + "properties": { + "configMapRef": { + "description": "ClusterCACertConfigMapRefSpec is the cluster-scoped variant; namespace required.", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false + }, + "secretRef": { + "description": "ClusterCACertSecretRefSpec is the cluster-scoped variant; namespace required.", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of caCert.secretRef or caCert.configMapRef must be set", + "rule": "has(self.secretRef) != has(self.configMapRef)" + } + ], + "additionalProperties": false + }, + "insecureSkipVerify": { + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, "token": { "description": "Token contains optional token caching configuration", "properties": { @@ -101,8 +200,8 @@ } }, "required": [ - "baseUrl", - "credentials" + "auth", + "baseUrl" ], "type": "object", "additionalProperties": false diff --git a/crdSchemas/contentitem_v1alpha1.json b/crdSchemas/contentitem_v1alpha1.json new file mode 100644 index 0000000..e505aaf --- /dev/null +++ b/crdSchemas/contentitem_v1alpha1.json @@ -0,0 +1,170 @@ +{ + "description": "ContentItem defines additional documentation for given resource.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "type": "object" + }, + "spec": { + "description": "Defines the documentation to attach to the referenced resource.", + "properties": { + "content": { + "description": "Content is the valid markdown content.", + "maxLength": 1500000, + "type": "string" + }, + "link": { + "description": "Link is the link to the content.", + "properties": { + "href": { + "description": "Href is the public URL of the content.", + "type": "string", + "x-kubernetes-validations": [ + { + "message": "must be a valid URL", + "rule": "isURL(self)" + } + ] + } + }, + "required": [ + "href" + ], + "type": "object", + "additionalProperties": false + }, + "order": { + "description": "Order defines the order of the content in the UI.", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "parentRef": { + "description": "ParentRef is the reference to the resource that this content belongs to.", + "properties": { + "kind": { + "description": "Kind is the kind of the resource that this content belongs to.", + "enum": [ + "APIPortal", + "API", + "APIBundle" + ], + "type": "string" + }, + "name": { + "description": "Name is the name of the resource that this content belongs to.", + "maxLength": 253, + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "title": { + "description": "Title is the public-facing name of the ContentItem.", + "maxLength": 253, + "minLength": 1, + "type": "string" + } + }, + "required": [ + "order", + "parentRef", + "title" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of content or link must be specified", + "rule": "[has(self.content), has(self.link)].filter(x, x).size() == 1" + } + ], + "additionalProperties": false + }, + "status": { + "description": "The current status of this ContentItem.", + "properties": { + "conditions": { + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "hash": { + "description": "Hash is a hash representing the ContentItem.", + "type": "string" + }, + "syncedAt": { + "format": "date-time", + "type": "string" + }, + "version": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object" +} diff --git a/crdSchemas/ingressroute_v1alpha1.json b/crdSchemas/ingressroute_v1alpha1.json index df9db15..bf93fe9 100644 --- a/crdSchemas/ingressroute_v1alpha1.json +++ b/crdSchemas/ingressroute_v1alpha1.json @@ -16,14 +16,18 @@ "description": "IngressRouteSpec defines the desired state of IngressRoute.", "properties": { "entryPoints": { - "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.", + "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/entrypoints/\nDefault: all.", "items": { "type": "string" }, "type": "array" }, + "ingressClassName": { + "description": "IngressClassName defines the name of the IngressClass cluster resource.", + "type": "string" + }, "parentRefs": { - "description": "ParentRefs defines references to parent IngressRoute resources for multi-layer routing.\nWhen set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.\nMore info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs", + "description": "ParentRefs defines references to parent IngressRoute resources for multi-layer routing.\nWhen set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.\nMore info: https://doc.traefik.io/traefik/v3.7/routing/routers/#parentrefs", "items": { "description": "IngressRouteRef is a reference to an IngressRoute resource.", "properties": { @@ -57,11 +61,11 @@ "type": "string" }, "match": { - "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/", + "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/rules-and-priority/", "type": "string" }, "middlewares": { - "description": "Middlewares defines the list of references to Middleware resources.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/", + "description": "Middlewares defines the list of references to Middleware resources.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/middleware/", "items": { "description": "MiddlewareRef is a reference to a Middleware resource.", "properties": { @@ -83,7 +87,7 @@ "type": "array" }, "observability": { - "description": "Observability defines the observability configuration for a router.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/", + "description": "Observability defines the observability configuration for a router.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/observability/", "properties": { "accessLogs": { "description": "AccessLogs enables access logs for this router.", @@ -111,7 +115,7 @@ "additionalProperties": false }, "priority": { - "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority", + "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/rules-and-priority/#priority", "maximum": 9223372036854775000, "type": "integer" }, @@ -210,6 +214,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -285,7 +311,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -315,7 +341,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -357,7 +386,7 @@ "type": "array" }, "syntax": { - "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", + "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", "type": "string" } }, @@ -370,14 +399,14 @@ "type": "array" }, "tls": { - "description": "TLS defines the TLS configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls", + "description": "TLS defines the TLS configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/router/#tls", "properties": { "certResolver": { - "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/", + "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/tls/certificate-resolvers/acme/", "type": "string" }, "domains": { - "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains", + "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#domains", "items": { "description": "Domain holds a domain name with SANs.", "properties": { @@ -399,14 +428,14 @@ "type": "array" }, "options": { - "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/", + "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-options/", "properties": { "name": { - "description": "Name defines the name of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/", + "description": "Name defines the name of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsoption/", "type": "string" }, "namespace": { - "description": "Namespace defines the namespace of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/", + "description": "Namespace defines the namespace of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsoption/", "type": "string" } }, @@ -424,11 +453,11 @@ "description": "Store defines the reference to the TLSStore, that will be used to store certificates.\nPlease note that only `default` TLSStore can be used.", "properties": { "name": { - "description": "Name defines the name of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/", + "description": "Name defines the name of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsstore/", "type": "string" }, "namespace": { - "description": "Namespace defines the namespace of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/", + "description": "Namespace defines the namespace of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsstore/", "type": "string" } }, diff --git a/crdSchemas/ingressroutetcp_v1alpha1.json b/crdSchemas/ingressroutetcp_v1alpha1.json index f5ef78e..dab584d 100644 --- a/crdSchemas/ingressroutetcp_v1alpha1.json +++ b/crdSchemas/ingressroutetcp_v1alpha1.json @@ -16,19 +16,23 @@ "description": "IngressRouteTCPSpec defines the desired state of IngressRouteTCP.", "properties": { "entryPoints": { - "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.", + "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/entrypoints/\nDefault: all.", "items": { "type": "string" }, "type": "array" }, + "ingressClassName": { + "description": "IngressClassName defines the name of the IngressClass cluster resource.", + "type": "string" + }, "routes": { "description": "Routes defines the list of routes.", "items": { "description": "RouteTCP holds the TCP route configuration.", "properties": { "match": { - "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/", + "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/rules-and-priority/", "type": "string" }, "middlewares": { @@ -54,7 +58,7 @@ "type": "array" }, "priority": { - "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority", + "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/rules-and-priority/#priority", "maximum": 9223372036854775000, "type": "integer" }, @@ -92,7 +96,7 @@ "x-kubernetes-int-or-string": true }, "proxyProtocol": { - "description": "ProxyProtocol defines the PROXY protocol configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol\n\nDeprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.", + "description": "ProxyProtocol defines the PROXY protocol configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/service/#proxy-protocol\n\nDeprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.", "properties": { "version": { "description": "Version defines the PROXY Protocol version to use.", @@ -132,7 +136,7 @@ "type": "array" }, "syntax": { - "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", + "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", "enum": [ "v3", "v2" @@ -149,14 +153,14 @@ "type": "array" }, "tls": { - "description": "TLS defines the TLS configuration on a layer 4 / TCP Route.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls", + "description": "TLS defines the TLS configuration on a layer 4 / TCP Route.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/router/#tls", "properties": { "certResolver": { - "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/", + "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/tls/certificate-resolvers/acme/", "type": "string" }, "domains": { - "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains", + "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/tls/#domains", "items": { "description": "Domain holds a domain name with SANs.", "properties": { @@ -178,7 +182,7 @@ "type": "array" }, "options": { - "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options", + "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/tls/#tls-options", "properties": { "name": { "description": "Name defines the name of the referenced Traefik resource.", diff --git a/crdSchemas/ingressrouteudp_v1alpha1.json b/crdSchemas/ingressrouteudp_v1alpha1.json index c3bb920..7855328 100644 --- a/crdSchemas/ingressrouteudp_v1alpha1.json +++ b/crdSchemas/ingressrouteudp_v1alpha1.json @@ -16,12 +16,16 @@ "description": "IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.", "properties": { "entryPoints": { - "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.", + "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/entrypoints/\nDefault: all.", "items": { "type": "string" }, "type": "array" }, + "ingressClassName": { + "description": "IngressClassName defines the name of the IngressClass cluster resource.", + "type": "string" + }, "routes": { "description": "Routes defines the list of routes.", "items": { diff --git a/crdSchemas/keycloakclient_v1beta1.json b/crdSchemas/keycloakclient_v1beta1.json index 53a29b7..fab15e2 100644 --- a/crdSchemas/keycloakclient_v1beta1.json +++ b/crdSchemas/keycloakclient_v1beta1.json @@ -20,7 +20,7 @@ "type": "string" }, "clientSecretRef": { - "description": "ClientSecretRef configures the Kubernetes Secret for client credentials.\nIf the secret exists, its value is used. If it doesn't exist and Create is true,\nthe operator auto-generates a secret and creates it.", + "description": "ClientSecretRef configures the Kubernetes Secret for client credentials.\nIf the secret exists, its value is used. If it doesn't exist and Create is true,\nthe operator auto-generates a secret and creates it.\nFor public clients (publicClient: true) the Secret is still materialised\nwhen ClientSecretRef is set, but only contains the client-id key \u2014 there\nis no client_secret to store.", "properties": { "clientIdKey": { "description": "ClientIdKey is the key for the client ID in the secret.\nDefaults to \"client-id\".", diff --git a/crdSchemas/keycloakidentityprovider_v1beta1.json b/crdSchemas/keycloakidentityprovider_v1beta1.json index ad007b6..944d4ab 100644 --- a/crdSchemas/keycloakidentityprovider_v1beta1.json +++ b/crdSchemas/keycloakidentityprovider_v1beta1.json @@ -65,6 +65,23 @@ ], "type": "object", "additionalProperties": false + }, + "tokenExchange": { + "description": "TokenExchange configures fine-grained-authz so that exactly the listed\nclients (and no others) may exchange tokens with this IdP as\n`subject_issuer`. Omit the field to leave token-exchange permissions\nunmanaged (whatever was clicked manually stays). Set to a list (possibly\nempty) to have the operator enable IdP permissions and bind a Client-type\npolicy listing the allowed clients on the `token-exchange` scope\npermission in the realm-management authz resource server.", + "properties": { + "allowedClients": { + "description": "AllowedClients is the list of clientIds (text, not UUIDs) in the same\nrealm as the IdP that are permitted to perform token-exchange against\nthis IdP. An empty list creates a policy that matches no clients,\neffectively denying all (useful as an explicit lockdown). Omitting the\nparent `tokenExchange` field entirely leaves Keycloak permissions\nuntouched.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "allowedClients" + ], + "type": "object", + "additionalProperties": false } }, "required": [ @@ -177,6 +194,33 @@ "status": { "description": "Status is a human-readable status message", "type": "string" + }, + "tokenExchange": { + "description": "TokenExchange contains the observed state of the token-exchange\npermission wiring, populated only when spec.tokenExchange is set.", + "properties": { + "enabled": { + "description": "Enabled reflects whether fine-grained authz permissions are enabled on\nthis IdP in Keycloak.", + "type": "boolean" + }, + "message": { + "description": "Message carries the last token-exchange reconcile error, if any. Set\nonly when token-exchange reconcile fails \u2014 the parent `status.ready`\nstill reflects the IdP itself, not the TE side.", + "type": "string" + }, + "permissionID": { + "description": "PermissionID is the ID of the `token-exchange` scope permission auto-\ncreated in the realm-management authz resource server when permissions\nare enabled on this IdP.", + "type": "string" + }, + "policyID": { + "description": "PolicyID is the ID of the Client-type authz policy managed by the\noperator (carries the AllowedClients list).", + "type": "string" + }, + "policyName": { + "description": "PolicyName is the name of the managed policy, useful for admins\nlooking the resource up in the Keycloak UI.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false } }, "required": [ diff --git a/crdSchemas/keycloakidentityprovidermapper_v1beta1.json b/crdSchemas/keycloakidentityprovidermapper_v1beta1.json new file mode 100644 index 0000000..1bec245 --- /dev/null +++ b/crdSchemas/keycloakidentityprovidermapper_v1beta1.json @@ -0,0 +1,180 @@ +{ + "description": "KeycloakIdentityProviderMapper defines a mapper attached to a KeycloakIdentityProvider", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "type": "object" + }, + "spec": { + "description": "KeycloakIdentityProviderMapperSpec defines the desired state of KeycloakIdentityProviderMapper", + "properties": { + "definition": { + "description": "Definition contains the Keycloak IdentityProviderMapperRepresentation.\nThe identityProviderAlias field is auto-injected from the parent\nKeycloakIdentityProvider at reconcile time and does not need to be set\nhere.", + "type": "object", + "x-kubernetes-preserve-unknown-fields": true + }, + "identityProviderRef": { + "description": "IdentityProviderRef is a reference to a KeycloakIdentityProvider that owns\nthis mapper. The realm and Keycloak instance are derived from the parent\nidentity provider.", + "properties": { + "name": { + "description": "Name of the resource", + "type": "string" + }, + "namespace": { + "description": "Namespace of the resource (optional, defaults to the same namespace)", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "definition", + "identityProviderRef" + ], + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "KeycloakIdentityProviderMapperStatus defines the observed state of KeycloakIdentityProviderMapper", + "properties": { + "conditions": { + "description": "Conditions represent the latest available observations", + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "identityProviderAlias": { + "description": "IdentityProviderAlias is the alias of the parent identity provider", + "type": "string" + }, + "instance": { + "description": "Instance contains the resolved instance reference", + "properties": { + "clusterInstanceRef": { + "description": "ClusterInstanceRef is the name of the cluster instance", + "type": "string" + }, + "instanceRef": { + "description": "InstanceRef is the name of the namespaced instance", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "mapperID": { + "description": "MapperID is the Keycloak internal mapper ID", + "type": "string" + }, + "mapperName": { + "description": "MapperName is the mapper name in Keycloak", + "type": "string" + }, + "message": { + "description": "Message contains additional information", + "type": "string" + }, + "observedGeneration": { + "description": "ObservedGeneration is the generation of the spec that was last processed", + "format": "int64", + "type": "integer" + }, + "ready": { + "description": "Ready indicates if the identity provider mapper is ready", + "type": "boolean" + }, + "realm": { + "description": "Realm contains the resolved realm reference", + "properties": { + "clusterRealmRef": { + "description": "ClusterRealmRef is the name of the cluster realm", + "type": "string" + }, + "realmRef": { + "description": "RealmRef is the name of the namespaced realm", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "resourcePath": { + "description": "ResourcePath is the Keycloak API path for this identity provider mapper", + "type": "string" + }, + "status": { + "description": "Status is a human-readable status message", + "type": "string" + } + }, + "required": [ + "ready" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object" +} diff --git a/crdSchemas/keycloakinstance_v1beta1.json b/crdSchemas/keycloakinstance_v1beta1.json index 83548a5..50cc6f9 100644 --- a/crdSchemas/keycloakinstance_v1beta1.json +++ b/crdSchemas/keycloakinstance_v1beta1.json @@ -15,70 +15,173 @@ "spec": { "description": "KeycloakInstanceSpec defines the desired state of KeycloakInstance", "properties": { - "baseUrl": { - "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", - "type": "string" - }, - "client": { - "description": "Client contains optional service account client configuration", + "auth": { + "description": "Auth selects how the operator authenticates to Keycloak.\nExactly one of auth.passwordGrant or auth.clientCredentials must be set.", "properties": { - "id": { - "description": "ID is the client ID for service account authentication", - "type": "string" - }, - "secret": { - "description": "Secret is the client secret (optional for public clients)", - "type": "string" - } - }, - "required": [ - "id" - ], - "type": "object", - "additionalProperties": false - }, - "credentials": { - "description": "Credentials contains the reference to the admin credentials secret", - "properties": { - "secretRef": { - "description": "SecretRef contains the reference to the secret with credentials", + "clientCredentials": { + "description": "ClientCredentials configures OAuth2 client_credentials grant\nauthentication via a confidential client / service account.", "properties": { - "name": { - "description": "Name is the name of the secret", + "clientId": { + "description": "ClientID, when set, overrides the value read from secretRef.clientIdKey.\nThe client ID is not a secret, so providing it inline is allowed.", "type": "string" }, - "namespace": { - "description": "Namespace is the namespace of the secret (defaults to resource namespace)", - "type": "string" + "secretRef": { + "description": "ClientCredentialsSecretRefSpec references a Secret containing client credentials.", + "properties": { + "clientIdKey": { + "default": "client-id", + "description": "ClientIdKey is ignored when ClientCredentialsSpec.ClientID is set.", + "type": "string" + }, + "clientSecretKey": { + "default": "client-secret", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "secretRef" + ], + "type": "object", + "additionalProperties": false + }, + "passwordGrant": { + "description": "PasswordGrant configures resource-owner password grant authentication\nagainst a user account (typically the master-realm admin).", + "properties": { + "secretRef": { + "description": "PasswordGrantSecretRefSpec references a Secret containing admin credentials.", + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + }, + "passwordKey": { + "default": "password", + "type": "string" + }, + "usernameKey": { + "default": "username", + "description": "UsernameKey is ignored when PasswordGrantSpec.Username is set.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false }, - "passwordKey": { - "default": "password", - "description": "PasswordKey is the key in the secret for the password (defaults to \"password\")", - "type": "string" - }, - "usernameKey": { - "default": "username", - "description": "UsernameKey is the key in the secret for the username (defaults to \"username\")", + "username": { + "description": "Username, when set, overrides the value read from secretRef.usernameKey.\nThe admin username is not a secret, so providing it inline is allowed.", "type": "string" } }, "required": [ - "name" + "secretRef" ], "type": "object", "additionalProperties": false } }, - "required": [ - "secretRef" - ], "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of auth.passwordGrant or auth.clientCredentials must be set", + "rule": "has(self.passwordGrant) != has(self.clientCredentials)" + } + ], "additionalProperties": false }, + "baseUrl": { + "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", + "type": "string" + }, "realm": { "description": "Realm is the admin realm (defaults to \"master\")", "type": "string" }, + "tls": { + "description": "TLS configures how the operator verifies the Keycloak server certificate.", + "properties": { + "caCert": { + "description": "CACert references a Secret or ConfigMap holding a PEM-encoded CA bundle\nused to verify the Keycloak server certificate.", + "properties": { + "configMapRef": { + "description": "CACertConfigMapRefSpec references a ConfigMap key holding a PEM-encoded CA\nbundle (e.g. kube-root-ca.crt or a cert-manager CA bundle).", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "secretRef": { + "description": "CACertSecretRefSpec references a Secret key holding a PEM-encoded CA bundle.", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of caCert.secretRef or caCert.configMapRef must be set", + "rule": "has(self.secretRef) != has(self.configMapRef)" + } + ], + "additionalProperties": false + }, + "insecureSkipVerify": { + "description": "InsecureSkipVerify disables TLS certificate verification. Do not enable\nin production.", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, "token": { "description": "Token contains optional token caching configuration", "properties": { @@ -100,8 +203,8 @@ } }, "required": [ - "baseUrl", - "credentials" + "auth", + "baseUrl" ], "type": "object", "additionalProperties": false diff --git a/crdSchemas/managedsubscription_v1alpha1.json b/crdSchemas/managedsubscription_v1alpha1.json index fef7ab1..680c602 100644 --- a/crdSchemas/managedsubscription_v1alpha1.json +++ b/crdSchemas/managedsubscription_v1alpha1.json @@ -130,7 +130,7 @@ ] }, "applications": { - "description": "Applications references the Applications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same AppID.\nDeprecated: Use ManagedApplications instead.", + "description": "Applications references the Applications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same AppID.\n\nDeprecated: Use ManagedApplications instead.", "items": { "description": "ApplicationReference references an Application.", "properties": { diff --git a/crdSchemas/master-standalone/api-stable-v1alpha1.json b/crdSchemas/master-standalone/api-stable-v1alpha1.json index 02f3396..85a3e02 100644 --- a/crdSchemas/master-standalone/api-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/api-stable-v1alpha1.json @@ -218,6 +218,10 @@ } ] }, + "validateRequestBodySchema": { + "description": "ValidateRequestBodySchema validates the request body against the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", + "type": "boolean" + }, "validateRequestMethodAndPath": { "description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", "type": "boolean" diff --git a/crdSchemas/master-standalone/apiauth-stable-v1alpha1.json b/crdSchemas/master-standalone/apiauth-stable-v1alpha1.json index 01337bd..4d8c5c5 100644 --- a/crdSchemas/master-standalone/apiauth-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/apiauth-stable-v1alpha1.json @@ -17,8 +17,36 @@ "properties": { "apiKey": { "description": "APIKey configures API key authentication.", + "properties": { + "keySource": { + "description": "KeySource defines where to extract the API key from requests.\nWhen not specified, defaults to \"Authorization\" header with \"Bearer\" scheme and \"api_key\" query parameter.\nWhen specified, it completely overrides defaults - fields left empty will disable that extraction method.", + "minProperties": 1, + "properties": { + "header": { + "description": "Header is the name of the header containing the API key.", + "type": "string" + }, + "headerAuthScheme": { + "description": "HeaderAuthScheme is the authentication scheme prefix in the header value.\nThe scheme is used to parse headers in the format \" \".\nOnly applies when header is \"Authorization\".", + "type": "string" + }, + "query": { + "description": "Query is the name of the query parameter containing the API key.", + "type": "string" + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "headerAuthScheme can only be used when header is 'Authorization'", + "rule": "!has(self.headerAuthScheme) || self.header == 'Authorization'" + } + ], + "additionalProperties": false + } + }, "type": "object", - "x-kubernetes-preserve-unknown-fields": true + "additionalProperties": false }, "isDefault": { "description": "IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.\nOnly one APIAuth per namespace should have isDefault set to true.", @@ -43,7 +71,7 @@ "type": "string" }, "jwksUrl": { - "description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.", + "description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\n\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.", "type": "string", "x-kubernetes-validations": [ { diff --git a/crdSchemas/master-standalone/apiversion-stable-v1alpha1.json b/crdSchemas/master-standalone/apiversion-stable-v1alpha1.json index 903fed2..e20bb0f 100644 --- a/crdSchemas/master-standalone/apiversion-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/apiversion-stable-v1alpha1.json @@ -218,6 +218,10 @@ } ] }, + "validateRequestBodySchema": { + "description": "ValidateRequestBodySchema validates the request body against the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", + "type": "boolean" + }, "validateRequestMethodAndPath": { "description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", "type": "boolean" diff --git a/crdSchemas/master-standalone/clusterkeycloakinstance-stable-v1beta1.json b/crdSchemas/master-standalone/clusterkeycloakinstance-stable-v1beta1.json index ecd0bba..b1a03e4 100644 --- a/crdSchemas/master-standalone/clusterkeycloakinstance-stable-v1beta1.json +++ b/crdSchemas/master-standalone/clusterkeycloakinstance-stable-v1beta1.json @@ -13,73 +13,172 @@ "type": "object" }, "spec": { - "description": "ClusterKeycloakInstanceSpec defines the desired state of ClusterKeycloakInstance\nIt mirrors KeycloakInstanceSpec but is cluster-scoped", + "description": "ClusterKeycloakInstanceSpec defines the desired state of ClusterKeycloakInstance.\nIt mirrors KeycloakInstanceSpec but is cluster-scoped: secret references must\nspecify a namespace explicitly.", "properties": { - "baseUrl": { - "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", - "type": "string" - }, - "client": { - "description": "Client contains optional service account client configuration", + "auth": { + "description": "Auth selects how the operator authenticates to Keycloak.\nExactly one of auth.passwordGrant or auth.clientCredentials must be set.", "properties": { - "id": { - "description": "ID is the client ID for service account authentication", - "type": "string" - }, - "secret": { - "description": "Secret is the client secret (optional for public clients)", - "type": "string" - } - }, - "required": [ - "id" - ], - "type": "object", - "additionalProperties": false - }, - "credentials": { - "description": "Credentials contains the reference to the admin credentials secret", - "properties": { - "secretRef": { - "description": "SecretRef contains the reference to the secret with credentials", + "clientCredentials": { + "description": "ClusterClientCredentialsSpec configures OAuth2 client_credentials\nauthentication for cluster-scoped instances.", "properties": { - "name": { - "description": "Name is the name of the secret", + "clientId": { + "description": "ClientID, when set, overrides secretRef.clientIdKey.", "type": "string" }, - "namespace": { - "description": "Namespace is the namespace of the secret (required for cluster-scoped resources)", - "type": "string" + "secretRef": { + "description": "ClusterClientCredentialsSecretRefSpec references a client-credentials Secret.\nNamespace is required because the resource is cluster-scoped.", + "properties": { + "clientIdKey": { + "default": "client-id", + "type": "string" + }, + "clientSecretKey": { + "default": "client-secret", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "secretRef" + ], + "type": "object", + "additionalProperties": false + }, + "passwordGrant": { + "description": "ClusterPasswordGrantSpec configures password-grant authentication\nfor cluster-scoped instances.", + "properties": { + "secretRef": { + "description": "ClusterPasswordGrantSecretRefSpec references an admin-credentials Secret.\nNamespace is required because the resource is cluster-scoped.", + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + }, + "passwordKey": { + "default": "password", + "type": "string" + }, + "usernameKey": { + "default": "username", + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false }, - "passwordKey": { - "default": "password", - "description": "PasswordKey is the key in the secret for the password (defaults to \"password\")", - "type": "string" - }, - "usernameKey": { - "default": "username", - "description": "UsernameKey is the key in the secret for the username (defaults to \"username\")", + "username": { + "description": "Username, when set, overrides secretRef.usernameKey.", "type": "string" } }, "required": [ - "name", - "namespace" + "secretRef" ], "type": "object", "additionalProperties": false } }, - "required": [ - "secretRef" - ], "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of auth.passwordGrant or auth.clientCredentials must be set", + "rule": "has(self.passwordGrant) != has(self.clientCredentials)" + } + ], "additionalProperties": false }, + "baseUrl": { + "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", + "type": "string" + }, "realm": { "description": "Realm is the admin realm (defaults to \"master\")", "type": "string" }, + "tls": { + "description": "TLS configures how the operator verifies the Keycloak server certificate.", + "properties": { + "caCert": { + "description": "ClusterCACertSource references a Secret or ConfigMap key containing a\nPEM-encoded CA bundle. Exactly one of secretRef or configMapRef must be set.", + "properties": { + "configMapRef": { + "description": "ClusterCACertConfigMapRefSpec is the cluster-scoped variant; namespace required.", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false + }, + "secretRef": { + "description": "ClusterCACertSecretRefSpec is the cluster-scoped variant; namespace required.", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of caCert.secretRef or caCert.configMapRef must be set", + "rule": "has(self.secretRef) != has(self.configMapRef)" + } + ], + "additionalProperties": false + }, + "insecureSkipVerify": { + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, "token": { "description": "Token contains optional token caching configuration", "properties": { @@ -101,8 +200,8 @@ } }, "required": [ - "baseUrl", - "credentials" + "auth", + "baseUrl" ], "type": "object", "additionalProperties": false diff --git a/crdSchemas/master-standalone/contentitem-stable-v1alpha1.json b/crdSchemas/master-standalone/contentitem-stable-v1alpha1.json new file mode 100644 index 0000000..e505aaf --- /dev/null +++ b/crdSchemas/master-standalone/contentitem-stable-v1alpha1.json @@ -0,0 +1,170 @@ +{ + "description": "ContentItem defines additional documentation for given resource.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "type": "object" + }, + "spec": { + "description": "Defines the documentation to attach to the referenced resource.", + "properties": { + "content": { + "description": "Content is the valid markdown content.", + "maxLength": 1500000, + "type": "string" + }, + "link": { + "description": "Link is the link to the content.", + "properties": { + "href": { + "description": "Href is the public URL of the content.", + "type": "string", + "x-kubernetes-validations": [ + { + "message": "must be a valid URL", + "rule": "isURL(self)" + } + ] + } + }, + "required": [ + "href" + ], + "type": "object", + "additionalProperties": false + }, + "order": { + "description": "Order defines the order of the content in the UI.", + "format": "int32", + "minimum": 0, + "type": "integer" + }, + "parentRef": { + "description": "ParentRef is the reference to the resource that this content belongs to.", + "properties": { + "kind": { + "description": "Kind is the kind of the resource that this content belongs to.", + "enum": [ + "APIPortal", + "API", + "APIBundle" + ], + "type": "string" + }, + "name": { + "description": "Name is the name of the resource that this content belongs to.", + "maxLength": 253, + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object", + "additionalProperties": false + }, + "title": { + "description": "Title is the public-facing name of the ContentItem.", + "maxLength": 253, + "minLength": 1, + "type": "string" + } + }, + "required": [ + "order", + "parentRef", + "title" + ], + "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of content or link must be specified", + "rule": "[has(self.content), has(self.link)].filter(x, x).size() == 1" + } + ], + "additionalProperties": false + }, + "status": { + "description": "The current status of this ContentItem.", + "properties": { + "conditions": { + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "hash": { + "description": "Hash is a hash representing the ContentItem.", + "type": "string" + }, + "syncedAt": { + "format": "date-time", + "type": "string" + }, + "version": { + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object" +} diff --git a/crdSchemas/master-standalone/ingressroute-stable-v1alpha1.json b/crdSchemas/master-standalone/ingressroute-stable-v1alpha1.json index df9db15..bf93fe9 100644 --- a/crdSchemas/master-standalone/ingressroute-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/ingressroute-stable-v1alpha1.json @@ -16,14 +16,18 @@ "description": "IngressRouteSpec defines the desired state of IngressRoute.", "properties": { "entryPoints": { - "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.", + "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/entrypoints/\nDefault: all.", "items": { "type": "string" }, "type": "array" }, + "ingressClassName": { + "description": "IngressClassName defines the name of the IngressClass cluster resource.", + "type": "string" + }, "parentRefs": { - "description": "ParentRefs defines references to parent IngressRoute resources for multi-layer routing.\nWhen set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.\nMore info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs", + "description": "ParentRefs defines references to parent IngressRoute resources for multi-layer routing.\nWhen set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.\nMore info: https://doc.traefik.io/traefik/v3.7/routing/routers/#parentrefs", "items": { "description": "IngressRouteRef is a reference to an IngressRoute resource.", "properties": { @@ -57,11 +61,11 @@ "type": "string" }, "match": { - "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/", + "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/rules-and-priority/", "type": "string" }, "middlewares": { - "description": "Middlewares defines the list of references to Middleware resources.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/", + "description": "Middlewares defines the list of references to Middleware resources.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/middleware/", "items": { "description": "MiddlewareRef is a reference to a Middleware resource.", "properties": { @@ -83,7 +87,7 @@ "type": "array" }, "observability": { - "description": "Observability defines the observability configuration for a router.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/", + "description": "Observability defines the observability configuration for a router.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/observability/", "properties": { "accessLogs": { "description": "AccessLogs enables access logs for this router.", @@ -111,7 +115,7 @@ "additionalProperties": false }, "priority": { - "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority", + "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/rules-and-priority/#priority", "maximum": 9223372036854775000, "type": "integer" }, @@ -210,6 +214,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -285,7 +311,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -315,7 +341,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -357,7 +386,7 @@ "type": "array" }, "syntax": { - "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", + "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", "type": "string" } }, @@ -370,14 +399,14 @@ "type": "array" }, "tls": { - "description": "TLS defines the TLS configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls", + "description": "TLS defines the TLS configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/routing/router/#tls", "properties": { "certResolver": { - "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/", + "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/tls/certificate-resolvers/acme/", "type": "string" }, "domains": { - "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains", + "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#domains", "items": { "description": "Domain holds a domain name with SANs.", "properties": { @@ -399,14 +428,14 @@ "type": "array" }, "options": { - "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/", + "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-options/", "properties": { "name": { - "description": "Name defines the name of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/", + "description": "Name defines the name of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsoption/", "type": "string" }, "namespace": { - "description": "Namespace defines the namespace of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/", + "description": "Namespace defines the namespace of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsoption/", "type": "string" } }, @@ -424,11 +453,11 @@ "description": "Store defines the reference to the TLSStore, that will be used to store certificates.\nPlease note that only `default` TLSStore can be used.", "properties": { "name": { - "description": "Name defines the name of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/", + "description": "Name defines the name of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsstore/", "type": "string" }, "namespace": { - "description": "Namespace defines the namespace of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/", + "description": "Namespace defines the namespace of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsstore/", "type": "string" } }, diff --git a/crdSchemas/master-standalone/ingressroutetcp-stable-v1alpha1.json b/crdSchemas/master-standalone/ingressroutetcp-stable-v1alpha1.json index f5ef78e..dab584d 100644 --- a/crdSchemas/master-standalone/ingressroutetcp-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/ingressroutetcp-stable-v1alpha1.json @@ -16,19 +16,23 @@ "description": "IngressRouteTCPSpec defines the desired state of IngressRouteTCP.", "properties": { "entryPoints": { - "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.", + "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/entrypoints/\nDefault: all.", "items": { "type": "string" }, "type": "array" }, + "ingressClassName": { + "description": "IngressClassName defines the name of the IngressClass cluster resource.", + "type": "string" + }, "routes": { "description": "Routes defines the list of routes.", "items": { "description": "RouteTCP holds the TCP route configuration.", "properties": { "match": { - "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/", + "description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/rules-and-priority/", "type": "string" }, "middlewares": { @@ -54,7 +58,7 @@ "type": "array" }, "priority": { - "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority", + "description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/rules-and-priority/#priority", "maximum": 9223372036854775000, "type": "integer" }, @@ -92,7 +96,7 @@ "x-kubernetes-int-or-string": true }, "proxyProtocol": { - "description": "ProxyProtocol defines the PROXY protocol configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol\n\nDeprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.", + "description": "ProxyProtocol defines the PROXY protocol configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/service/#proxy-protocol\n\nDeprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.", "properties": { "version": { "description": "Version defines the PROXY Protocol version to use.", @@ -132,7 +136,7 @@ "type": "array" }, "syntax": { - "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", + "description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.", "enum": [ "v3", "v2" @@ -149,14 +153,14 @@ "type": "array" }, "tls": { - "description": "TLS defines the TLS configuration on a layer 4 / TCP Route.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls", + "description": "TLS defines the TLS configuration on a layer 4 / TCP Route.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/routing/router/#tls", "properties": { "certResolver": { - "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/", + "description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/tls/certificate-resolvers/acme/", "type": "string" }, "domains": { - "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains", + "description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/tls/#domains", "items": { "description": "Domain holds a domain name with SANs.", "properties": { @@ -178,7 +182,7 @@ "type": "array" }, "options": { - "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options", + "description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/tls/#tls-options", "properties": { "name": { "description": "Name defines the name of the referenced Traefik resource.", diff --git a/crdSchemas/master-standalone/ingressrouteudp-stable-v1alpha1.json b/crdSchemas/master-standalone/ingressrouteudp-stable-v1alpha1.json index c3bb920..7855328 100644 --- a/crdSchemas/master-standalone/ingressrouteudp-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/ingressrouteudp-stable-v1alpha1.json @@ -16,12 +16,16 @@ "description": "IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.", "properties": { "entryPoints": { - "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.", + "description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/install-configuration/entrypoints/\nDefault: all.", "items": { "type": "string" }, "type": "array" }, + "ingressClassName": { + "description": "IngressClassName defines the name of the IngressClass cluster resource.", + "type": "string" + }, "routes": { "description": "Routes defines the list of routes.", "items": { diff --git a/crdSchemas/master-standalone/keycloakclient-stable-v1beta1.json b/crdSchemas/master-standalone/keycloakclient-stable-v1beta1.json index 53a29b7..fab15e2 100644 --- a/crdSchemas/master-standalone/keycloakclient-stable-v1beta1.json +++ b/crdSchemas/master-standalone/keycloakclient-stable-v1beta1.json @@ -20,7 +20,7 @@ "type": "string" }, "clientSecretRef": { - "description": "ClientSecretRef configures the Kubernetes Secret for client credentials.\nIf the secret exists, its value is used. If it doesn't exist and Create is true,\nthe operator auto-generates a secret and creates it.", + "description": "ClientSecretRef configures the Kubernetes Secret for client credentials.\nIf the secret exists, its value is used. If it doesn't exist and Create is true,\nthe operator auto-generates a secret and creates it.\nFor public clients (publicClient: true) the Secret is still materialised\nwhen ClientSecretRef is set, but only contains the client-id key \u2014 there\nis no client_secret to store.", "properties": { "clientIdKey": { "description": "ClientIdKey is the key for the client ID in the secret.\nDefaults to \"client-id\".", diff --git a/crdSchemas/master-standalone/keycloakidentityprovider-stable-v1beta1.json b/crdSchemas/master-standalone/keycloakidentityprovider-stable-v1beta1.json index ad007b6..944d4ab 100644 --- a/crdSchemas/master-standalone/keycloakidentityprovider-stable-v1beta1.json +++ b/crdSchemas/master-standalone/keycloakidentityprovider-stable-v1beta1.json @@ -65,6 +65,23 @@ ], "type": "object", "additionalProperties": false + }, + "tokenExchange": { + "description": "TokenExchange configures fine-grained-authz so that exactly the listed\nclients (and no others) may exchange tokens with this IdP as\n`subject_issuer`. Omit the field to leave token-exchange permissions\nunmanaged (whatever was clicked manually stays). Set to a list (possibly\nempty) to have the operator enable IdP permissions and bind a Client-type\npolicy listing the allowed clients on the `token-exchange` scope\npermission in the realm-management authz resource server.", + "properties": { + "allowedClients": { + "description": "AllowedClients is the list of clientIds (text, not UUIDs) in the same\nrealm as the IdP that are permitted to perform token-exchange against\nthis IdP. An empty list creates a policy that matches no clients,\neffectively denying all (useful as an explicit lockdown). Omitting the\nparent `tokenExchange` field entirely leaves Keycloak permissions\nuntouched.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "allowedClients" + ], + "type": "object", + "additionalProperties": false } }, "required": [ @@ -177,6 +194,33 @@ "status": { "description": "Status is a human-readable status message", "type": "string" + }, + "tokenExchange": { + "description": "TokenExchange contains the observed state of the token-exchange\npermission wiring, populated only when spec.tokenExchange is set.", + "properties": { + "enabled": { + "description": "Enabled reflects whether fine-grained authz permissions are enabled on\nthis IdP in Keycloak.", + "type": "boolean" + }, + "message": { + "description": "Message carries the last token-exchange reconcile error, if any. Set\nonly when token-exchange reconcile fails \u2014 the parent `status.ready`\nstill reflects the IdP itself, not the TE side.", + "type": "string" + }, + "permissionID": { + "description": "PermissionID is the ID of the `token-exchange` scope permission auto-\ncreated in the realm-management authz resource server when permissions\nare enabled on this IdP.", + "type": "string" + }, + "policyID": { + "description": "PolicyID is the ID of the Client-type authz policy managed by the\noperator (carries the AllowedClients list).", + "type": "string" + }, + "policyName": { + "description": "PolicyName is the name of the managed policy, useful for admins\nlooking the resource up in the Keycloak UI.", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false } }, "required": [ diff --git a/crdSchemas/master-standalone/keycloakidentityprovidermapper-stable-v1beta1.json b/crdSchemas/master-standalone/keycloakidentityprovidermapper-stable-v1beta1.json new file mode 100644 index 0000000..1bec245 --- /dev/null +++ b/crdSchemas/master-standalone/keycloakidentityprovidermapper-stable-v1beta1.json @@ -0,0 +1,180 @@ +{ + "description": "KeycloakIdentityProviderMapper defines a mapper attached to a KeycloakIdentityProvider", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "type": "object" + }, + "spec": { + "description": "KeycloakIdentityProviderMapperSpec defines the desired state of KeycloakIdentityProviderMapper", + "properties": { + "definition": { + "description": "Definition contains the Keycloak IdentityProviderMapperRepresentation.\nThe identityProviderAlias field is auto-injected from the parent\nKeycloakIdentityProvider at reconcile time and does not need to be set\nhere.", + "type": "object", + "x-kubernetes-preserve-unknown-fields": true + }, + "identityProviderRef": { + "description": "IdentityProviderRef is a reference to a KeycloakIdentityProvider that owns\nthis mapper. The realm and Keycloak instance are derived from the parent\nidentity provider.", + "properties": { + "name": { + "description": "Name of the resource", + "type": "string" + }, + "namespace": { + "description": "Namespace of the resource (optional, defaults to the same namespace)", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "definition", + "identityProviderRef" + ], + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "KeycloakIdentityProviderMapperStatus defines the observed state of KeycloakIdentityProviderMapper", + "properties": { + "conditions": { + "description": "Conditions represent the latest available observations", + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "identityProviderAlias": { + "description": "IdentityProviderAlias is the alias of the parent identity provider", + "type": "string" + }, + "instance": { + "description": "Instance contains the resolved instance reference", + "properties": { + "clusterInstanceRef": { + "description": "ClusterInstanceRef is the name of the cluster instance", + "type": "string" + }, + "instanceRef": { + "description": "InstanceRef is the name of the namespaced instance", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "mapperID": { + "description": "MapperID is the Keycloak internal mapper ID", + "type": "string" + }, + "mapperName": { + "description": "MapperName is the mapper name in Keycloak", + "type": "string" + }, + "message": { + "description": "Message contains additional information", + "type": "string" + }, + "observedGeneration": { + "description": "ObservedGeneration is the generation of the spec that was last processed", + "format": "int64", + "type": "integer" + }, + "ready": { + "description": "Ready indicates if the identity provider mapper is ready", + "type": "boolean" + }, + "realm": { + "description": "Realm contains the resolved realm reference", + "properties": { + "clusterRealmRef": { + "description": "ClusterRealmRef is the name of the cluster realm", + "type": "string" + }, + "realmRef": { + "description": "RealmRef is the name of the namespaced realm", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "resourcePath": { + "description": "ResourcePath is the Keycloak API path for this identity provider mapper", + "type": "string" + }, + "status": { + "description": "Status is a human-readable status message", + "type": "string" + } + }, + "required": [ + "ready" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object" +} diff --git a/crdSchemas/master-standalone/keycloakinstance-stable-v1beta1.json b/crdSchemas/master-standalone/keycloakinstance-stable-v1beta1.json index 83548a5..50cc6f9 100644 --- a/crdSchemas/master-standalone/keycloakinstance-stable-v1beta1.json +++ b/crdSchemas/master-standalone/keycloakinstance-stable-v1beta1.json @@ -15,70 +15,173 @@ "spec": { "description": "KeycloakInstanceSpec defines the desired state of KeycloakInstance", "properties": { - "baseUrl": { - "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", - "type": "string" - }, - "client": { - "description": "Client contains optional service account client configuration", + "auth": { + "description": "Auth selects how the operator authenticates to Keycloak.\nExactly one of auth.passwordGrant or auth.clientCredentials must be set.", "properties": { - "id": { - "description": "ID is the client ID for service account authentication", - "type": "string" - }, - "secret": { - "description": "Secret is the client secret (optional for public clients)", - "type": "string" - } - }, - "required": [ - "id" - ], - "type": "object", - "additionalProperties": false - }, - "credentials": { - "description": "Credentials contains the reference to the admin credentials secret", - "properties": { - "secretRef": { - "description": "SecretRef contains the reference to the secret with credentials", + "clientCredentials": { + "description": "ClientCredentials configures OAuth2 client_credentials grant\nauthentication via a confidential client / service account.", "properties": { - "name": { - "description": "Name is the name of the secret", + "clientId": { + "description": "ClientID, when set, overrides the value read from secretRef.clientIdKey.\nThe client ID is not a secret, so providing it inline is allowed.", "type": "string" }, - "namespace": { - "description": "Namespace is the namespace of the secret (defaults to resource namespace)", - "type": "string" + "secretRef": { + "description": "ClientCredentialsSecretRefSpec references a Secret containing client credentials.", + "properties": { + "clientIdKey": { + "default": "client-id", + "description": "ClientIdKey is ignored when ClientCredentialsSpec.ClientID is set.", + "type": "string" + }, + "clientSecretKey": { + "default": "client-secret", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "secretRef" + ], + "type": "object", + "additionalProperties": false + }, + "passwordGrant": { + "description": "PasswordGrant configures resource-owner password grant authentication\nagainst a user account (typically the master-realm admin).", + "properties": { + "secretRef": { + "description": "PasswordGrantSecretRefSpec references a Secret containing admin credentials.", + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + }, + "passwordKey": { + "default": "password", + "type": "string" + }, + "usernameKey": { + "default": "username", + "description": "UsernameKey is ignored when PasswordGrantSpec.Username is set.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false }, - "passwordKey": { - "default": "password", - "description": "PasswordKey is the key in the secret for the password (defaults to \"password\")", - "type": "string" - }, - "usernameKey": { - "default": "username", - "description": "UsernameKey is the key in the secret for the username (defaults to \"username\")", + "username": { + "description": "Username, when set, overrides the value read from secretRef.usernameKey.\nThe admin username is not a secret, so providing it inline is allowed.", "type": "string" } }, "required": [ - "name" + "secretRef" ], "type": "object", "additionalProperties": false } }, - "required": [ - "secretRef" - ], "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of auth.passwordGrant or auth.clientCredentials must be set", + "rule": "has(self.passwordGrant) != has(self.clientCredentials)" + } + ], "additionalProperties": false }, + "baseUrl": { + "description": "BaseUrl is the URL of the Keycloak server (e.g., http://keycloak:8080)", + "type": "string" + }, "realm": { "description": "Realm is the admin realm (defaults to \"master\")", "type": "string" }, + "tls": { + "description": "TLS configures how the operator verifies the Keycloak server certificate.", + "properties": { + "caCert": { + "description": "CACert references a Secret or ConfigMap holding a PEM-encoded CA bundle\nused to verify the Keycloak server certificate.", + "properties": { + "configMapRef": { + "description": "CACertConfigMapRefSpec references a ConfigMap key holding a PEM-encoded CA\nbundle (e.g. kube-root-ca.crt or a cert-manager CA bundle).", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "secretRef": { + "description": "CACertSecretRefSpec references a Secret key holding a PEM-encoded CA bundle.", + "properties": { + "key": { + "default": "ca.crt", + "type": "string" + }, + "name": { + "type": "string" + }, + "namespace": { + "description": "Namespace defaults to the KeycloakInstance namespace when unset.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "x-kubernetes-validations": [ + { + "message": "exactly one of caCert.secretRef or caCert.configMapRef must be set", + "rule": "has(self.secretRef) != has(self.configMapRef)" + } + ], + "additionalProperties": false + }, + "insecureSkipVerify": { + "description": "InsecureSkipVerify disables TLS certificate verification. Do not enable\nin production.", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, "token": { "description": "Token contains optional token caching configuration", "properties": { @@ -100,8 +203,8 @@ } }, "required": [ - "baseUrl", - "credentials" + "auth", + "baseUrl" ], "type": "object", "additionalProperties": false diff --git a/crdSchemas/master-standalone/managedsubscription-stable-v1alpha1.json b/crdSchemas/master-standalone/managedsubscription-stable-v1alpha1.json index fef7ab1..680c602 100644 --- a/crdSchemas/master-standalone/managedsubscription-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/managedsubscription-stable-v1alpha1.json @@ -130,7 +130,7 @@ ] }, "applications": { - "description": "Applications references the Applications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same AppID.\nDeprecated: Use ManagedApplications instead.", + "description": "Applications references the Applications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same AppID.\n\nDeprecated: Use ManagedApplications instead.", "items": { "description": "ApplicationReference references an Application.", "properties": { diff --git a/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1alpha1.json b/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1alpha1.json index 308902d..29bb0e0 100644 --- a/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1alpha1.json @@ -137,7 +137,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -147,6 +147,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -365,7 +390,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", @@ -900,6 +925,10 @@ "type": "object", "additionalProperties": false }, + "obo": { + "description": "OBO configures On-Behalf-Of (OBO) authentication.\nOnly used when Type is \"obo\". The inner schema is intentionally empty in\nthis revision; sub-fields land in a follow-up. Setting this field on an\nupstream-only build will cause the MCPExternalAuthConfig to transition to\nstatus.conditions[Valid] = False with Reason: EnterpriseRequired.", + "type": "object" + }, "tokenExchange": { "description": "TokenExchange configures RFC-8693 OAuth 2.0 Token Exchange\nOnly used when Type is \"tokenExchange\"", "properties": { @@ -964,7 +993,7 @@ "additionalProperties": false }, "type": { - "description": "Type is the type of external authentication to configure", + "description": "Type is the type of external authentication to configure.\nWhen set to \"obo\", the cluster must run a build that has registered an\nOBO handler via controllerutil.RegisterOBOHandler; upstream-only builds\nsurface status.conditions[Valid] = False with Reason: EnterpriseRequired\nfor obo-typed configs.", "enum": [ "tokenExchange", "headerInjection", @@ -972,7 +1001,8 @@ "unauthenticated", "embeddedAuthServer", "awsSts", - "upstreamInject" + "upstreamInject", + "obo" ], "type": "string" }, @@ -1021,9 +1051,13 @@ "message": "upstreamInject configuration must be set if and only if type is 'upstreamInject'", "rule": "self.type == 'upstreamInject' ? has(self.upstreamInject) : !has(self.upstreamInject)" }, + { + "message": "obo configuration must be set if and only if type is 'obo'", + "rule": "self.type == 'obo' ? has(self.obo) : !has(self.obo)" + }, { "message": "no configuration must be set when type is 'unauthenticated'", - "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject)) : true" + "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject) && !has(self.obo)) : true" } ], "additionalProperties": false diff --git a/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1beta1.json b/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1beta1.json index e9639a0..0d50462 100644 --- a/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1beta1.json +++ b/crdSchemas/master-standalone/mcpexternalauthconfig-stable-v1beta1.json @@ -137,7 +137,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -147,6 +147,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -365,7 +390,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", @@ -900,6 +925,10 @@ "type": "object", "additionalProperties": false }, + "obo": { + "description": "OBO configures On-Behalf-Of (OBO) authentication.\nOnly used when Type is \"obo\". The inner schema is intentionally empty in\nthis revision; sub-fields land in a follow-up. Setting this field on an\nupstream-only build will cause the MCPExternalAuthConfig to transition to\nstatus.conditions[Valid] = False with Reason: EnterpriseRequired.", + "type": "object" + }, "tokenExchange": { "description": "TokenExchange configures RFC-8693 OAuth 2.0 Token Exchange\nOnly used when Type is \"tokenExchange\"", "properties": { @@ -964,7 +993,7 @@ "additionalProperties": false }, "type": { - "description": "Type is the type of external authentication to configure", + "description": "Type is the type of external authentication to configure.\nWhen set to \"obo\", the cluster must run a build that has registered an\nOBO handler via controllerutil.RegisterOBOHandler; upstream-only builds\nsurface status.conditions[Valid] = False with Reason: EnterpriseRequired\nfor obo-typed configs.", "enum": [ "tokenExchange", "headerInjection", @@ -972,7 +1001,8 @@ "unauthenticated", "embeddedAuthServer", "awsSts", - "upstreamInject" + "upstreamInject", + "obo" ], "type": "string" }, @@ -1021,9 +1051,13 @@ "message": "upstreamInject configuration must be set if and only if type is 'upstreamInject'", "rule": "self.type == 'upstreamInject' ? has(self.upstreamInject) : !has(self.upstreamInject)" }, + { + "message": "obo configuration must be set if and only if type is 'obo'", + "rule": "self.type == 'obo' ? has(self.obo) : !has(self.obo)" + }, { "message": "no configuration must be set when type is 'unauthenticated'", - "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject)) : true" + "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject) && !has(self.obo)) : true" } ], "additionalProperties": false diff --git a/crdSchemas/master-standalone/mcpregistry-stable-v1alpha1.json b/crdSchemas/master-standalone/mcpregistry-stable-v1alpha1.json index fd95beb..3f199f2 100644 --- a/crdSchemas/master-standalone/mcpregistry-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/mcpregistry-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "MCPRegistry is the deprecated v1alpha1 version of the MCPRegistry resource.", + "description": "MCPRegistry is the deprecated v1alpha1 version of the MCPRegistry resource.\nThe MCPRegistry CRD as a whole is deprecated and will be removed in a future\nrelease; install the ToolHive registry server via the toolhive-registry-server\nHelm chart instead: https://github.com/stacklok/toolhive-registry-server", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/master-standalone/mcpregistry-stable-v1beta1.json b/crdSchemas/master-standalone/mcpregistry-stable-v1beta1.json index 4e343fa..65c4796 100644 --- a/crdSchemas/master-standalone/mcpregistry-stable-v1beta1.json +++ b/crdSchemas/master-standalone/mcpregistry-stable-v1beta1.json @@ -1,5 +1,5 @@ { - "description": "MCPRegistry is the Schema for the mcpregistries API", + "description": "MCPRegistry is the Schema for the mcpregistries API.\n\nThe MCPRegistry CRD is deprecated and will be removed in a future release.\nInstall the ToolHive registry server via the toolhive-registry-server Helm chart\ninstead: https://github.com/stacklok/toolhive-registry-server", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/master-standalone/mcpremoteproxy-stable-v1alpha1.json b/crdSchemas/master-standalone/mcpremoteproxy-stable-v1alpha1.json index 5c4d880..6f002ba 100644 --- a/crdSchemas/master-standalone/mcpremoteproxy-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/mcpremoteproxy-stable-v1alpha1.json @@ -238,7 +238,7 @@ "additionalProperties": false }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the remote MCP server under a synthetic local-user identity, with no\ntoken or credential check. Set this field to enforce identity-based access control\nper request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/master-standalone/mcpremoteproxy-stable-v1beta1.json b/crdSchemas/master-standalone/mcpremoteproxy-stable-v1beta1.json index 1ed29ab..d270e4b 100644 --- a/crdSchemas/master-standalone/mcpremoteproxy-stable-v1beta1.json +++ b/crdSchemas/master-standalone/mcpremoteproxy-stable-v1beta1.json @@ -238,7 +238,7 @@ "additionalProperties": false }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the remote MCP server under a synthetic local-user identity, with no\ntoken or credential check. Set this field to enforce identity-based access control\nper request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/master-standalone/mcpserver-stable-v1alpha1.json b/crdSchemas/master-standalone/mcpserver-stable-v1alpha1.json index df715ae..8bb1ec0 100644 --- a/crdSchemas/master-standalone/mcpserver-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/mcpserver-stable-v1alpha1.json @@ -232,7 +232,7 @@ "type": "integer" }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the MCP server under a synthetic local-user identity, with no token or\ncredential check. Set this field to enforce identity-based access control per request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/master-standalone/mcpserver-stable-v1beta1.json b/crdSchemas/master-standalone/mcpserver-stable-v1beta1.json index 76781b3..8003940 100644 --- a/crdSchemas/master-standalone/mcpserver-stable-v1beta1.json +++ b/crdSchemas/master-standalone/mcpserver-stable-v1beta1.json @@ -232,7 +232,7 @@ "type": "integer" }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the MCP server under a synthetic local-user identity, with no token or\ncredential check. Set this field to enforce identity-based access control per request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/master-standalone/middleware-stable-v1alpha1.json b/crdSchemas/master-standalone/middleware-stable-v1alpha1.json index bfc7cea..4c16c38 100644 --- a/crdSchemas/master-standalone/middleware-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/middleware-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "Middleware is the CRD implementation of a Traefik Middleware.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/", + "description": "Middleware is the CRD implementation of a Traefik Middleware.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/overview/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -16,7 +16,7 @@ "description": "MiddlewareSpec defines the desired state of a Middleware.", "properties": { "addPrefix": { - "description": "AddPrefix holds the add prefix middleware configuration.\nThis middleware updates the path of a request before forwarding it.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/addprefix/", + "description": "AddPrefix holds the add prefix middleware configuration.\nThis middleware updates the path of a request before forwarding it.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/addprefix/", "properties": { "prefix": { "description": "Prefix is the string to add before the current path in the requested URL.\nIt should include a leading slash (/).", @@ -33,10 +33,10 @@ "additionalProperties": false }, "basicAuth": { - "description": "BasicAuth holds the basic auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/", + "description": "BasicAuth holds the basic auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/basicauth/", "properties": { "headerField": { - "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/#headerfield", + "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/basicauth/#headerfield", "type": "string" }, "realm": { @@ -56,7 +56,7 @@ "additionalProperties": false }, "buffering": { - "description": "Buffering holds the buffering middleware configuration.\nThis middleware retries or limits the size of requests that can be forwarded to backends.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#maxrequestbodybytes", + "description": "Buffering holds the buffering middleware configuration.\nThis middleware retries or limits the size of requests that can be forwarded to backends.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/buffering/#maxrequestbodybytes", "properties": { "maxRequestBodyBytes": { "description": "MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).\nIf the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.\nDefault: 0 (no maximum).", @@ -79,7 +79,7 @@ "type": "integer" }, "retryExpression": { - "description": "RetryExpression defines the retry conditions.\nIt is a logical combination of functions with operators AND (&&) and OR (||).\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#retryexpression", + "description": "RetryExpression defines the retry conditions.\nIt is a logical combination of functions with operators AND (&&) and OR (||).\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/buffering/#retryexpression", "type": "string" } }, @@ -87,7 +87,7 @@ "additionalProperties": false }, "chain": { - "description": "Chain holds the configuration of the chain middleware.\nThis middleware enables to define reusable combinations of other pieces of middleware.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/chain/", + "description": "Chain holds the configuration of the chain middleware.\nThis middleware enables to define reusable combinations of other pieces of middleware.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/chain/", "properties": { "middlewares": { "description": "Middlewares is the list of MiddlewareRef which composes the chain.", @@ -171,7 +171,7 @@ "additionalProperties": false }, "compress": { - "description": "Compress holds the compress middleware configuration.\nThis middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/compress/", + "description": "Compress holds the compress middleware configuration.\nThis middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/compress/", "properties": { "defaultEncoding": { "description": "DefaultEncoding specifies the default encoding if the `Accept-Encoding` header is not in the request or contains a wildcard (`*`).", @@ -219,10 +219,10 @@ "additionalProperties": false }, "digestAuth": { - "description": "DigestAuth holds the digest auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/", + "description": "DigestAuth holds the digest auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/digestauth/", "properties": { "headerField": { - "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/#headerfield", + "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/digestauth/#headerfield", "type": "string" }, "realm": { @@ -241,15 +241,50 @@ "type": "object", "additionalProperties": false }, + "encodedCharacters": { + "description": "EncodedCharacters configures which encoded characters are allowed in the request path.", + "properties": { + "allowEncodedBackSlash": { + "description": "AllowEncodedBackSlash defines whether requests with encoded back slash characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedHash": { + "description": "AllowEncodedHash defines whether requests with encoded hash characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedNullCharacter": { + "description": "AllowEncodedNullCharacter defines whether requests with encoded null characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedPercent": { + "description": "AllowEncodedPercent defines whether requests with encoded percent characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedQuestionMark": { + "description": "AllowEncodedQuestionMark defines whether requests with encoded question mark characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedSemicolon": { + "description": "AllowEncodedSemicolon defines whether requests with encoded semicolon characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedSlash": { + "description": "AllowEncodedSlash defines whether requests with encoded slash characters in the path are allowed.", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, "errors": { - "description": "ErrorPage holds the custom error middleware configuration.\nThis middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/", + "description": "ErrorPage holds the custom error middleware configuration.\nThis middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/errorpages/", "properties": { "query": { "description": "Query defines the URL for the error page (hosted by service).\nThe {status} variable can be used in order to insert the status code in the URL.\nThe {originalStatus} variable can be used in order to insert the upstream status code in the URL.\nThe {url} variable can be used in order to insert the escaped request URL.", "type": "string" }, "service": { - "description": "Service defines the reference to a Kubernetes Service that will serve the error page.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/#service", + "description": "Service defines the reference to a Kubernetes Service that will serve the error page.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/errorpages/#service", "properties": { "healthCheck": { "description": "Healthcheck defines health checks for ExternalName services.", @@ -341,6 +376,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -416,7 +473,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -446,7 +503,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -505,7 +565,7 @@ "additionalProperties": false }, "forwardAuth": { - "description": "ForwardAuth holds the forward auth middleware configuration.\nThis middleware delegates the request authentication to a Service.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/", + "description": "ForwardAuth holds the forward auth middleware configuration.\nThis middleware delegates the request authentication to a Service.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/forwardauth/", "properties": { "addAuthCookiesToResponse": { "description": "AddAuthCookiesToResponse defines the list of cookies to copy from the authentication server response to the response.", @@ -533,7 +593,11 @@ "type": "array" }, "authResponseHeadersRegex": { - "description": "AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex", + "description": "AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex", + "type": "string" + }, + "authSigninURL": { + "description": "AuthSigninURL specifies the URL to redirect to when the authentication server returns 401 Unauthorized.", "type": "string" }, "forwardBody": { @@ -541,7 +605,7 @@ "type": "boolean" }, "headerField": { - "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#headerfield", + "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/forwardauth/#headerfield", "type": "string" }, "maxBodySize": { @@ -586,7 +650,7 @@ "additionalProperties": false }, "trustForwardHeader": { - "description": "TrustForwardHeader defines whether to trust (ie: forward) all X-Forwarded-* headers.", + "description": "TrustForwardHeader defines whether to trust (ie: forward) all X-Forwarded-* headers.\n\nDeprecated: Use forwardedHeaders.trustedIPs at the EntryPoint level instead, and set trustForwardHeader to true on this middleware.", "type": "boolean" } }, @@ -608,7 +672,7 @@ "additionalProperties": false }, "headers": { - "description": "Headers holds the headers middleware configuration.\nThis middleware manages the requests and responses headers.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/headers/#customrequestheaders", + "description": "Headers holds the headers middleware configuration.\nThis middleware manages the requests and responses headers.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/headers/#customrequestheaders", "properties": { "accessControlAllowCredentials": { "description": "AccessControlAllowCredentials defines whether the request can include user credentials.", @@ -780,7 +844,7 @@ "additionalProperties": false }, "inFlightReq": { - "description": "InFlightReq holds the in-flight request middleware configuration.\nThis middleware limits the number of requests being processed and served concurrently.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/", + "description": "InFlightReq holds the in-flight request middleware configuration.\nThis middleware limits the number of requests being processed and served concurrently.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/inflightreq/", "properties": { "amount": { "description": "Amount defines the maximum amount of allowed simultaneous in-flight request.\nThe middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).", @@ -789,10 +853,10 @@ "type": "integer" }, "sourceCriterion": { - "description": "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the requestHost.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/#sourcecriterion", + "description": "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the requestHost.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/inflightreq/#sourcecriterion", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -831,10 +895,10 @@ "additionalProperties": false }, "ipAllowList": { - "description": "IPAllowList holds the IP allowlist middleware configuration.\nThis middleware limits allowed requests based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/", + "description": "IPAllowList holds the IP allowlist middleware configuration.\nThis middleware limits allowed requests based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -875,7 +939,7 @@ "description": "Deprecated: please use IPAllowList instead.", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -909,7 +973,7 @@ "additionalProperties": false }, "passTLSClientCert": { - "description": "PassTLSClientCert holds the pass TLS client cert middleware configuration.\nThis middleware adds the selected data from the passed client TLS certificate to a header.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/passtlsclientcert/", + "description": "PassTLSClientCert holds the pass TLS client cert middleware configuration.\nThis middleware adds the selected data from the passed client TLS certificate to a header.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/passtlsclientcert/", "properties": { "info": { "description": "Info selects the specific client certificate details you want to add to the X-Forwarded-Tls-Client-Cert-Info header.", @@ -1020,11 +1084,11 @@ "additionalProperties": { "x-kubernetes-preserve-unknown-fields": true }, - "description": "Plugin defines the middleware plugin configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/#community-middlewares", + "description": "Plugin defines the middleware plugin configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/overview/#community-middlewares", "type": "object" }, "rateLimit": { - "description": "RateLimit holds the rate limit configuration.\nThis middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/ratelimit/", + "description": "RateLimit holds the rate limit configuration.\nThis middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/ratelimit/", "properties": { "average": { "description": "Average is the maximum rate, by default in requests/s, allowed for the given source.\nIt defaults to 0, which means no rate limiting.\nThe rate is actually defined by dividing Average by Period. So for a rate below 1req/s,\none needs to define a Period larger than a second.", @@ -1146,7 +1210,7 @@ "description": "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the request's remote address field (as an ipStrategy).", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -1185,7 +1249,7 @@ "additionalProperties": false }, "redirectRegex": { - "description": "RedirectRegex holds the redirect regex middleware configuration.\nThis middleware redirects a request using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectregex/#regex", + "description": "RedirectRegex holds the redirect regex middleware configuration.\nThis middleware redirects a request using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/redirectregex/#regex", "properties": { "permanent": { "description": "Permanent defines whether the redirection is permanent (308).", @@ -1204,7 +1268,7 @@ "additionalProperties": false }, "redirectScheme": { - "description": "RedirectScheme holds the redirect scheme middleware configuration.\nThis middleware redirects requests from a scheme/port to another.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectscheme/", + "description": "RedirectScheme holds the redirect scheme middleware configuration.\nThis middleware redirects requests from a scheme/port to another.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/redirectscheme/", "properties": { "permanent": { "description": "Permanent defines whether the redirection is permanent.\nFor HTTP GET requests a 301 is returned, otherwise a 308 is returned.", @@ -1223,7 +1287,7 @@ "additionalProperties": false }, "replacePath": { - "description": "ReplacePath holds the replace path middleware configuration.\nThis middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepath/", + "description": "ReplacePath holds the replace path middleware configuration.\nThis middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/replacepath/", "properties": { "path": { "description": "Path defines the path to use as replacement in the request URL.", @@ -1234,7 +1298,7 @@ "additionalProperties": false }, "replacePathRegex": { - "description": "ReplacePathRegex holds the replace path regex middleware configuration.\nThis middleware replaces the path of a URL using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepathregex/", + "description": "ReplacePathRegex holds the replace path regex middleware configuration.\nThis middleware replaces the path of a URL using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/replacepathregex/", "properties": { "regex": { "description": "Regex defines the regular expression used to match and capture the path from the request URL.", @@ -1249,13 +1313,17 @@ "additionalProperties": false }, "retry": { - "description": "Retry holds the retry middleware configuration.\nThis middleware reissues requests a given number of times to a backend server if that server does not reply.\nAs soon as the server answers, the middleware stops retrying, regardless of the response status.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/retry/", + "description": "Retry holds the retry middleware configuration.\nThis middleware reissues requests a given number of times to a backend server if that server does not reply.\nAs soon as the server answers, the middleware stops retrying, regardless of the response status.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/retry/", "properties": { "attempts": { "description": "Attempts defines how many times the request should be retried.", "minimum": 0, "type": "integer" }, + "disableRetryOnNetworkError": { + "description": "DisableRetryOnNetworkError defines whether to disable the retry if an error occurs when transmitting the request to the server.", + "type": "boolean" + }, "initialInterval": { "anyOf": [ { @@ -1268,13 +1336,44 @@ "description": "InitialInterval defines the first wait time in the exponential backoff series.\nThe maximum interval is calculated as twice the initialInterval.\nIf unspecified, requests will be retried immediately.\nThe value of initialInterval should be provided in seconds or as a valid duration format,\nsee https://pkg.go.dev/time#ParseDuration.", "pattern": "^([0-9]+(ns|us|\u00b5s|ms|s|m|h)?)+$", "x-kubernetes-int-or-string": true + }, + "maxRequestBodyBytes": { + "description": "MaxRequestBodyBytes defines the maximum size for the request body.\nDefault is `-1`, which means no limit.", + "format": "int64", + "minimum": -1, + "type": "integer" + }, + "retryNonIdempotentMethod": { + "description": "RetryNonIdempotentMethod activates the retry for non-idempotent methods (POST, LOCK, PATCH)", + "type": "boolean" + }, + "status": { + "description": "Status defines the range of HTTP status codes to retry on.", + "items": { + "pattern": "^([1-5][0-9]{2}[,-]?)+$", + "type": "string" + }, + "type": "array" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines how much time the middleware is allowed to retry the request.\nThe value of timeout should be provided in seconds or as a valid duration format,\nsee https://pkg.go.dev/time#ParseDuration.", + "pattern": "^([0-9]+(ns|us|\u00b5s|ms|s|m|h)?)+$", + "x-kubernetes-int-or-string": true } }, "type": "object", "additionalProperties": false }, "stripPrefix": { - "description": "StripPrefix holds the strip prefix middleware configuration.\nThis middleware removes the specified prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefix/", + "description": "StripPrefix holds the strip prefix middleware configuration.\nThis middleware removes the specified prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/stripprefix/", "properties": { "forceSlash": { "description": "Deprecated: ForceSlash option is deprecated, please remove any usage of this option.\nForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.\nDefault: true.", @@ -1292,7 +1391,7 @@ "additionalProperties": false }, "stripPrefixRegex": { - "description": "StripPrefixRegex holds the strip prefix regex middleware configuration.\nThis middleware removes the matching prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefixregex/", + "description": "StripPrefixRegex holds the strip prefix regex middleware configuration.\nThis middleware removes the matching prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/stripprefixregex/", "properties": { "regex": { "description": "Regex defines the regular expression to match the path prefix from the request URL.", diff --git a/crdSchemas/master-standalone/middlewaretcp-stable-v1alpha1.json b/crdSchemas/master-standalone/middlewaretcp-stable-v1alpha1.json index e97e6e6..3862ad7 100644 --- a/crdSchemas/master-standalone/middlewaretcp-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/middlewaretcp-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/", + "description": "MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/middlewares/overview/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -29,7 +29,7 @@ "additionalProperties": false }, "ipAllowList": { - "description": "IPAllowList defines the IPAllowList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/", + "description": "IPAllowList defines the IPAllowList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/middlewares/ipallowlist/", "properties": { "sourceRange": { "description": "SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).", @@ -43,7 +43,7 @@ "additionalProperties": false }, "ipWhiteList": { - "description": "IPWhiteList defines the IPWhiteList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/\n\nDeprecated: please use IPAllowList instead.", + "description": "IPWhiteList defines the IPWhiteList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/middlewares/ipwhitelist/\n\nDeprecated: please use IPAllowList instead.", "properties": { "sourceRange": { "description": "SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).", diff --git a/crdSchemas/master-standalone/serverstransport-stable-v1alpha1.json b/crdSchemas/master-standalone/serverstransport-stable-v1alpha1.json index bb929a0..6eacfcd 100644 --- a/crdSchemas/master-standalone/serverstransport-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/serverstransport-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "ServersTransport is the CRD implementation of a ServersTransport.\nIf no serversTransport is specified, the default@internal will be used.\nThe default@internal serversTransport is created from the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/", + "description": "ServersTransport is the CRD implementation of a ServersTransport.\nIf no serversTransport is specified, the default@internal will be used.\nThe default@internal serversTransport is created from the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/serverstransport/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -22,6 +22,13 @@ }, "type": "array" }, + "cipherSuites": { + "description": "CipherSuites defines the cipher suites to use when contacting backend servers.", + "items": { + "type": "string" + }, + "type": "array" + }, "disableHTTP2": { "description": "DisableHTTP2 disables HTTP/2 for connections with backend servers.", "type": "boolean" @@ -107,6 +114,14 @@ "minimum": -1, "type": "integer" }, + "maxVersion": { + "description": "MaxVersion defines the maximum TLS version to use when contacting backend servers.", + "type": "string" + }, + "minVersion": { + "description": "MinVersion defines the minimum TLS version to use when contacting backend servers.", + "type": "string" + }, "peerCertURI": { "description": "PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.", "type": "string" diff --git a/crdSchemas/master-standalone/serverstransporttcp-stable-v1alpha1.json b/crdSchemas/master-standalone/serverstransporttcp-stable-v1alpha1.json index 2e05c77..b2a0e8a 100644 --- a/crdSchemas/master-standalone/serverstransporttcp-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/serverstransporttcp-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "ServersTransportTCP is the CRD implementation of a TCPServersTransport.\nIf no tcpServersTransport is specified, a default one named default@internal will be used.\nThe default@internal tcpServersTransport can be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/", + "description": "ServersTransportTCP is the CRD implementation of a TCPServersTransport.\nIf no tcpServersTransport is specified, a default one named default@internal will be used.\nThe default@internal tcpServersTransport can be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/serverstransport/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/master-standalone/tlsoption-stable-v1alpha1.json b/crdSchemas/master-standalone/tlsoption-stable-v1alpha1.json index 7afcf90..d1e3501 100644 --- a/crdSchemas/master-standalone/tlsoption-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/tlsoption-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options", + "description": "TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -16,14 +16,14 @@ "description": "TLSOptionSpec defines the desired state of a TLSOption.", "properties": { "alpnProtocols": { - "description": "ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols", + "description": "ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols", "items": { "type": "string" }, "type": "array" }, "cipherSuites": { - "description": "CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites", + "description": "CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites", "items": { "type": "string" }, @@ -55,7 +55,7 @@ "additionalProperties": false }, "curvePreferences": { - "description": "CurvePreferences defines the preferred elliptic curves.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences", + "description": "CurvePreferences defines the preferred elliptic curves.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences", "items": { "type": "string" }, diff --git a/crdSchemas/master-standalone/tlsstore-stable-v1alpha1.json b/crdSchemas/master-standalone/tlsstore-stable-v1alpha1.json index 7f3381d..5089e66 100644 --- a/crdSchemas/master-standalone/tlsstore-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/tlsstore-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "TLSStore is the CRD implementation of a Traefik TLS Store.\nFor the time being, only the TLSStore named default is supported.\nThis means that you cannot have two stores that are named default in different Kubernetes namespaces.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores", + "description": "TLSStore is the CRD implementation of a Traefik TLS Store.\nFor the time being, only the TLSStore named default is supported.\nThis means that you cannot have two stores that are named default in different Kubernetes namespaces.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/master-standalone/traefikservice-stable-v1alpha1.json b/crdSchemas/master-standalone/traefikservice-stable-v1alpha1.json index 30035a1..0a8deef 100644 --- a/crdSchemas/master-standalone/traefikservice-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/traefikservice-stable-v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "TraefikService is the CRD implementation of a Traefik Service.\nTraefikService object allows to:\n- Apply weight to Services on load-balancing\n- Mirror traffic on services\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/", + "description": "TraefikService is the CRD implementation of a Traefik Service.\nTraefikService object allows to:\n- Apply weight to Services on load-balancing\n- Mirror traffic on services\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/traefikservice/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -15,6 +15,561 @@ "spec": { "description": "TraefikServiceSpec defines the desired state of a TraefikService.", "properties": { + "failover": { + "description": "Failover defines the Failover service configuration.", + "properties": { + "errors": { + "description": "Errors defines which errors should trigger the use of the fallback service.", + "properties": { + "maxRequestBodyBytes": { + "description": "MaxRequestBodyBytes defines the maximum size allowed for the body of the request.\nDefault value is -1, which means unlimited size.", + "format": "int64", + "type": "integer" + }, + "status": { + "description": "Status defines the list of status code ranges for which the fallback service should be used.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + }, + "fallback": { + "description": "Fallback defines the fallback service to use when the main service returns an error.", + "properties": { + "healthCheck": { + "description": "Healthcheck defines health checks for ExternalName services.", + "properties": { + "followRedirects": { + "description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + "type": "boolean" + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "description": "Headers defines custom headers to be sent to the health check endpoint.", + "type": "object" + }, + "hostname": { + "description": "Hostname defines the value of hostname in the Host header of the health check request.", + "type": "string" + }, + "interval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + "method": { + "description": "Method defines the healthcheck method.", + "type": "string" + }, + "mode": { + "description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + "type": "string" + }, + "path": { + "description": "Path defines the server URL path for the health check endpoint.", + "type": "string" + }, + "port": { + "description": "Port defines the server URL port for the health check endpoint.", + "type": "integer" + }, + "scheme": { + "description": "Scheme replaces the server URL scheme for the health check endpoint.", + "type": "string" + }, + "status": { + "description": "Status defines the expected HTTP status code of the response to the health check request.", + "type": "integer" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + }, + "unhealthyInterval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s", + "x-kubernetes-int-or-string": true + } + }, + "type": "object", + "additionalProperties": false + }, + "kind": { + "description": "Kind defines the kind of the Service.", + "enum": [ + "Service", + "TraefikService" + ], + "type": "string" + }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "name": { + "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + "type": "string" + }, + "nativeLB": { + "description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + "type": "boolean" + }, + "nodePortLB": { + "description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + "type": "boolean" + }, + "passHostHeader": { + "description": "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + "type": "boolean" + }, + "passiveHealthCheck": { + "description": "PassiveHealthCheck defines passive health checks for ExternalName services.", + "properties": { + "failureWindow": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.", + "x-kubernetes-int-or-string": true + }, + "maxFailedAttempts": { + "description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + "responseForwarding": { + "description": "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + "properties": { + "flushInterval": { + "description": "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "scheme": { + "description": "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + "type": "string" + }, + "serversTransport": { + "description": "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + "type": "string" + }, + "sticky": { + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "properties": { + "cookie": { + "description": "Cookie defines the sticky cookie configuration.", + "properties": { + "domain": { + "description": "Domain defines the host to which the cookie will be sent.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value", + "type": "string" + }, + "httpOnly": { + "description": "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + "type": "boolean" + }, + "maxAge": { + "description": "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + "type": "integer" + }, + "name": { + "description": "Name defines the Cookie name.", + "type": "string" + }, + "path": { + "description": "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + "type": "string" + }, + "sameSite": { + "description": "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + "enum": [ + "none", + "lax", + "strict", + "None", + "Lax", + "Strict" + ], + "type": "string" + }, + "secure": { + "description": "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "strategy": { + "description": "Strategy defines the load balancing strategy between the servers.\nSupported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).\nRoundRobin value is deprecated and supported for backward compatibility.", + "enum": [ + "wrr", + "p2c", + "hrw", + "leasttime", + "RoundRobin" + ], + "type": "string" + }, + "weight": { + "description": "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "service": { + "description": "Service defines the main service to use.", + "properties": { + "healthCheck": { + "description": "Healthcheck defines health checks for ExternalName services.", + "properties": { + "followRedirects": { + "description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + "type": "boolean" + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "description": "Headers defines custom headers to be sent to the health check endpoint.", + "type": "object" + }, + "hostname": { + "description": "Hostname defines the value of hostname in the Host header of the health check request.", + "type": "string" + }, + "interval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + "method": { + "description": "Method defines the healthcheck method.", + "type": "string" + }, + "mode": { + "description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + "type": "string" + }, + "path": { + "description": "Path defines the server URL path for the health check endpoint.", + "type": "string" + }, + "port": { + "description": "Port defines the server URL port for the health check endpoint.", + "type": "integer" + }, + "scheme": { + "description": "Scheme replaces the server URL scheme for the health check endpoint.", + "type": "string" + }, + "status": { + "description": "Status defines the expected HTTP status code of the response to the health check request.", + "type": "integer" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + }, + "unhealthyInterval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s", + "x-kubernetes-int-or-string": true + } + }, + "type": "object", + "additionalProperties": false + }, + "kind": { + "description": "Kind defines the kind of the Service.", + "enum": [ + "Service", + "TraefikService" + ], + "type": "string" + }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "name": { + "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + "type": "string" + }, + "nativeLB": { + "description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + "type": "boolean" + }, + "nodePortLB": { + "description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + "type": "boolean" + }, + "passHostHeader": { + "description": "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + "type": "boolean" + }, + "passiveHealthCheck": { + "description": "PassiveHealthCheck defines passive health checks for ExternalName services.", + "properties": { + "failureWindow": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.", + "x-kubernetes-int-or-string": true + }, + "maxFailedAttempts": { + "description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + "responseForwarding": { + "description": "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + "properties": { + "flushInterval": { + "description": "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "scheme": { + "description": "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + "type": "string" + }, + "serversTransport": { + "description": "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + "type": "string" + }, + "sticky": { + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "properties": { + "cookie": { + "description": "Cookie defines the sticky cookie configuration.", + "properties": { + "domain": { + "description": "Domain defines the host to which the cookie will be sent.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value", + "type": "string" + }, + "httpOnly": { + "description": "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + "type": "boolean" + }, + "maxAge": { + "description": "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + "type": "integer" + }, + "name": { + "description": "Name defines the Cookie name.", + "type": "string" + }, + "path": { + "description": "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + "type": "string" + }, + "sameSite": { + "description": "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + "enum": [ + "none", + "lax", + "strict", + "None", + "Lax", + "Strict" + ], + "type": "string" + }, + "secure": { + "description": "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "strategy": { + "description": "Strategy defines the load balancing strategy between the servers.\nSupported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).\nRoundRobin value is deprecated and supported for backward compatibility.", + "enum": [ + "wrr", + "p2c", + "hrw", + "leasttime", + "RoundRobin" + ], + "type": "string" + }, + "weight": { + "description": "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "errors", + "fallback", + "service" + ], + "type": "object", + "additionalProperties": false + }, "highestRandomWeight": { "description": "HighestRandomWeight defines the highest random weight service configuration.", "properties": { @@ -113,6 +668,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -188,7 +765,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -218,7 +795,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -361,6 +941,28 @@ "format": "int64", "type": "integer" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "mirrorBody": { "description": "MirrorBody defines whether the body of the request should be mirrored.\nDefault value is true.", "type": "boolean" @@ -460,6 +1062,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -539,7 +1163,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -569,7 +1193,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -685,7 +1312,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -715,7 +1342,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -852,6 +1482,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -927,7 +1579,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -957,7 +1609,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -999,7 +1654,7 @@ "type": "array" }, "sticky": { - "description": "Sticky defines whether sticky sessions are enabled.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing", + "description": "Sticky defines whether sticky sessions are enabled.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -1029,7 +1684,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, diff --git a/crdSchemas/master-standalone/uplink-stable-v1alpha1.json b/crdSchemas/master-standalone/uplink-stable-v1alpha1.json new file mode 100644 index 0000000..8c07f3a --- /dev/null +++ b/crdSchemas/master-standalone/uplink-stable-v1alpha1.json @@ -0,0 +1,212 @@ +{ + "description": "Uplink is an inter-cluster service advertisement: a child cluster declares an Uplink to advertise\nto a parent cluster that it can handle a particular workload.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "type": "object" + }, + "spec": { + "description": "UplinkSpec describes the Uplink.", + "properties": { + "entryPoints": { + "description": "EntryPoints references uplinkEntryPoints. When omitted, uses default uplinkEntrypoints.", + "items": { + "type": "string" + }, + "type": "array" + }, + "exposeName": { + "description": "ExposeName is the name of the service to expose.\nBy default it uses -.", + "type": "string" + }, + "healthCheck": { + "description": "HealthCheck configures the active health check on the parent cluster for this uplink's load balancer.", + "properties": { + "followRedirects": { + "description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + "type": "boolean" + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "description": "Headers defines custom headers to be sent to the health check endpoint.", + "type": "object" + }, + "hostname": { + "description": "Hostname defines the value of hostname in the Host header of the health check request.", + "type": "string" + }, + "interval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + "method": { + "description": "Method defines the healthcheck method.", + "type": "string" + }, + "mode": { + "description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + "type": "string" + }, + "path": { + "description": "Path defines the server URL path for the health check endpoint.", + "type": "string" + }, + "port": { + "description": "Port defines the server URL port for the health check endpoint.", + "type": "integer" + }, + "scheme": { + "description": "Scheme replaces the server URL scheme for the health check endpoint.", + "type": "string" + }, + "status": { + "description": "Status defines the expected HTTP status code of the response to the health check request.", + "type": "integer" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + }, + "unhealthyInterval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s", + "x-kubernetes-int-or-string": true + } + }, + "type": "object", + "additionalProperties": false + }, + "passiveHealthCheck": { + "description": "PassiveHealthCheck configures the passive health check on the parent cluster for this uplink's load balancer.", + "properties": { + "failureWindow": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.", + "x-kubernetes-int-or-string": true + }, + "maxFailedAttempts": { + "description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "weight": { + "description": "Weight for WRR on the parent.", + "type": "integer", + "x-kubernetes-validations": [ + { + "message": "must be a positive number", + "rule": "self >= 0" + } + ] + } + }, + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "The current status of this Uplink.", + "properties": { + "conditions": { + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object" +} diff --git a/crdSchemas/master-standalone/virtualmcpserver-stable-v1alpha1.json b/crdSchemas/master-standalone/virtualmcpserver-stable-v1alpha1.json index b11eefb..72dfb03 100644 --- a/crdSchemas/master-standalone/virtualmcpserver-stable-v1alpha1.json +++ b/crdSchemas/master-standalone/virtualmcpserver-stable-v1alpha1.json @@ -24,7 +24,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -34,6 +34,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -252,7 +277,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", diff --git a/crdSchemas/master-standalone/virtualmcpserver-stable-v1beta1.json b/crdSchemas/master-standalone/virtualmcpserver-stable-v1beta1.json index d8d0a19..736751d 100644 --- a/crdSchemas/master-standalone/virtualmcpserver-stable-v1beta1.json +++ b/crdSchemas/master-standalone/virtualmcpserver-stable-v1beta1.json @@ -24,7 +24,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -34,6 +34,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -252,7 +277,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", diff --git a/crdSchemas/mcpexternalauthconfig_v1alpha1.json b/crdSchemas/mcpexternalauthconfig_v1alpha1.json index 308902d..29bb0e0 100644 --- a/crdSchemas/mcpexternalauthconfig_v1alpha1.json +++ b/crdSchemas/mcpexternalauthconfig_v1alpha1.json @@ -137,7 +137,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -147,6 +147,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -365,7 +390,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", @@ -900,6 +925,10 @@ "type": "object", "additionalProperties": false }, + "obo": { + "description": "OBO configures On-Behalf-Of (OBO) authentication.\nOnly used when Type is \"obo\". The inner schema is intentionally empty in\nthis revision; sub-fields land in a follow-up. Setting this field on an\nupstream-only build will cause the MCPExternalAuthConfig to transition to\nstatus.conditions[Valid] = False with Reason: EnterpriseRequired.", + "type": "object" + }, "tokenExchange": { "description": "TokenExchange configures RFC-8693 OAuth 2.0 Token Exchange\nOnly used when Type is \"tokenExchange\"", "properties": { @@ -964,7 +993,7 @@ "additionalProperties": false }, "type": { - "description": "Type is the type of external authentication to configure", + "description": "Type is the type of external authentication to configure.\nWhen set to \"obo\", the cluster must run a build that has registered an\nOBO handler via controllerutil.RegisterOBOHandler; upstream-only builds\nsurface status.conditions[Valid] = False with Reason: EnterpriseRequired\nfor obo-typed configs.", "enum": [ "tokenExchange", "headerInjection", @@ -972,7 +1001,8 @@ "unauthenticated", "embeddedAuthServer", "awsSts", - "upstreamInject" + "upstreamInject", + "obo" ], "type": "string" }, @@ -1021,9 +1051,13 @@ "message": "upstreamInject configuration must be set if and only if type is 'upstreamInject'", "rule": "self.type == 'upstreamInject' ? has(self.upstreamInject) : !has(self.upstreamInject)" }, + { + "message": "obo configuration must be set if and only if type is 'obo'", + "rule": "self.type == 'obo' ? has(self.obo) : !has(self.obo)" + }, { "message": "no configuration must be set when type is 'unauthenticated'", - "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject)) : true" + "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject) && !has(self.obo)) : true" } ], "additionalProperties": false diff --git a/crdSchemas/mcpexternalauthconfig_v1beta1.json b/crdSchemas/mcpexternalauthconfig_v1beta1.json index e9639a0..0d50462 100644 --- a/crdSchemas/mcpexternalauthconfig_v1beta1.json +++ b/crdSchemas/mcpexternalauthconfig_v1beta1.json @@ -137,7 +137,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -147,6 +147,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -365,7 +390,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", @@ -900,6 +925,10 @@ "type": "object", "additionalProperties": false }, + "obo": { + "description": "OBO configures On-Behalf-Of (OBO) authentication.\nOnly used when Type is \"obo\". The inner schema is intentionally empty in\nthis revision; sub-fields land in a follow-up. Setting this field on an\nupstream-only build will cause the MCPExternalAuthConfig to transition to\nstatus.conditions[Valid] = False with Reason: EnterpriseRequired.", + "type": "object" + }, "tokenExchange": { "description": "TokenExchange configures RFC-8693 OAuth 2.0 Token Exchange\nOnly used when Type is \"tokenExchange\"", "properties": { @@ -964,7 +993,7 @@ "additionalProperties": false }, "type": { - "description": "Type is the type of external authentication to configure", + "description": "Type is the type of external authentication to configure.\nWhen set to \"obo\", the cluster must run a build that has registered an\nOBO handler via controllerutil.RegisterOBOHandler; upstream-only builds\nsurface status.conditions[Valid] = False with Reason: EnterpriseRequired\nfor obo-typed configs.", "enum": [ "tokenExchange", "headerInjection", @@ -972,7 +1001,8 @@ "unauthenticated", "embeddedAuthServer", "awsSts", - "upstreamInject" + "upstreamInject", + "obo" ], "type": "string" }, @@ -1021,9 +1051,13 @@ "message": "upstreamInject configuration must be set if and only if type is 'upstreamInject'", "rule": "self.type == 'upstreamInject' ? has(self.upstreamInject) : !has(self.upstreamInject)" }, + { + "message": "obo configuration must be set if and only if type is 'obo'", + "rule": "self.type == 'obo' ? has(self.obo) : !has(self.obo)" + }, { "message": "no configuration must be set when type is 'unauthenticated'", - "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject)) : true" + "rule": "self.type == 'unauthenticated' ? (!has(self.tokenExchange) && !has(self.headerInjection) && !has(self.bearerToken) && !has(self.embeddedAuthServer) && !has(self.awsSts) && !has(self.upstreamInject) && !has(self.obo)) : true" } ], "additionalProperties": false diff --git a/crdSchemas/mcpregistry_v1alpha1.json b/crdSchemas/mcpregistry_v1alpha1.json index fd95beb..3f199f2 100644 --- a/crdSchemas/mcpregistry_v1alpha1.json +++ b/crdSchemas/mcpregistry_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "MCPRegistry is the deprecated v1alpha1 version of the MCPRegistry resource.", + "description": "MCPRegistry is the deprecated v1alpha1 version of the MCPRegistry resource.\nThe MCPRegistry CRD as a whole is deprecated and will be removed in a future\nrelease; install the ToolHive registry server via the toolhive-registry-server\nHelm chart instead: https://github.com/stacklok/toolhive-registry-server", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/mcpregistry_v1beta1.json b/crdSchemas/mcpregistry_v1beta1.json index 4e343fa..65c4796 100644 --- a/crdSchemas/mcpregistry_v1beta1.json +++ b/crdSchemas/mcpregistry_v1beta1.json @@ -1,5 +1,5 @@ { - "description": "MCPRegistry is the Schema for the mcpregistries API", + "description": "MCPRegistry is the Schema for the mcpregistries API.\n\nThe MCPRegistry CRD is deprecated and will be removed in a future release.\nInstall the ToolHive registry server via the toolhive-registry-server Helm chart\ninstead: https://github.com/stacklok/toolhive-registry-server", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/mcpremoteproxy_v1alpha1.json b/crdSchemas/mcpremoteproxy_v1alpha1.json index 5c4d880..6f002ba 100644 --- a/crdSchemas/mcpremoteproxy_v1alpha1.json +++ b/crdSchemas/mcpremoteproxy_v1alpha1.json @@ -238,7 +238,7 @@ "additionalProperties": false }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the remote MCP server under a synthetic local-user identity, with no\ntoken or credential check. Set this field to enforce identity-based access control\nper request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/mcpremoteproxy_v1beta1.json b/crdSchemas/mcpremoteproxy_v1beta1.json index 1ed29ab..d270e4b 100644 --- a/crdSchemas/mcpremoteproxy_v1beta1.json +++ b/crdSchemas/mcpremoteproxy_v1beta1.json @@ -238,7 +238,7 @@ "additionalProperties": false }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the remote MCP server under a synthetic local-user identity, with no\ntoken or credential check. Set this field to enforce identity-based access control\nper request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/mcpserver_v1alpha1.json b/crdSchemas/mcpserver_v1alpha1.json index df715ae..8bb1ec0 100644 --- a/crdSchemas/mcpserver_v1alpha1.json +++ b/crdSchemas/mcpserver_v1alpha1.json @@ -232,7 +232,7 @@ "type": "integer" }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the MCP server under a synthetic local-user identity, with no token or\ncredential check. Set this field to enforce identity-based access control per request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/mcpserver_v1beta1.json b/crdSchemas/mcpserver_v1beta1.json index 76781b3..8003940 100644 --- a/crdSchemas/mcpserver_v1beta1.json +++ b/crdSchemas/mcpserver_v1beta1.json @@ -232,7 +232,7 @@ "type": "integer" }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the MCP server under a synthetic local-user identity, with no token or\ncredential check. Set this field to enforce identity-based access control per request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/crdSchemas/middleware_v1alpha1.json b/crdSchemas/middleware_v1alpha1.json index bfc7cea..4c16c38 100644 --- a/crdSchemas/middleware_v1alpha1.json +++ b/crdSchemas/middleware_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "Middleware is the CRD implementation of a Traefik Middleware.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/", + "description": "Middleware is the CRD implementation of a Traefik Middleware.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/overview/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -16,7 +16,7 @@ "description": "MiddlewareSpec defines the desired state of a Middleware.", "properties": { "addPrefix": { - "description": "AddPrefix holds the add prefix middleware configuration.\nThis middleware updates the path of a request before forwarding it.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/addprefix/", + "description": "AddPrefix holds the add prefix middleware configuration.\nThis middleware updates the path of a request before forwarding it.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/addprefix/", "properties": { "prefix": { "description": "Prefix is the string to add before the current path in the requested URL.\nIt should include a leading slash (/).", @@ -33,10 +33,10 @@ "additionalProperties": false }, "basicAuth": { - "description": "BasicAuth holds the basic auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/", + "description": "BasicAuth holds the basic auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/basicauth/", "properties": { "headerField": { - "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/#headerfield", + "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/basicauth/#headerfield", "type": "string" }, "realm": { @@ -56,7 +56,7 @@ "additionalProperties": false }, "buffering": { - "description": "Buffering holds the buffering middleware configuration.\nThis middleware retries or limits the size of requests that can be forwarded to backends.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#maxrequestbodybytes", + "description": "Buffering holds the buffering middleware configuration.\nThis middleware retries or limits the size of requests that can be forwarded to backends.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/buffering/#maxrequestbodybytes", "properties": { "maxRequestBodyBytes": { "description": "MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).\nIf the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.\nDefault: 0 (no maximum).", @@ -79,7 +79,7 @@ "type": "integer" }, "retryExpression": { - "description": "RetryExpression defines the retry conditions.\nIt is a logical combination of functions with operators AND (&&) and OR (||).\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#retryexpression", + "description": "RetryExpression defines the retry conditions.\nIt is a logical combination of functions with operators AND (&&) and OR (||).\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/buffering/#retryexpression", "type": "string" } }, @@ -87,7 +87,7 @@ "additionalProperties": false }, "chain": { - "description": "Chain holds the configuration of the chain middleware.\nThis middleware enables to define reusable combinations of other pieces of middleware.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/chain/", + "description": "Chain holds the configuration of the chain middleware.\nThis middleware enables to define reusable combinations of other pieces of middleware.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/chain/", "properties": { "middlewares": { "description": "Middlewares is the list of MiddlewareRef which composes the chain.", @@ -171,7 +171,7 @@ "additionalProperties": false }, "compress": { - "description": "Compress holds the compress middleware configuration.\nThis middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/compress/", + "description": "Compress holds the compress middleware configuration.\nThis middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/compress/", "properties": { "defaultEncoding": { "description": "DefaultEncoding specifies the default encoding if the `Accept-Encoding` header is not in the request or contains a wildcard (`*`).", @@ -219,10 +219,10 @@ "additionalProperties": false }, "digestAuth": { - "description": "DigestAuth holds the digest auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/", + "description": "DigestAuth holds the digest auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/digestauth/", "properties": { "headerField": { - "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/#headerfield", + "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/digestauth/#headerfield", "type": "string" }, "realm": { @@ -241,15 +241,50 @@ "type": "object", "additionalProperties": false }, + "encodedCharacters": { + "description": "EncodedCharacters configures which encoded characters are allowed in the request path.", + "properties": { + "allowEncodedBackSlash": { + "description": "AllowEncodedBackSlash defines whether requests with encoded back slash characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedHash": { + "description": "AllowEncodedHash defines whether requests with encoded hash characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedNullCharacter": { + "description": "AllowEncodedNullCharacter defines whether requests with encoded null characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedPercent": { + "description": "AllowEncodedPercent defines whether requests with encoded percent characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedQuestionMark": { + "description": "AllowEncodedQuestionMark defines whether requests with encoded question mark characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedSemicolon": { + "description": "AllowEncodedSemicolon defines whether requests with encoded semicolon characters in the path are allowed.", + "type": "boolean" + }, + "allowEncodedSlash": { + "description": "AllowEncodedSlash defines whether requests with encoded slash characters in the path are allowed.", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + }, "errors": { - "description": "ErrorPage holds the custom error middleware configuration.\nThis middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/", + "description": "ErrorPage holds the custom error middleware configuration.\nThis middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/errorpages/", "properties": { "query": { "description": "Query defines the URL for the error page (hosted by service).\nThe {status} variable can be used in order to insert the status code in the URL.\nThe {originalStatus} variable can be used in order to insert the upstream status code in the URL.\nThe {url} variable can be used in order to insert the escaped request URL.", "type": "string" }, "service": { - "description": "Service defines the reference to a Kubernetes Service that will serve the error page.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/#service", + "description": "Service defines the reference to a Kubernetes Service that will serve the error page.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/errorpages/#service", "properties": { "healthCheck": { "description": "Healthcheck defines health checks for ExternalName services.", @@ -341,6 +376,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -416,7 +473,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -446,7 +503,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -505,7 +565,7 @@ "additionalProperties": false }, "forwardAuth": { - "description": "ForwardAuth holds the forward auth middleware configuration.\nThis middleware delegates the request authentication to a Service.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/", + "description": "ForwardAuth holds the forward auth middleware configuration.\nThis middleware delegates the request authentication to a Service.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/forwardauth/", "properties": { "addAuthCookiesToResponse": { "description": "AddAuthCookiesToResponse defines the list of cookies to copy from the authentication server response to the response.", @@ -533,7 +593,11 @@ "type": "array" }, "authResponseHeadersRegex": { - "description": "AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex", + "description": "AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex", + "type": "string" + }, + "authSigninURL": { + "description": "AuthSigninURL specifies the URL to redirect to when the authentication server returns 401 Unauthorized.", "type": "string" }, "forwardBody": { @@ -541,7 +605,7 @@ "type": "boolean" }, "headerField": { - "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#headerfield", + "description": "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/forwardauth/#headerfield", "type": "string" }, "maxBodySize": { @@ -586,7 +650,7 @@ "additionalProperties": false }, "trustForwardHeader": { - "description": "TrustForwardHeader defines whether to trust (ie: forward) all X-Forwarded-* headers.", + "description": "TrustForwardHeader defines whether to trust (ie: forward) all X-Forwarded-* headers.\n\nDeprecated: Use forwardedHeaders.trustedIPs at the EntryPoint level instead, and set trustForwardHeader to true on this middleware.", "type": "boolean" } }, @@ -608,7 +672,7 @@ "additionalProperties": false }, "headers": { - "description": "Headers holds the headers middleware configuration.\nThis middleware manages the requests and responses headers.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/headers/#customrequestheaders", + "description": "Headers holds the headers middleware configuration.\nThis middleware manages the requests and responses headers.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/headers/#customrequestheaders", "properties": { "accessControlAllowCredentials": { "description": "AccessControlAllowCredentials defines whether the request can include user credentials.", @@ -780,7 +844,7 @@ "additionalProperties": false }, "inFlightReq": { - "description": "InFlightReq holds the in-flight request middleware configuration.\nThis middleware limits the number of requests being processed and served concurrently.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/", + "description": "InFlightReq holds the in-flight request middleware configuration.\nThis middleware limits the number of requests being processed and served concurrently.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/inflightreq/", "properties": { "amount": { "description": "Amount defines the maximum amount of allowed simultaneous in-flight request.\nThe middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).", @@ -789,10 +853,10 @@ "type": "integer" }, "sourceCriterion": { - "description": "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the requestHost.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/#sourcecriterion", + "description": "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the requestHost.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/inflightreq/#sourcecriterion", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -831,10 +895,10 @@ "additionalProperties": false }, "ipAllowList": { - "description": "IPAllowList holds the IP allowlist middleware configuration.\nThis middleware limits allowed requests based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/", + "description": "IPAllowList holds the IP allowlist middleware configuration.\nThis middleware limits allowed requests based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -875,7 +939,7 @@ "description": "Deprecated: please use IPAllowList instead.", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -909,7 +973,7 @@ "additionalProperties": false }, "passTLSClientCert": { - "description": "PassTLSClientCert holds the pass TLS client cert middleware configuration.\nThis middleware adds the selected data from the passed client TLS certificate to a header.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/passtlsclientcert/", + "description": "PassTLSClientCert holds the pass TLS client cert middleware configuration.\nThis middleware adds the selected data from the passed client TLS certificate to a header.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/passtlsclientcert/", "properties": { "info": { "description": "Info selects the specific client certificate details you want to add to the X-Forwarded-Tls-Client-Cert-Info header.", @@ -1020,11 +1084,11 @@ "additionalProperties": { "x-kubernetes-preserve-unknown-fields": true }, - "description": "Plugin defines the middleware plugin configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/#community-middlewares", + "description": "Plugin defines the middleware plugin configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/overview/#community-middlewares", "type": "object" }, "rateLimit": { - "description": "RateLimit holds the rate limit configuration.\nThis middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/ratelimit/", + "description": "RateLimit holds the rate limit configuration.\nThis middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/ratelimit/", "properties": { "average": { "description": "Average is the maximum rate, by default in requests/s, allowed for the given source.\nIt defaults to 0, which means no rate limiting.\nThe rate is actually defined by dividing Average by Period. So for a rate below 1req/s,\none needs to define a Period larger than a second.", @@ -1146,7 +1210,7 @@ "description": "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the request's remote address field (as an ipStrategy).", "properties": { "ipStrategy": { - "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy", + "description": "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/ipallowlist/#ipstrategy", "properties": { "depth": { "description": "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", @@ -1185,7 +1249,7 @@ "additionalProperties": false }, "redirectRegex": { - "description": "RedirectRegex holds the redirect regex middleware configuration.\nThis middleware redirects a request using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectregex/#regex", + "description": "RedirectRegex holds the redirect regex middleware configuration.\nThis middleware redirects a request using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/redirectregex/#regex", "properties": { "permanent": { "description": "Permanent defines whether the redirection is permanent (308).", @@ -1204,7 +1268,7 @@ "additionalProperties": false }, "redirectScheme": { - "description": "RedirectScheme holds the redirect scheme middleware configuration.\nThis middleware redirects requests from a scheme/port to another.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectscheme/", + "description": "RedirectScheme holds the redirect scheme middleware configuration.\nThis middleware redirects requests from a scheme/port to another.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/redirectscheme/", "properties": { "permanent": { "description": "Permanent defines whether the redirection is permanent.\nFor HTTP GET requests a 301 is returned, otherwise a 308 is returned.", @@ -1223,7 +1287,7 @@ "additionalProperties": false }, "replacePath": { - "description": "ReplacePath holds the replace path middleware configuration.\nThis middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepath/", + "description": "ReplacePath holds the replace path middleware configuration.\nThis middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/replacepath/", "properties": { "path": { "description": "Path defines the path to use as replacement in the request URL.", @@ -1234,7 +1298,7 @@ "additionalProperties": false }, "replacePathRegex": { - "description": "ReplacePathRegex holds the replace path regex middleware configuration.\nThis middleware replaces the path of a URL using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepathregex/", + "description": "ReplacePathRegex holds the replace path regex middleware configuration.\nThis middleware replaces the path of a URL using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/replacepathregex/", "properties": { "regex": { "description": "Regex defines the regular expression used to match and capture the path from the request URL.", @@ -1249,13 +1313,17 @@ "additionalProperties": false }, "retry": { - "description": "Retry holds the retry middleware configuration.\nThis middleware reissues requests a given number of times to a backend server if that server does not reply.\nAs soon as the server answers, the middleware stops retrying, regardless of the response status.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/retry/", + "description": "Retry holds the retry middleware configuration.\nThis middleware reissues requests a given number of times to a backend server if that server does not reply.\nAs soon as the server answers, the middleware stops retrying, regardless of the response status.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/middlewares/retry/", "properties": { "attempts": { "description": "Attempts defines how many times the request should be retried.", "minimum": 0, "type": "integer" }, + "disableRetryOnNetworkError": { + "description": "DisableRetryOnNetworkError defines whether to disable the retry if an error occurs when transmitting the request to the server.", + "type": "boolean" + }, "initialInterval": { "anyOf": [ { @@ -1268,13 +1336,44 @@ "description": "InitialInterval defines the first wait time in the exponential backoff series.\nThe maximum interval is calculated as twice the initialInterval.\nIf unspecified, requests will be retried immediately.\nThe value of initialInterval should be provided in seconds or as a valid duration format,\nsee https://pkg.go.dev/time#ParseDuration.", "pattern": "^([0-9]+(ns|us|\u00b5s|ms|s|m|h)?)+$", "x-kubernetes-int-or-string": true + }, + "maxRequestBodyBytes": { + "description": "MaxRequestBodyBytes defines the maximum size for the request body.\nDefault is `-1`, which means no limit.", + "format": "int64", + "minimum": -1, + "type": "integer" + }, + "retryNonIdempotentMethod": { + "description": "RetryNonIdempotentMethod activates the retry for non-idempotent methods (POST, LOCK, PATCH)", + "type": "boolean" + }, + "status": { + "description": "Status defines the range of HTTP status codes to retry on.", + "items": { + "pattern": "^([1-5][0-9]{2}[,-]?)+$", + "type": "string" + }, + "type": "array" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines how much time the middleware is allowed to retry the request.\nThe value of timeout should be provided in seconds or as a valid duration format,\nsee https://pkg.go.dev/time#ParseDuration.", + "pattern": "^([0-9]+(ns|us|\u00b5s|ms|s|m|h)?)+$", + "x-kubernetes-int-or-string": true } }, "type": "object", "additionalProperties": false }, "stripPrefix": { - "description": "StripPrefix holds the strip prefix middleware configuration.\nThis middleware removes the specified prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefix/", + "description": "StripPrefix holds the strip prefix middleware configuration.\nThis middleware removes the specified prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/stripprefix/", "properties": { "forceSlash": { "description": "Deprecated: ForceSlash option is deprecated, please remove any usage of this option.\nForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.\nDefault: true.", @@ -1292,7 +1391,7 @@ "additionalProperties": false }, "stripPrefixRegex": { - "description": "StripPrefixRegex holds the strip prefix regex middleware configuration.\nThis middleware removes the matching prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefixregex/", + "description": "StripPrefixRegex holds the strip prefix regex middleware configuration.\nThis middleware removes the matching prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.7/middlewares/http/stripprefixregex/", "properties": { "regex": { "description": "Regex defines the regular expression to match the path prefix from the request URL.", diff --git a/crdSchemas/middlewaretcp_v1alpha1.json b/crdSchemas/middlewaretcp_v1alpha1.json index e97e6e6..3862ad7 100644 --- a/crdSchemas/middlewaretcp_v1alpha1.json +++ b/crdSchemas/middlewaretcp_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/", + "description": "MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/middlewares/overview/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -29,7 +29,7 @@ "additionalProperties": false }, "ipAllowList": { - "description": "IPAllowList defines the IPAllowList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/", + "description": "IPAllowList defines the IPAllowList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/middlewares/ipallowlist/", "properties": { "sourceRange": { "description": "SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).", @@ -43,7 +43,7 @@ "additionalProperties": false }, "ipWhiteList": { - "description": "IPWhiteList defines the IPWhiteList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/\n\nDeprecated: please use IPAllowList instead.", + "description": "IPWhiteList defines the IPWhiteList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/middlewares/ipwhitelist/\n\nDeprecated: please use IPAllowList instead.", "properties": { "sourceRange": { "description": "SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).", diff --git a/crdSchemas/serverstransport_v1alpha1.json b/crdSchemas/serverstransport_v1alpha1.json index bb929a0..6eacfcd 100644 --- a/crdSchemas/serverstransport_v1alpha1.json +++ b/crdSchemas/serverstransport_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "ServersTransport is the CRD implementation of a ServersTransport.\nIf no serversTransport is specified, the default@internal will be used.\nThe default@internal serversTransport is created from the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/", + "description": "ServersTransport is the CRD implementation of a ServersTransport.\nIf no serversTransport is specified, the default@internal will be used.\nThe default@internal serversTransport is created from the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/serverstransport/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -22,6 +22,13 @@ }, "type": "array" }, + "cipherSuites": { + "description": "CipherSuites defines the cipher suites to use when contacting backend servers.", + "items": { + "type": "string" + }, + "type": "array" + }, "disableHTTP2": { "description": "DisableHTTP2 disables HTTP/2 for connections with backend servers.", "type": "boolean" @@ -107,6 +114,14 @@ "minimum": -1, "type": "integer" }, + "maxVersion": { + "description": "MaxVersion defines the maximum TLS version to use when contacting backend servers.", + "type": "string" + }, + "minVersion": { + "description": "MinVersion defines the minimum TLS version to use when contacting backend servers.", + "type": "string" + }, "peerCertURI": { "description": "PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.", "type": "string" diff --git a/crdSchemas/serverstransporttcp_v1alpha1.json b/crdSchemas/serverstransporttcp_v1alpha1.json index 2e05c77..b2a0e8a 100644 --- a/crdSchemas/serverstransporttcp_v1alpha1.json +++ b/crdSchemas/serverstransporttcp_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "ServersTransportTCP is the CRD implementation of a TCPServersTransport.\nIf no tcpServersTransport is specified, a default one named default@internal will be used.\nThe default@internal tcpServersTransport can be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/", + "description": "ServersTransportTCP is the CRD implementation of a TCPServersTransport.\nIf no tcpServersTransport is specified, a default one named default@internal will be used.\nThe default@internal tcpServersTransport can be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/tcp/serverstransport/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/tlsoption_v1alpha1.json b/crdSchemas/tlsoption_v1alpha1.json index 7afcf90..d1e3501 100644 --- a/crdSchemas/tlsoption_v1alpha1.json +++ b/crdSchemas/tlsoption_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options", + "description": "TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -16,14 +16,14 @@ "description": "TLSOptionSpec defines the desired state of a TLSOption.", "properties": { "alpnProtocols": { - "description": "ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols", + "description": "ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols", "items": { "type": "string" }, "type": "array" }, "cipherSuites": { - "description": "CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites", + "description": "CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites", "items": { "type": "string" }, @@ -55,7 +55,7 @@ "additionalProperties": false }, "curvePreferences": { - "description": "CurvePreferences defines the preferred elliptic curves.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences", + "description": "CurvePreferences defines the preferred elliptic curves.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences", "items": { "type": "string" }, diff --git a/crdSchemas/tlsstore_v1alpha1.json b/crdSchemas/tlsstore_v1alpha1.json index 7f3381d..5089e66 100644 --- a/crdSchemas/tlsstore_v1alpha1.json +++ b/crdSchemas/tlsstore_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "TLSStore is the CRD implementation of a Traefik TLS Store.\nFor the time being, only the TLSStore named default is supported.\nThis means that you cannot have two stores that are named default in different Kubernetes namespaces.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores", + "description": "TLSStore is the CRD implementation of a Traefik TLS Store.\nFor the time being, only the TLSStore named default is supported.\nThis means that you cannot have two stores that are named default in different Kubernetes namespaces.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", diff --git a/crdSchemas/traefikservice_v1alpha1.json b/crdSchemas/traefikservice_v1alpha1.json index 30035a1..0a8deef 100644 --- a/crdSchemas/traefikservice_v1alpha1.json +++ b/crdSchemas/traefikservice_v1alpha1.json @@ -1,5 +1,5 @@ { - "description": "TraefikService is the CRD implementation of a Traefik Service.\nTraefikService object allows to:\n- Apply weight to Services on load-balancing\n- Mirror traffic on services\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/", + "description": "TraefikService is the CRD implementation of a Traefik Service.\nTraefikService object allows to:\n- Apply weight to Services on load-balancing\n- Mirror traffic on services\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/traefikservice/", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -15,6 +15,561 @@ "spec": { "description": "TraefikServiceSpec defines the desired state of a TraefikService.", "properties": { + "failover": { + "description": "Failover defines the Failover service configuration.", + "properties": { + "errors": { + "description": "Errors defines which errors should trigger the use of the fallback service.", + "properties": { + "maxRequestBodyBytes": { + "description": "MaxRequestBodyBytes defines the maximum size allowed for the body of the request.\nDefault value is -1, which means unlimited size.", + "format": "int64", + "type": "integer" + }, + "status": { + "description": "Status defines the list of status code ranges for which the fallback service should be used.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + }, + "fallback": { + "description": "Fallback defines the fallback service to use when the main service returns an error.", + "properties": { + "healthCheck": { + "description": "Healthcheck defines health checks for ExternalName services.", + "properties": { + "followRedirects": { + "description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + "type": "boolean" + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "description": "Headers defines custom headers to be sent to the health check endpoint.", + "type": "object" + }, + "hostname": { + "description": "Hostname defines the value of hostname in the Host header of the health check request.", + "type": "string" + }, + "interval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + "method": { + "description": "Method defines the healthcheck method.", + "type": "string" + }, + "mode": { + "description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + "type": "string" + }, + "path": { + "description": "Path defines the server URL path for the health check endpoint.", + "type": "string" + }, + "port": { + "description": "Port defines the server URL port for the health check endpoint.", + "type": "integer" + }, + "scheme": { + "description": "Scheme replaces the server URL scheme for the health check endpoint.", + "type": "string" + }, + "status": { + "description": "Status defines the expected HTTP status code of the response to the health check request.", + "type": "integer" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + }, + "unhealthyInterval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s", + "x-kubernetes-int-or-string": true + } + }, + "type": "object", + "additionalProperties": false + }, + "kind": { + "description": "Kind defines the kind of the Service.", + "enum": [ + "Service", + "TraefikService" + ], + "type": "string" + }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "name": { + "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + "type": "string" + }, + "nativeLB": { + "description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + "type": "boolean" + }, + "nodePortLB": { + "description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + "type": "boolean" + }, + "passHostHeader": { + "description": "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + "type": "boolean" + }, + "passiveHealthCheck": { + "description": "PassiveHealthCheck defines passive health checks for ExternalName services.", + "properties": { + "failureWindow": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.", + "x-kubernetes-int-or-string": true + }, + "maxFailedAttempts": { + "description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + "responseForwarding": { + "description": "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + "properties": { + "flushInterval": { + "description": "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "scheme": { + "description": "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + "type": "string" + }, + "serversTransport": { + "description": "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + "type": "string" + }, + "sticky": { + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "properties": { + "cookie": { + "description": "Cookie defines the sticky cookie configuration.", + "properties": { + "domain": { + "description": "Domain defines the host to which the cookie will be sent.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value", + "type": "string" + }, + "httpOnly": { + "description": "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + "type": "boolean" + }, + "maxAge": { + "description": "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + "type": "integer" + }, + "name": { + "description": "Name defines the Cookie name.", + "type": "string" + }, + "path": { + "description": "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + "type": "string" + }, + "sameSite": { + "description": "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + "enum": [ + "none", + "lax", + "strict", + "None", + "Lax", + "Strict" + ], + "type": "string" + }, + "secure": { + "description": "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "strategy": { + "description": "Strategy defines the load balancing strategy between the servers.\nSupported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).\nRoundRobin value is deprecated and supported for backward compatibility.", + "enum": [ + "wrr", + "p2c", + "hrw", + "leasttime", + "RoundRobin" + ], + "type": "string" + }, + "weight": { + "description": "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "service": { + "description": "Service defines the main service to use.", + "properties": { + "healthCheck": { + "description": "Healthcheck defines health checks for ExternalName services.", + "properties": { + "followRedirects": { + "description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + "type": "boolean" + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "description": "Headers defines custom headers to be sent to the health check endpoint.", + "type": "object" + }, + "hostname": { + "description": "Hostname defines the value of hostname in the Host header of the health check request.", + "type": "string" + }, + "interval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + "method": { + "description": "Method defines the healthcheck method.", + "type": "string" + }, + "mode": { + "description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + "type": "string" + }, + "path": { + "description": "Path defines the server URL path for the health check endpoint.", + "type": "string" + }, + "port": { + "description": "Port defines the server URL port for the health check endpoint.", + "type": "integer" + }, + "scheme": { + "description": "Scheme replaces the server URL scheme for the health check endpoint.", + "type": "string" + }, + "status": { + "description": "Status defines the expected HTTP status code of the response to the health check request.", + "type": "integer" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + }, + "unhealthyInterval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s", + "x-kubernetes-int-or-string": true + } + }, + "type": "object", + "additionalProperties": false + }, + "kind": { + "description": "Kind defines the kind of the Service.", + "enum": [ + "Service", + "TraefikService" + ], + "type": "string" + }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, + "name": { + "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + "type": "string" + }, + "nativeLB": { + "description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + "type": "boolean" + }, + "nodePortLB": { + "description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + "type": "boolean" + }, + "passHostHeader": { + "description": "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + "type": "boolean" + }, + "passiveHealthCheck": { + "description": "PassiveHealthCheck defines passive health checks for ExternalName services.", + "properties": { + "failureWindow": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.", + "x-kubernetes-int-or-string": true + }, + "maxFailedAttempts": { + "description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "port": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + "responseForwarding": { + "description": "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + "properties": { + "flushInterval": { + "description": "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + "type": "string" + } + }, + "type": "object", + "additionalProperties": false + }, + "scheme": { + "description": "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + "type": "string" + }, + "serversTransport": { + "description": "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + "type": "string" + }, + "sticky": { + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "properties": { + "cookie": { + "description": "Cookie defines the sticky cookie configuration.", + "properties": { + "domain": { + "description": "Domain defines the host to which the cookie will be sent.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value", + "type": "string" + }, + "httpOnly": { + "description": "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + "type": "boolean" + }, + "maxAge": { + "description": "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + "type": "integer" + }, + "name": { + "description": "Name defines the Cookie name.", + "type": "string" + }, + "path": { + "description": "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + "type": "string" + }, + "sameSite": { + "description": "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + "enum": [ + "none", + "lax", + "strict", + "None", + "Lax", + "Strict" + ], + "type": "string" + }, + "secure": { + "description": "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + "type": "boolean" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object", + "additionalProperties": false + }, + "strategy": { + "description": "Strategy defines the load balancing strategy between the servers.\nSupported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).\nRoundRobin value is deprecated and supported for backward compatibility.", + "enum": [ + "wrr", + "p2c", + "hrw", + "leasttime", + "RoundRobin" + ], + "type": "string" + }, + "weight": { + "description": "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + } + }, + "required": [ + "errors", + "fallback", + "service" + ], + "type": "object", + "additionalProperties": false + }, "highestRandomWeight": { "description": "HighestRandomWeight defines the highest random weight service configuration.", "properties": { @@ -113,6 +668,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -188,7 +765,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -218,7 +795,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -361,6 +941,28 @@ "format": "int64", "type": "integer" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "mirrorBody": { "description": "MirrorBody defines whether the body of the request should be mirrored.\nDefault value is true.", "type": "boolean" @@ -460,6 +1062,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -539,7 +1163,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -569,7 +1193,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -685,7 +1312,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -715,7 +1342,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -852,6 +1482,28 @@ ], "type": "string" }, + "middlewares": { + "description": "Middlewares defines the list of references to Middleware resources to apply to the service.", + "items": { + "description": "MiddlewareRef is a reference to a Middleware resource.", + "properties": { + "name": { + "description": "Name defines the name of the referenced Middleware resource.", + "type": "string" + }, + "namespace": { + "description": "Namespace defines the namespace of the referenced Middleware resource.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + }, "name": { "description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", "type": "string" @@ -927,7 +1579,7 @@ "type": "string" }, "sticky": { - "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", + "description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/http/load-balancing/service/#sticky-sessions", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -957,7 +1609,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, @@ -999,7 +1654,7 @@ "type": "array" }, "sticky": { - "description": "Sticky defines whether sticky sessions are enabled.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing", + "description": "Sticky defines whether sticky sessions are enabled.\nMore info: https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing", "properties": { "cookie": { "description": "Cookie defines the sticky cookie configuration.", @@ -1029,7 +1684,10 @@ "enum": [ "none", "lax", - "strict" + "strict", + "None", + "Lax", + "Strict" ], "type": "string" }, diff --git a/crdSchemas/uplink_v1alpha1.json b/crdSchemas/uplink_v1alpha1.json new file mode 100644 index 0000000..8c07f3a --- /dev/null +++ b/crdSchemas/uplink_v1alpha1.json @@ -0,0 +1,212 @@ +{ + "description": "Uplink is an inter-cluster service advertisement: a child cluster declares an Uplink to advertise\nto a parent cluster that it can handle a particular workload.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "type": "object" + }, + "spec": { + "description": "UplinkSpec describes the Uplink.", + "properties": { + "entryPoints": { + "description": "EntryPoints references uplinkEntryPoints. When omitted, uses default uplinkEntrypoints.", + "items": { + "type": "string" + }, + "type": "array" + }, + "exposeName": { + "description": "ExposeName is the name of the service to expose.\nBy default it uses -.", + "type": "string" + }, + "healthCheck": { + "description": "HealthCheck configures the active health check on the parent cluster for this uplink's load balancer.", + "properties": { + "followRedirects": { + "description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + "type": "boolean" + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "description": "Headers defines custom headers to be sent to the health check endpoint.", + "type": "object" + }, + "hostname": { + "description": "Hostname defines the value of hostname in the Host header of the health check request.", + "type": "string" + }, + "interval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + "method": { + "description": "Method defines the healthcheck method.", + "type": "string" + }, + "mode": { + "description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + "type": "string" + }, + "path": { + "description": "Path defines the server URL path for the health check endpoint.", + "type": "string" + }, + "port": { + "description": "Port defines the server URL port for the health check endpoint.", + "type": "integer" + }, + "scheme": { + "description": "Scheme replaces the server URL scheme for the health check endpoint.", + "type": "string" + }, + "status": { + "description": "Status defines the expected HTTP status code of the response to the health check request.", + "type": "integer" + }, + "timeout": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + }, + "unhealthyInterval": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s", + "x-kubernetes-int-or-string": true + } + }, + "type": "object", + "additionalProperties": false + }, + "passiveHealthCheck": { + "description": "PassiveHealthCheck configures the passive health check on the parent cluster for this uplink's load balancer.", + "properties": { + "failureWindow": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.", + "x-kubernetes-int-or-string": true + }, + "maxFailedAttempts": { + "description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.", + "type": "integer" + } + }, + "type": "object", + "additionalProperties": false + }, + "weight": { + "description": "Weight for WRR on the parent.", + "type": "integer", + "x-kubernetes-validations": [ + { + "message": "must be a positive number", + "rule": "self >= 0" + } + ] + } + }, + "type": "object", + "additionalProperties": false + }, + "status": { + "description": "The current status of this Uplink.", + "properties": { + "conditions": { + "items": { + "description": "Condition contains details for one aspect of the current state of this API Resource.", + "properties": { + "lastTransitionTime": { + "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + "format": "date-time", + "type": "string" + }, + "message": { + "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + "maxLength": 32768, + "type": "string" + }, + "observedGeneration": { + "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + "format": "int64", + "minimum": 0, + "type": "integer" + }, + "reason": { + "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + "maxLength": 1024, + "minLength": 1, + "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + "type": "string" + }, + "status": { + "description": "status of the condition, one of True, False, Unknown.", + "enum": [ + "True", + "False", + "Unknown" + ], + "type": "string" + }, + "type": { + "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", + "maxLength": 316, + "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + "type": "string" + } + }, + "required": [ + "lastTransitionTime", + "message", + "reason", + "status", + "type" + ], + "type": "object", + "additionalProperties": false + }, + "type": "array" + } + }, + "type": "object", + "additionalProperties": false + } + }, + "type": "object" +} diff --git a/crdSchemas/virtualmcpserver_v1alpha1.json b/crdSchemas/virtualmcpserver_v1alpha1.json index b11eefb..72dfb03 100644 --- a/crdSchemas/virtualmcpserver_v1alpha1.json +++ b/crdSchemas/virtualmcpserver_v1alpha1.json @@ -24,7 +24,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -34,6 +34,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -252,7 +277,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", diff --git a/crdSchemas/virtualmcpserver_v1beta1.json b/crdSchemas/virtualmcpserver_v1beta1.json index d8d0a19..736751d 100644 --- a/crdSchemas/virtualmcpserver_v1beta1.json +++ b/crdSchemas/virtualmcpserver_v1beta1.json @@ -24,7 +24,7 @@ "type": "string" }, "baselineClientScopes": { - "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.", + "description": "BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be\nincluded in every client registration. The embedded auth server unions these\nscopes into the registered set returned by RFC 7591 Dynamic Client\nRegistration, so a client that narrows the `scope` field at /oauth/register\ncan still request the baseline scopes at /oauth/authorize. All values must\nbe present in the upstream-derived scopesSupported set; the auth server\nfails to start if any value is missing.\n\nSecurity: every client registered via /oauth/register will gain the\nability to request these scopes at /oauth/authorize, regardless of what\nthe client itself requested. Keep the baseline narrow (typically\n\"openid\" and \"offline_access\"). Adding a privileged scope here \u2014 e.g.\n\"admin:read\" \u2014 would grant it to every DCR-registered client, including\npublic clients like Claude Code, Cursor, and VS Code.\nWhen cimd.enabled is true, every dynamically resolved CIMD client will\nalso gain the ability to request these scopes, including third-party\nclients resolved from arbitrary HTTPS URLs.", "items": { "minLength": 1, "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$", @@ -34,6 +34,31 @@ "type": "array", "x-kubernetes-list-type": "atomic" }, + "cimd": { + "description": "CIMD configures Client ID Metadata Document support. When omitted, CIMD is disabled.", + "properties": { + "cacheFallbackTtl": { + "description": "CacheFallbackTTL is the fixed TTL applied to every cached CIMD document.\nCache-Control header parsing is not yet implemented; all entries use this value.\nFormat: Go duration string (e.g. \"5m\", \"10m\", \"1h\").\nDefaults to 5 minutes when Enabled is true and this field is omitted.", + "pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$", + "type": "string" + }, + "cacheMaxSize": { + "description": "CacheMaxSize is the maximum number of CIMD documents held in the LRU cache.\nDefaults to 256 when Enabled is true and this field is omitted.", + "minimum": 1, + "type": "integer" + }, + "enabled": { + "default": false, + "description": "Enabled activates CIMD client lookup. When false (the default), the AS only\naccepts client_id values that were registered via DCR.", + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object", + "additionalProperties": false + }, "hmacSecretRefs": { "description": "HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing\nauthorization codes and refresh tokens (opaque tokens).\nCurrent secret must be at least 32 bytes and cryptographically random.\nSupports secret rotation via multiple entries (first is current, rest are for verification).\nIf not specified, an ephemeral secret will be auto-generated (development only -\nauth codes and refresh tokens will be invalid after restart).", "items": { @@ -252,7 +277,7 @@ "additionalProperties": false }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.",