first commit
This commit is contained in:
@@ -0,0 +1,459 @@
|
||||
{
|
||||
"description": "AccessControlPolicy defines an access control policy.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "AccessControlPolicySpec configures an access control policy.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "AccessControlPolicyAPIKey configure an APIKey control policy.",
|
||||
"properties": {
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.",
|
||||
"type": "object"
|
||||
},
|
||||
"keySource": {
|
||||
"description": "KeySource defines how to extract API keys from requests.",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie is the name of a cookie.",
|
||||
"type": "string"
|
||||
},
|
||||
"header": {
|
||||
"description": "Header is the name of a header.",
|
||||
"type": "string"
|
||||
},
|
||||
"headerAuthScheme": {
|
||||
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
||||
"type": "string"
|
||||
},
|
||||
"query": {
|
||||
"description": "Query is the name of a query parameter.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"keys": {
|
||||
"description": "Keys define the set of authorized keys to access a protected resource.",
|
||||
"items": {
|
||||
"description": "AccessControlPolicyAPIKeyKey defines an API key.",
|
||||
"properties": {
|
||||
"id": {
|
||||
"description": "ID is the unique identifier of the key.",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.",
|
||||
"type": "object"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is the SHAKE-256 hash (using 64 bytes) of the API key.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"id",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"keySource"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"basicAuth": {
|
||||
"description": "AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.",
|
||||
"properties": {
|
||||
"forwardUsernameHeader": {
|
||||
"type": "string"
|
||||
},
|
||||
"realm": {
|
||||
"type": "string"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"users": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"jwt": {
|
||||
"description": "AccessControlPolicyJWT configures a JWT access control policy.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"jwksFile": {
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"publicKey": {
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecret": {
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecretBase64Encoded": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"tokenQueryKey": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oAuthIntro": {
|
||||
"description": "AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientConfig": {
|
||||
"description": "AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.",
|
||||
"properties": {
|
||||
"headers": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Headers to set when sending requests to the Authorization Server.",
|
||||
"type": "object"
|
||||
},
|
||||
"maxRetries": {
|
||||
"default": 3,
|
||||
"description": "MaxRetries defines the number of retries for introspection requests.",
|
||||
"type": "integer"
|
||||
},
|
||||
"timeoutSeconds": {
|
||||
"default": 5,
|
||||
"description": "TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.",
|
||||
"type": "integer"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS configures TLS communication with the Authorization Server.",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"description": "CA sets the CA bundle used to sign the Authorization Server certificate.",
|
||||
"type": "string"
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify skips the Authorization Server certificate validation.\nFor testing purposes only, do not use in production.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tokenTypeHint": {
|
||||
"description": "TokenTypeHint is a hint to pass to the Authorization Server.\nSee https://tools.ietf.org/html/rfc7662#section-2.1 for more information.",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL of the Authorization Server.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"tokenSource": {
|
||||
"description": "TokenSource describes how to extract tokens from HTTP requests.\nIf multiple sources are set, the order is the following: header > query > cookie.",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie is the name of a cookie.",
|
||||
"type": "string"
|
||||
},
|
||||
"header": {
|
||||
"description": "Header is the name of a header.",
|
||||
"type": "string"
|
||||
},
|
||||
"headerAuthScheme": {
|
||||
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
||||
"type": "string"
|
||||
},
|
||||
"query": {
|
||||
"description": "Query is the name of a query parameter.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"clientConfig",
|
||||
"tokenSource"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidc": {
|
||||
"description": "AccessControlPolicyOIDC holds the OIDC authentication configuration.",
|
||||
"properties": {
|
||||
"authParams": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"disableAuthRedirectionPaths": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"issuer": {
|
||||
"type": "string"
|
||||
},
|
||||
"logoutUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"redirectUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secret": {
|
||||
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "name is unique within a namespace to reference a secret resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "namespace defines the space within which the secret name must be unique.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"session": {
|
||||
"description": "Session holds session configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"refresh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"stateCookie": {
|
||||
"description": "StateCookie holds state cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidcGoogle": {
|
||||
"description": "AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.",
|
||||
"properties": {
|
||||
"authParams": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"emails": {
|
||||
"description": "Emails are the allowed emails to connect.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"logoutUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"redirectUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"secret": {
|
||||
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "name is unique within a namespace to reference a secret resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "namespace defines the space within which the secret name must be unique.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"session": {
|
||||
"description": "Session holds session configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"refresh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"stateCookie": {
|
||||
"description": "StateCookie holds state cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this access control policy.",
|
||||
"properties": {
|
||||
"specHash": {
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,487 @@
|
||||
{
|
||||
"description": "AIService is a Kubernetes-like Service to interact with a text-based LLM provider. It defines the parameters and credentials required to interact with various LLM providers.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this AIService.",
|
||||
"properties": {
|
||||
"anthropic": {
|
||||
"description": "Anthropic configures Anthropic backend.",
|
||||
"properties": {
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"azureOpenai": {
|
||||
"description": "AzureOpenAI configures AzureOpenAI.",
|
||||
"properties": {
|
||||
"apiKeySecret": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"deploymentName": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseUrl",
|
||||
"deploymentName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"bedrock": {
|
||||
"description": "Bedrock configures Bedrock backend.",
|
||||
"properties": {
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"region": {
|
||||
"type": "string"
|
||||
},
|
||||
"systemMessage": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"cohere": {
|
||||
"description": "Cohere configures Cohere backend.",
|
||||
"properties": {
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"deepSeek": {
|
||||
"description": "DeepSeek configures DeepSeek.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"gemini": {
|
||||
"description": "Gemini configures Gemini backend.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"mistral": {
|
||||
"description": "Mistral configures Mistral AI backend.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ollama": {
|
||||
"description": "Ollama configures Ollama backend.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseUrl"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"openai": {
|
||||
"description": "OpenAI configures OpenAI.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"qWen": {
|
||||
"description": "QWen configures QWen.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,340 @@
|
||||
{
|
||||
"description": "API defines an HTTP interface that is exposed to external clients. It specifies the supported versions\nand provides instructions for accessing its documentation. Once instantiated, an API object is associated\nwith an Ingress, IngressRoute, or HTTPRoute resource, enabling the exposure of the described API to the outside world.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "APISpec describes the API.",
|
||||
"properties": {
|
||||
"cors": {
|
||||
"description": "Cors defines the Cross-Origin Resource Sharing configuration.",
|
||||
"properties": {
|
||||
"addVaryHeader": {
|
||||
"description": "AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowCredentials": {
|
||||
"description": "AllowCredentials defines whether the request can include user credentials.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowHeadersList": {
|
||||
"description": "AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowMethodsList": {
|
||||
"description": "AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginListRegex": {
|
||||
"description": "AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginsList": {
|
||||
"description": "AllowOriginsList is a list of allowable origins. Can also be a wildcard origin \"*\".",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"exposeHeadersList": {
|
||||
"description": "ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"maxAge": {
|
||||
"description": "MaxAge defines the time that a preflight request may be cached.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description explains what the API does.",
|
||||
"type": "string"
|
||||
},
|
||||
"openApiSpec": {
|
||||
"description": "OpenAPISpec defines the API contract as an OpenAPI specification.",
|
||||
"properties": {
|
||||
"operationSets": {
|
||||
"description": "OperationSets defines the sets of operations to be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"items": {
|
||||
"description": "OperationSet gives a name to a set of matching OpenAPI operations.\nThis set of operations can then be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"properties": {
|
||||
"matchers": {
|
||||
"description": "Matchers defines a list of alternative rules for matching OpenAPI operations.",
|
||||
"items": {
|
||||
"description": "OperationMatcher defines criteria for matching an OpenAPI operation.",
|
||||
"minProperties": 1,
|
||||
"properties": {
|
||||
"methods": {
|
||||
"description": "Methods specifies the HTTP methods to be included for selection.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 10,
|
||||
"type": "array"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the exact path of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathPrefix": {
|
||||
"description": "PathPrefix specifies the path prefix of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathRegex": {
|
||||
"description": "PathRegex specifies a regular expression pattern for matching operations based on their paths.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path, pathPrefix and pathRegex are mutually exclusive",
|
||||
"rule": "[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the OperationSet to reference in APICatalogItems or ManagedSubscriptions.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"matchers",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
},
|
||||
"override": {
|
||||
"description": "Override holds data used to override OpenAPI specification.",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"url": {
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"servers"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.\nThe Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.\nIt's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.\nThe Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.\nThe URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validateRequestMethodAndPath": {
|
||||
"description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path or url must be defined",
|
||||
"rule": "has(self.path) || has(self.url)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the human-readable name of the API that will be used on the portal.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"versions": {
|
||||
"description": "Versions are the different APIVersions available.",
|
||||
"items": {
|
||||
"description": "APIVersionRef references an APIVersion.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIVersion.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this API.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the API.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,270 @@
|
||||
{
|
||||
"description": "APIAuth defines the authentication configuration for APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIAuth.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "APIKey configures API key authentication.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"isDefault": {
|
||||
"description": "IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.\nOnly one APIAuth per namespace should have isDefault set to true.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"jwt": {
|
||||
"description": "JWT configures JWT authentication.",
|
||||
"properties": {
|
||||
"appIdClaim": {
|
||||
"description": "AppIDClaim is the name of the claim holding the identifier of the application.\nThis field is sometimes named `client_id`.",
|
||||
"type": "string"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ForwardHeaders specifies additional headers to forward with the request.",
|
||||
"type": "object"
|
||||
},
|
||||
"jwksFile": {
|
||||
"description": "JWKSFile contains the JWKS file content for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSURL, and TrustedIssuers.",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid HTTPS URL",
|
||||
"rule": "isURL(self) && self.startsWith('https://')"
|
||||
}
|
||||
]
|
||||
},
|
||||
"publicKey": {
|
||||
"description": "PublicKey is the PEM-encoded public key for JWT verification.\nMutually exclusive with SigningSecretName, JWKSFile, JWKSURL, and TrustedIssuers.",
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecretName": {
|
||||
"description": "SigningSecretName is the name of the Kubernetes Secret containing the signing secret.\nThe secret must be of type Opaque and contain a key named 'value'.\nMutually exclusive with PublicKey, JWKSFile, JWKSURL, and TrustedIssuers.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"description": "StripAuthorizationHeader determines whether to strip the Authorization header before forwarding the request.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"tokenNameClaim": {
|
||||
"description": "TokenNameClaim is the name of the claim holding the name of the token.\nThis name, if provided, will be used in the metrics.",
|
||||
"type": "string"
|
||||
},
|
||||
"tokenQueryKey": {
|
||||
"description": "TokenQueryKey specifies the query parameter name for the JWT token.",
|
||||
"type": "string"
|
||||
},
|
||||
"trustedIssuers": {
|
||||
"description": "TrustedIssuers defines multiple JWKS providers with optional issuer validation.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and JWKSURL.",
|
||||
"items": {
|
||||
"description": "TrustedIssuer represents a trusted JWT issuer with its associated JWKS endpoint for token verification.",
|
||||
"properties": {
|
||||
"issuer": {
|
||||
"description": "Issuer is the expected value of the \"iss\" claim.\nIf specified, tokens must have this exact issuer to be validated against this JWKS.\nThe issuer value must match exactly, including trailing slashes and URL encoding.\nIf omitted, this JWKS acts as a fallback for any issuer.",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS from.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid HTTPS URL",
|
||||
"rule": "isURL(self) && self.startsWith('https://')"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"jwksUrl"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"appIdClaim"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "exactly one of signingSecretName, publicKey, jwksFile, jwksUrl, or trustedIssuers must be specified",
|
||||
"rule": "[has(self.signingSecretName), has(self.publicKey), has(self.jwksFile), has(self.jwksUrl), has(self.trustedIssuers)].filter(x, x).size() == 1"
|
||||
},
|
||||
{
|
||||
"message": "trustedIssuers must not be empty when specified",
|
||||
"rule": "!has(self.trustedIssuers) || size(self.trustedIssuers) > 0"
|
||||
},
|
||||
{
|
||||
"message": "only one entry in trustedIssuers may omit the issuer field",
|
||||
"rule": "!has(self.trustedIssuers) || self.trustedIssuers.filter(x, !has(x.issuer) || x.issuer == \"\").size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ldap": {
|
||||
"description": "LDAP configures LDAP authentication.",
|
||||
"properties": {
|
||||
"attribute": {
|
||||
"default": "cn",
|
||||
"description": "Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.\nThe bind DN is formed as <Attribute>=<Username>,<BaseDN>.",
|
||||
"type": "string"
|
||||
},
|
||||
"baseDn": {
|
||||
"description": "BaseDN is the base domain name that should be used for bind and search queries.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindDn": {
|
||||
"description": "BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.\nIf empty, an anonymous bind will be done.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindPasswordSecretName": {
|
||||
"description": "BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.\nThe secret must contain a key named 'password'.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"certificateAuthority": {
|
||||
"description": "CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the\nconnection uses TLS but that the certificate was signed by a custom Certificate Authority.",
|
||||
"type": "string"
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify controls whether the server's certificate chain and host name is verified.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"searchFilter": {
|
||||
"description": "SearchFilter is used to filter LDAP search queries.\nExample: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))\n%s can be used as a placeholder for the username.",
|
||||
"type": "string"
|
||||
},
|
||||
"startTls": {
|
||||
"description": "StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid LDAP URL",
|
||||
"rule": "isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseDn",
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"isDefault"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "exactly one authentication method must be specified",
|
||||
"rule": "[has(self.apiKey), has(self.jwt), has(self.ldap)].filter(x, x).size() == 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIAuth.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIAuth.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,212 @@
|
||||
{
|
||||
"description": "APIBundle defines a set of APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIBundle.",
|
||||
"properties": {
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be accessible to the configured audience.\nMultiple APIBundles can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be accessible to the configured audience.\nMultiple APIBundles can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the human-readable name of the APIBundle that will be used on the portal.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIBundle.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions is the list of status conditions.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIBundle.",
|
||||
"type": "string"
|
||||
},
|
||||
"resolvedApis": {
|
||||
"description": "ResolvedAPIs is the list of APIs that were successfully resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"unresolvedApis": {
|
||||
"description": "UnresolvedAPIs is the list of APIs that could not be resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,284 @@
|
||||
{
|
||||
"description": "APICatalogItem defines APIs that will be part of the API catalog on the portal.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APICatalogItem.",
|
||||
"properties": {
|
||||
"apiBundles": {
|
||||
"description": "APIBundles defines a set of APIBundle that will be visible to the configured audience.\nMultiple APICatalogItem can select the same APIBundles.",
|
||||
"items": {
|
||||
"description": "APIBundleReference references an APIBundle.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIBundle.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apiBundles",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"apiPlan": {
|
||||
"description": "APIPlan defines which APIPlan will be available.\nIf multiple APICatalogItem specify the same API with different APIPlan, the API consumer will be able to pick\na plan from this list.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIPlan.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be visible to the configured audience.\nMultiple APICatalogItem can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be visible to the configured audience.\nMultiple APICatalogItem can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"everyone": {
|
||||
"description": "Everyone indicates that all users will see these APIs.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups are the consumer groups that will see the APIs.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"operationFilter": {
|
||||
"description": "OperationFilter specifies the visible operations on APIs and APIVersions.\nIf not set, all operations are available.\nAn empty OperationFilter prohibits all operations.",
|
||||
"properties": {
|
||||
"include": {
|
||||
"description": "Include defines the names of OperationSets that will be accessible.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "groups and everyone are mutually exclusive",
|
||||
"rule": "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true"
|
||||
},
|
||||
{
|
||||
"message": "groups is required when everyone is false",
|
||||
"rule": "(has(self.everyone) && self.everyone) || (has(self.groups) && self.groups.size() > 0)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APICatalogItem.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions is the list of status conditions.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APICatalogItem.",
|
||||
"type": "string"
|
||||
},
|
||||
"resolvedApis": {
|
||||
"description": "ResolvedAPIs is the list of APIs that were successfully resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"unresolvedApis": {
|
||||
"description": "UnresolvedAPIs is the list of APIs that could not be resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,190 @@
|
||||
{
|
||||
"description": "APIPlan defines API Plan policy.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIPlan.",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description describes the plan.",
|
||||
"type": "string"
|
||||
},
|
||||
"quota": {
|
||||
"description": "Quota defines the quota policy.",
|
||||
"properties": {
|
||||
"bucket": {
|
||||
"default": "subscription",
|
||||
"description": "Bucket defines the bucket strategy for the quota.",
|
||||
"enum": [
|
||||
"subscription",
|
||||
"application-api",
|
||||
"application"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"limit": {
|
||||
"description": "Limit is the maximum number of requests per sliding Period.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"period": {
|
||||
"description": "Period is the unit of time for the Limit.",
|
||||
"format": "duration",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be between 1s and 9999h",
|
||||
"rule": "self >= duration('1s') && self <= duration('9999h')"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"limit"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"rateLimit": {
|
||||
"description": "RateLimit defines the rate limit policy.",
|
||||
"properties": {
|
||||
"bucket": {
|
||||
"default": "subscription",
|
||||
"description": "Bucket defines the bucket strategy for the rate limit.",
|
||||
"enum": [
|
||||
"subscription",
|
||||
"application-api",
|
||||
"application"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"limit": {
|
||||
"description": "Limit is the number of requests per Period used to calculate the regeneration rate.\nTraffic will converge to this rate over time by delaying requests when possible, and dropping them when throttling alone is not enough.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"period": {
|
||||
"description": "Period is the time unit used to express the rate.\nCombined with Limit, it defines the rate at which request capacity regenerates (Limit \u00f7 Period).",
|
||||
"format": "duration",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be between 1s and 1h",
|
||||
"rule": "self >= duration('1s') && self <= duration('1h')"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"limit"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the human-readable name of the plan.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"title"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIPlan.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIPlan.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,207 @@
|
||||
{
|
||||
"description": "APIPortal defines a developer portal for accessing the documentation of APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIPortal.",
|
||||
"properties": {
|
||||
"auth": {
|
||||
"description": "Auth references the APIPortalAuth resource for authentication configuration.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the APIPortalAuth resource.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description of the APIPortal.",
|
||||
"type": "string"
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the public facing name of the APIPortal.",
|
||||
"type": "string"
|
||||
},
|
||||
"trustedUrls": {
|
||||
"description": "TrustedURLs are the urls that are trusted by the OAuth 2.0 authorization server.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 1,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URLs",
|
||||
"rule": "self.all(x, isURL(x))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"ui": {
|
||||
"description": "UI holds the UI customization options.",
|
||||
"properties": {
|
||||
"logoUrl": {
|
||||
"description": "LogoURL is the public URL of the logo.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"trustedUrls"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIPortal.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIPortal.",
|
||||
"type": "string"
|
||||
},
|
||||
"oidc": {
|
||||
"description": "OIDC is the OIDC configuration for accessing the exposed APIPortal WebUI.",
|
||||
"properties": {
|
||||
"clientId": {
|
||||
"description": "ClientID is the OIDC ClientID for accessing the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"companyClaim": {
|
||||
"description": "CompanyClaim is the name of the JWT claim containing the user company.",
|
||||
"type": "string"
|
||||
},
|
||||
"emailClaim": {
|
||||
"description": "EmailClaim is the name of the JWT claim containing the user email.",
|
||||
"type": "string"
|
||||
},
|
||||
"firstnameClaim": {
|
||||
"description": "FirstnameClaim is the name of the JWT claim containing the user firstname.",
|
||||
"type": "string"
|
||||
},
|
||||
"generic": {
|
||||
"description": "Generic indicates whether or not the APIPortal authentication relies on Generic OIDC.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"groupsClaim": {
|
||||
"description": "GroupsClaim is the name of the JWT claim containing the user groups.",
|
||||
"type": "string"
|
||||
},
|
||||
"issuer": {
|
||||
"description": "Issuer is the OIDC issuer for accessing the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastnameClaim": {
|
||||
"description": "LastnameClaim is the name of the JWT claim containing the user lastname.",
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is the OIDC scopes for getting user attributes during the authentication to the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "SecretName is the name of the secret containing the OIDC ClientSecret for accessing the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAttributes": {
|
||||
"description": "SyncedAttributes configure the user attributes to sync.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"userIdClaim": {
|
||||
"description": "UserIDClaim is the name of the JWT claim containing the user ID.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,297 @@
|
||||
{
|
||||
"description": "APIPortalAuth defines the authentication configuration for an APIPortal.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIPortalAuth.",
|
||||
"properties": {
|
||||
"ldap": {
|
||||
"description": "LDAP configures the LDAP authentication.",
|
||||
"properties": {
|
||||
"attribute": {
|
||||
"default": "cn",
|
||||
"description": "Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.\nThe bind DN is formed as <Attribute>=<Username>,<BaseDN>.",
|
||||
"type": "string"
|
||||
},
|
||||
"attributes": {
|
||||
"description": "Attributes configures LDAP attribute mappings for user attributes.",
|
||||
"properties": {
|
||||
"company": {
|
||||
"description": "Company is the LDAP attribute for user company.",
|
||||
"type": "string"
|
||||
},
|
||||
"email": {
|
||||
"description": "Email is the LDAP attribute for user email.",
|
||||
"type": "string"
|
||||
},
|
||||
"firstname": {
|
||||
"description": "Firstname is the LDAP attribute for user first name.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastname": {
|
||||
"description": "Lastname is the LDAP attribute for user last name.",
|
||||
"type": "string"
|
||||
},
|
||||
"userId": {
|
||||
"description": "UserID is the LDAP attribute for user ID mapping.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"baseDn": {
|
||||
"description": "BaseDN is the base domain name that should be used for bind and search queries.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindDn": {
|
||||
"description": "BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.\nIf empty, an anonymous bind will be done.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindPasswordSecretName": {
|
||||
"description": "BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.\nThe secret must contain a key named 'password'.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"certificateAuthority": {
|
||||
"description": "CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the\nconnection uses TLS but that the certificate was signed by a custom Certificate Authority.",
|
||||
"type": "string"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups configures group extraction.",
|
||||
"properties": {
|
||||
"memberOfAttribute": {
|
||||
"default": "memberOf",
|
||||
"description": "MemberOfAttribute is the LDAP attribute containing group memberships (e.g., \"memberOf\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify controls whether the server's certificate chain and host name is verified.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"searchFilter": {
|
||||
"description": "SearchFilter is used to filter LDAP search queries.\nExample: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))\n%s can be used as a placeholder for the username.",
|
||||
"type": "string"
|
||||
},
|
||||
"startTls": {
|
||||
"description": "StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"syncedAttributes": {
|
||||
"description": "SyncedAttributes are the user attributes to synchronize with Hub platform.",
|
||||
"items": {
|
||||
"enum": [
|
||||
"groups",
|
||||
"userId",
|
||||
"firstname",
|
||||
"lastname",
|
||||
"email",
|
||||
"company"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 6,
|
||||
"type": "array"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid LDAP URL",
|
||||
"rule": "isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseDn",
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidc": {
|
||||
"description": "OIDC configures the OIDC authentication.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"description": "Claims configures JWT claim mappings for user attributes.",
|
||||
"properties": {
|
||||
"company": {
|
||||
"description": "Company is the JWT claim for user company.",
|
||||
"type": "string"
|
||||
},
|
||||
"email": {
|
||||
"description": "Email is the JWT claim for user email.",
|
||||
"type": "string"
|
||||
},
|
||||
"firstname": {
|
||||
"description": "Firstname is the JWT claim for user first name.",
|
||||
"type": "string"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups is the JWT claim for user groups. This field is required for authorization.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastname": {
|
||||
"description": "Lastname is the JWT claim for user last name.",
|
||||
"type": "string"
|
||||
},
|
||||
"userId": {
|
||||
"description": "UserID is the JWT claim for user ID mapping.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"groups"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"issuerUrl": {
|
||||
"description": "IssuerURL is the OIDC provider issuer URL.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is a list of OAuth2 scopes.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "SecretName is the name of the Kubernetes Secret containing clientId and clientSecret keys.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAttributes": {
|
||||
"description": "SyncedAttributes are the user attributes to synchronize with Hub platform.",
|
||||
"items": {
|
||||
"enum": [
|
||||
"groups",
|
||||
"userId",
|
||||
"firstname",
|
||||
"lastname",
|
||||
"email",
|
||||
"company"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 6,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"claims",
|
||||
"issuerUrl",
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "exactly one of oidc or ldap must be specified",
|
||||
"rule": "[has(self.oidc), has(self.ldap)].filter(x, x).size() == 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIPortalAuth.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIPortalAuth.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,164 @@
|
||||
{
|
||||
"description": "APIRateLimit defines how group of consumers are rate limited on a set of APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIRateLimit.",
|
||||
"properties": {
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be rate limited.\nMultiple APIRateLimits can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be rate limited.\nMultiple APIRateLimits can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"everyone": {
|
||||
"description": "Everyone indicates that all users will, by default, be rate limited with this configuration.\nIf an APIRateLimit explicitly target a group, the default rate limit will be ignored.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups are the consumer groups that will be rate limited.\nMultiple APIRateLimits can target the same set of consumer groups, the most restrictive one applies.\nWhen a consumer belongs to multiple groups, the least restrictive APIRateLimit applies.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"limit": {
|
||||
"description": "Limit is the maximum number of token in the bucket.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"period": {
|
||||
"description": "Period is the unit of time for the Limit.",
|
||||
"format": "duration",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be between 1s and 1h",
|
||||
"rule": "self >= duration('1s') && self <= duration('1h')"
|
||||
}
|
||||
]
|
||||
},
|
||||
"strategy": {
|
||||
"description": "Strategy defines how the bucket state will be synchronized between the different Traefik Hub instances.\nIt can be, either \"local\" or \"distributed\".",
|
||||
"enum": [
|
||||
"local",
|
||||
"distributed"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"limit"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "groups and everyone are mutually exclusive",
|
||||
"rule": "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIRateLimit.",
|
||||
"properties": {
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIRateLimit.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,332 @@
|
||||
{
|
||||
"description": "APIVersion defines a version of an API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIVersion.",
|
||||
"properties": {
|
||||
"cors": {
|
||||
"description": "Cors defines the Cross-Origin Resource Sharing configuration.",
|
||||
"properties": {
|
||||
"addVaryHeader": {
|
||||
"description": "AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowCredentials": {
|
||||
"description": "AllowCredentials defines whether the request can include user credentials.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowHeadersList": {
|
||||
"description": "AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowMethodsList": {
|
||||
"description": "AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginListRegex": {
|
||||
"description": "AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginsList": {
|
||||
"description": "AllowOriginsList is a list of allowable origins. Can also be a wildcard origin \"*\".",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"exposeHeadersList": {
|
||||
"description": "ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"maxAge": {
|
||||
"description": "MaxAge defines the time that a preflight request may be cached.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description explains what the APIVersion does.",
|
||||
"type": "string"
|
||||
},
|
||||
"openApiSpec": {
|
||||
"description": "OpenAPISpec defines the API contract as an OpenAPI specification.",
|
||||
"properties": {
|
||||
"operationSets": {
|
||||
"description": "OperationSets defines the sets of operations to be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"items": {
|
||||
"description": "OperationSet gives a name to a set of matching OpenAPI operations.\nThis set of operations can then be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"properties": {
|
||||
"matchers": {
|
||||
"description": "Matchers defines a list of alternative rules for matching OpenAPI operations.",
|
||||
"items": {
|
||||
"description": "OperationMatcher defines criteria for matching an OpenAPI operation.",
|
||||
"minProperties": 1,
|
||||
"properties": {
|
||||
"methods": {
|
||||
"description": "Methods specifies the HTTP methods to be included for selection.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 10,
|
||||
"type": "array"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the exact path of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathPrefix": {
|
||||
"description": "PathPrefix specifies the path prefix of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathRegex": {
|
||||
"description": "PathRegex specifies a regular expression pattern for matching operations based on their paths.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path, pathPrefix and pathRegex are mutually exclusive",
|
||||
"rule": "[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the OperationSet to reference in APICatalogItems or ManagedSubscriptions.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"matchers",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
},
|
||||
"override": {
|
||||
"description": "Override holds data used to override OpenAPI specification.",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"url": {
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"servers"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.\nThe Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.\nIt's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.\nThe Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.\nThe URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validateRequestMethodAndPath": {
|
||||
"description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path or url must be defined",
|
||||
"rule": "has(self.path) || has(self.url)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"release": {
|
||||
"description": "Release is the version number of the API.\nThis value must follow the SemVer format: https://semver.org/",
|
||||
"maxLength": 100,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid semver version",
|
||||
"rule": "self.matches(r\"\"\"^v?(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the public facing name of the APIVersion.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"release"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIVersion.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIVersion.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,405 @@
|
||||
{
|
||||
"description": "AppProject provides a logical grouping of applications, providing controls for:\n* where the apps may deploy to (cluster whitelist)\n* what may be deployed (repository whitelist, resource whitelist/blacklist)\n* who can access these applications (roles, OIDC group claims bindings)\n* and what they can do (RBAC policies)\n* automation access to these roles (JWT tokens)",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "AppProjectSpec is the specification of an AppProject",
|
||||
"properties": {
|
||||
"clusterResourceBlacklist": {
|
||||
"description": "ClusterResourceBlacklist contains list of blacklisted cluster level resources",
|
||||
"items": {
|
||||
"description": "ClusterResourceRestrictionItem is a cluster resource that is restricted by the project's whitelist or blacklist",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the restricted resource. Glob patterns using Go's filepath.Match syntax are supported.\nUnlike the group and kind fields, if no name is specified, all resources of the specified group/kind are matched.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"clusterResourceWhitelist": {
|
||||
"description": "ClusterResourceWhitelist contains list of whitelisted cluster level resources",
|
||||
"items": {
|
||||
"description": "ClusterResourceRestrictionItem is a cluster resource that is restricted by the project's whitelist or blacklist",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the restricted resource. Glob patterns using Go's filepath.Match syntax are supported.\nUnlike the group and kind fields, if no name is specified, all resources of the specified group/kind are matched.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"description": {
|
||||
"description": "Description contains optional project description",
|
||||
"maxLength": 255,
|
||||
"type": "string"
|
||||
},
|
||||
"destinationServiceAccounts": {
|
||||
"description": "DestinationServiceAccounts holds information about the service accounts to be impersonated for the application sync operation for each destination.",
|
||||
"items": {
|
||||
"description": "ApplicationDestinationServiceAccount holds information about the service account to be impersonated for the application sync operation.",
|
||||
"properties": {
|
||||
"defaultServiceAccount": {
|
||||
"description": "DefaultServiceAccount to be used for impersonation during the sync operation",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace specifies the target namespace for the application's resources.",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "Server specifies the URL of the target cluster's Kubernetes control plane API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"defaultServiceAccount",
|
||||
"server"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"destinations": {
|
||||
"description": "Destinations contains list of destinations available for deployment",
|
||||
"items": {
|
||||
"description": "ApplicationDestination holds information about the application's destination",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is an alternate way of specifying the target cluster by its symbolic name. This must be set if Server is not set.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace specifies the target namespace for the application's resources.\nThe namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "Server specifies the URL of the target cluster's Kubernetes control plane API. This must be set if Name is not set.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"namespaceResourceBlacklist": {
|
||||
"description": "NamespaceResourceBlacklist contains list of blacklisted namespace level resources",
|
||||
"items": {
|
||||
"description": "GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying\nconcepts during lookup stages without having partially valid types",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"namespaceResourceWhitelist": {
|
||||
"description": "NamespaceResourceWhitelist contains list of whitelisted namespace level resources",
|
||||
"items": {
|
||||
"description": "GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying\nconcepts during lookup stages without having partially valid types",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"orphanedResources": {
|
||||
"description": "OrphanedResources specifies if controller should monitor orphaned resources of apps in this project",
|
||||
"properties": {
|
||||
"ignore": {
|
||||
"description": "Ignore contains a list of resources that are to be excluded from orphaned resources monitoring",
|
||||
"items": {
|
||||
"description": "OrphanedResourceKey is a reference to a resource to be ignored from",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"warn": {
|
||||
"description": "Warn indicates if warning condition should be created for apps which have orphaned resources",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"permitOnlyProjectScopedClusters": {
|
||||
"description": "PermitOnlyProjectScopedClusters determines whether destinations can only reference clusters which are project-scoped",
|
||||
"type": "boolean"
|
||||
},
|
||||
"roles": {
|
||||
"description": "Roles are user defined RBAC roles associated with this project",
|
||||
"items": {
|
||||
"description": "ProjectRole represents a role that has access to a project",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description is a description of the role",
|
||||
"type": "string"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups are a list of OIDC group claims bound to this role",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"jwtTokens": {
|
||||
"description": "JWTTokens are a list of generated JWT tokens bound to this role",
|
||||
"items": {
|
||||
"description": "JWTToken holds the issuedAt and expiresAt values of a token",
|
||||
"properties": {
|
||||
"exp": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"iat": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"id": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"iat"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is a name for this role",
|
||||
"type": "string"
|
||||
},
|
||||
"policies": {
|
||||
"description": "Policies Stores a list of casbin formatted strings that define access policies for the role in the project",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"signatureKeys": {
|
||||
"description": "SignatureKeys contains a list of PGP key IDs that commits in Git must be signed with in order to be allowed for sync",
|
||||
"items": {
|
||||
"description": "SignatureKey is the specification of a key required to verify commit signatures with",
|
||||
"properties": {
|
||||
"keyID": {
|
||||
"description": "The ID of the key in hexadecimal notation",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"keyID"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"sourceNamespaces": {
|
||||
"description": "SourceNamespaces defines the namespaces application resources are allowed to be created in",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"sourceRepos": {
|
||||
"description": "SourceRepos contains list of repository URLs which can be used for deployment",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncWindows": {
|
||||
"description": "SyncWindows controls when syncs can be run for apps in this project",
|
||||
"items": {
|
||||
"description": "SyncWindow contains the kind, time, duration and attributes that are used to assign the syncWindows to apps",
|
||||
"properties": {
|
||||
"andOperator": {
|
||||
"description": "UseAndOperator use AND operator for matching applications, namespaces and clusters instead of the default OR operator",
|
||||
"type": "boolean"
|
||||
},
|
||||
"applications": {
|
||||
"description": "Applications contains a list of applications that the window will apply to",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"clusters": {
|
||||
"description": "Clusters contains a list of clusters that the window will apply to",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"description": {
|
||||
"description": "Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example",
|
||||
"type": "string"
|
||||
},
|
||||
"duration": {
|
||||
"description": "Duration is the amount of time the sync window will be open",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind defines if the window allows or blocks syncs",
|
||||
"type": "string"
|
||||
},
|
||||
"manualSync": {
|
||||
"description": "ManualSync enables manual syncs when they would otherwise be blocked",
|
||||
"type": "boolean"
|
||||
},
|
||||
"namespaces": {
|
||||
"description": "Namespaces contains a list of namespaces that the window will apply to",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"schedule": {
|
||||
"description": "Schedule is the time the window will begin, specified in cron format",
|
||||
"type": "string"
|
||||
},
|
||||
"timeZone": {
|
||||
"description": "TimeZone of the sync that will be applied to the schedule",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "AppProjectStatus contains status information for AppProject CRs",
|
||||
"properties": {
|
||||
"jwtTokensByRole": {
|
||||
"additionalProperties": {
|
||||
"description": "JWTTokens represents a list of JWT tokens",
|
||||
"properties": {
|
||||
"items": {
|
||||
"items": {
|
||||
"description": "JWTToken holds the issuedAt and expiresAt values of a token",
|
||||
"properties": {
|
||||
"exp": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"iat": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"id": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"iat"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "JWTTokensByRole contains a list of JWT tokens issued for a given role",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,373 @@
|
||||
{
|
||||
"description": "BackendTLSPolicy provides a way to configure how a Gateway\nconnects to a Backend via TLS.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"options": {
|
||||
"additionalProperties": {
|
||||
"description": "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.",
|
||||
"maxLength": 4096,
|
||||
"minLength": 0,
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Options are a list of key/value pairs to enable extended TLS\nconfiguration for each implementation. For example, configuring the\nminimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid\nany ambiguity, implementation-specific definitions MUST use\ndomain-prefixed names, such as `example.com/my-custom-option`.\nUn-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific",
|
||||
"maxProperties": 16,
|
||||
"type": "object"
|
||||
},
|
||||
"targetRefs": {
|
||||
"description": "TargetRefs identifies an API object to apply the policy to.\nOnly Services have Extended support. Implementations MAY support\nadditional objects, with Implementation Specific support.\nNote that this config applies to the entire referenced resource\nby default, but this default may change in the future to provide\na more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, and `name` must\n be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nWhen more than one BackendTLSPolicy selects the same target and\nsectionName, implementations MUST determine precedence using the\nfollowing criteria, continuing on ties:\n\n* The older policy by creation timestamp takes precedence. For\n example, a policy with a creation timestamp of \"2021-07-15\n 01:02:03\" MUST be given precedence over a policy with a\n creation timestamp of \"2021-07-15 01:02:04\".\n* The policy appearing first in alphabetical order by {name}.\n For example, a policy named `bar` is given precedence over a\n policy named `baz`.\n\nFor any BackendTLSPolicy that does not take precedence, the\nimplementation MUST ensure the `Accepted` Condition is set to\n`status: False`, with Reason `Conflicted`.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
|
||||
"items": {
|
||||
"description": "LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a\ndirect policy to. This should be used as part of Policy resources that can\ntarget single resources. For more information on how this policy attachment\nmode works, and a sample Policy resource, refer to the policy attachment\ndocumentation for Gateway API.\n\nNote: This should only be used for direct policy attachment when references\nto SectionName are actually needed. In all other cases,\nLocalPolicyTargetReference should be used.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the target resource.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the target resource.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the target resource.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. When\nunspecified, this targetRef targets the entire resource. In the following\nresources, SectionName is interpreted as the following:\n\n* Gateway: Listener name\n* HTTPRoute: HTTPRouteRule name\n* Service: Port name\n\nIf a SectionName is specified, but does not exist on the targeted object,\nthe Policy must fail to attach, and the policy implementation should record\na `ResolvedRefs` or similar Condition in the Policy's status.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "sectionName must be specified when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
|
||||
},
|
||||
{
|
||||
"message": "sectionName must be unique when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validation": {
|
||||
"description": "Validation contains backend TLS validation configuration.",
|
||||
"properties": {
|
||||
"caCertificateRefs": {
|
||||
"description": "CACertificateRefs contains one or more references to Kubernetes objects that\ncontain a PEM-encoded TLS CA certificate bundle, which is used to\nvalidate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\nspecified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\nnot both. If CACertificateRefs is empty or unspecified, the configuration for\nWellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nA CACertificateRef is invalid if:\n\n* It refers to a resource that cannot be resolved (e.g., the referenced resource\n does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n and the Message of the Condition must indicate which reference is invalid and why.\n\n* It refers to an unknown or unsupported kind of resource. In this case, the Reason\n must be set to `InvalidKind` and the Message of the Condition must explain which\n kind of resource is unknown or unsupported.\n\n* It refers to a resource in another namespace. This may change in future\n spec updates.\n\nImplementations MAY choose to perform further validation of the certificate\ncontent (e.g., checking expiry or enforcing specific formats). In such cases,\nan implementation-specific Reason and Message must be set for the invalid reference.\n\nIn all cases, the implementation MUST ensure the `ResolvedRefs` Condition on\nthe BackendTLSPolicy is set to `status: False`, with a Reason and Message\nthat indicate the cause of the error. Connections using an invalid\nCACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error\nresponse. If ALL CACertificateRefs are invalid, the implementation MUST also\nensure the `Accepted` Condition on the BackendTLSPolicy is set to\n`status: False`, with a Reason `NoValidCACertificate`.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support.\nImplementations MAY choose to support attaching multiple certificates to\na backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap,\nwith the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific - More than one reference, other kinds\nof resources, or a single reference that includes multiple certificates.",
|
||||
"items": {
|
||||
"description": "LocalObjectReference identifies an API object within the namespace of the\nreferrer.\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must\nbe rejected by the implementation, with appropriate Conditions set\non the containing object.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"hostname": {
|
||||
"description": "Hostname is used for two purposes in the connection between Gateways and\nbackends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).\n2. Hostname MUST be used for authentication and MUST match the certificate\n served by the matching backend, unless SubjectAltNames is specified.\n3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n but MUST NOT be used for authentication. If you want to use the value\n of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "SubjectAltNames contains one or more Subject Alternative Names.\nWhen specified the certificate served from the backend MUST\nhave at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
|
||||
"items": {
|
||||
"description": "SubjectAltName represents Subject Alternative Name.",
|
||||
"properties": {
|
||||
"hostname": {
|
||||
"description": "Hostname contains Subject Alternative Name specified in DNS name format.\nRequired when Type is set to Hostname, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type determines the format of the Subject Alternative Name. Always required.\n\nSupport: Core",
|
||||
"enum": [
|
||||
"Hostname",
|
||||
"URI"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"uri": {
|
||||
"description": "URI contains Subject Alternative Name specified in a full URI format.\nIt MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part.\nCommon values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\".\nRequired when Type is set to URI, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\\?([^#]*))?(#(.*))?",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "SubjectAltName element must contain Hostname, if Type is set to Hostname",
|
||||
"rule": "!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain Hostname, if Type is not set to Hostname",
|
||||
"rule": "!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must contain URI, if Type is set to URI",
|
||||
"rule": "!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain URI, if Type is not set to URI",
|
||||
"rule": "!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 5,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"wellKnownCACertificates": {
|
||||
"description": "WellKnownCACertificates specifies whether system CA certificates may be used in\nthe TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\nmust be specified with at least one entry for a valid configuration. Only one of\nCACertificateRefs or WellKnownCACertificates may be specified, not both.\nIf an implementation does not support the WellKnownCACertificates field, or\nthe supplied value is not recognized, the implementation MUST ensure the\n`Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with\na Reason `Invalid`.\n\nSupport: Implementation-specific",
|
||||
"enum": [
|
||||
"System"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"hostname"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must not contain both CACertificateRefs and WellKnownCACertificates",
|
||||
"rule": "!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "must specify either CACertificateRefs or WellKnownCACertificates",
|
||||
"rule": "(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"targetRefs",
|
||||
"validation"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status defines the current state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"ancestors": {
|
||||
"description": "Ancestors is a list of ancestor resources (usually Gateways) that are\nassociated with the policy, and the status of the policy with respect to\neach ancestor. When this policy attaches to a parent, the controller that\nmanages the parent and the ancestors MUST add an entry to this list when\nthe controller first sees the policy and SHOULD update the entry as\nappropriate when the relevant ancestor is modified.\n\nNote that choosing the relevant ancestor is left to the Policy designers;\nan important part of Policy design is designing the right object level at\nwhich to namespace this status.\n\nNote also that implementations MUST ONLY populate ancestor status for\nthe Ancestor resources they are responsible for. Implementations MUST\nuse the ControllerName field to uniquely identify the entries in this list\nthat they are responsible for.\n\nNote that to achieve this, the list of PolicyAncestorStatus structs\nMUST be treated as a map with a composite key, made up of the AncestorRef\nand ControllerName fields combined.\n\nA maximum of 16 ancestors will be represented in this list. An empty list\nmeans the Policy is not relevant for any ancestors.\n\nIf this slice is full, implementations MUST NOT add further entries.\nInstead they MUST consider the policy unimplementable and signal that\non any related resources such as the ancestor that would be referenced\nhere. For example, if this list was full on BackendTLSPolicy, no\nadditional Gateways would be able to reference the Service targeted by\nthe BackendTLSPolicy.",
|
||||
"items": {
|
||||
"description": "PolicyAncestorStatus describes the status of a route with respect to an\nassociated Ancestor.\n\nAncestors refer to objects that are either the Target of a policy or above it\nin terms of object hierarchy. For example, if a policy targets a Service, the\nPolicy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and\nthe GatewayClass. Almost always, in this hierarchy, the Gateway will be the most\nuseful object to place Policy status on, so we recommend that implementations\nSHOULD use Gateway as the PolicyAncestorStatus object unless the designers\nhave a _very_ good reason otherwise.\n\nIn the context of policy attachment, the Ancestor is used to distinguish which\nresource results in a distinct application of this policy. For example, if a policy\ntargets a Service, it may have a distinct result per attached Gateway.\n\nPolicies targeting the same resource may have different effects depending on the\nancestors of those resources. For example, different Gateways targeting the same\nService may have different capabilities, especially if they have different underlying\nimplementations.\n\nFor example, in BackendTLSPolicy, the Policy attaches to a Service that is\nused as a backend in a HTTPRoute that is itself attached to a Gateway.\nIn this case, the relevant object for status is the Gateway, and that is the\nancestor object referred to in this status.\n\nNote that a parent is also an ancestor, so for objects where the parent is the\nrelevant object for status, this struct SHOULD still be used.\n\nThis struct is intended to be used in a slice that's effectively a map,\nwith a composite key made up of the AncestorRef and the ControllerName.",
|
||||
"properties": {
|
||||
"ancestorRef": {
|
||||
"description": "AncestorRef corresponds with a ParentRef in the spec that this\nPolicyAncestorStatus struct describes the status of.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"default": "gateway.networking.k8s.io",
|
||||
"description": "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"default": "Gateway",
|
||||
"description": "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\nSupport: Core",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions describes the status of the Policy with respect to the given Ancestor.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"controllerName": {
|
||||
"description": "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestorRef",
|
||||
"conditions",
|
||||
"controllerName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestors"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,373 @@
|
||||
{
|
||||
"description": "BackendTLSPolicy provides a way to configure how a Gateway\nconnects to a Backend via TLS.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"options": {
|
||||
"additionalProperties": {
|
||||
"description": "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.",
|
||||
"maxLength": 4096,
|
||||
"minLength": 0,
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Options are a list of key/value pairs to enable extended TLS\nconfiguration for each implementation. For example, configuring the\nminimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid\nany ambiguity, implementation-specific definitions MUST use\ndomain-prefixed names, such as `example.com/my-custom-option`.\nUn-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific",
|
||||
"maxProperties": 16,
|
||||
"type": "object"
|
||||
},
|
||||
"targetRefs": {
|
||||
"description": "TargetRefs identifies an API object to apply the policy to.\nOnly Services have Extended support. Implementations MAY support\nadditional objects, with Implementation Specific support.\nNote that this config applies to the entire referenced resource\nby default, but this default may change in the future to provide\na more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, and `name` must\n be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nWhen more than one BackendTLSPolicy selects the same target and\nsectionName, implementations MUST determine precedence using the\nfollowing criteria, continuing on ties:\n\n* The older policy by creation timestamp takes precedence. For\n example, a policy with a creation timestamp of \"2021-07-15\n 01:02:03\" MUST be given precedence over a policy with a\n creation timestamp of \"2021-07-15 01:02:04\".\n* The policy appearing first in alphabetical order by {name}.\n For example, a policy named `bar` is given precedence over a\n policy named `baz`.\n\nFor any BackendTLSPolicy that does not take precedence, the\nimplementation MUST ensure the `Accepted` Condition is set to\n`status: False`, with Reason `Conflicted`.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
|
||||
"items": {
|
||||
"description": "LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a\ndirect policy to. This should be used as part of Policy resources that can\ntarget single resources. For more information on how this policy attachment\nmode works, and a sample Policy resource, refer to the policy attachment\ndocumentation for Gateway API.\n\nNote: This should only be used for direct policy attachment when references\nto SectionName are actually needed. In all other cases,\nLocalPolicyTargetReference should be used.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the target resource.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the target resource.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the target resource.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. When\nunspecified, this targetRef targets the entire resource. In the following\nresources, SectionName is interpreted as the following:\n\n* Gateway: Listener name\n* HTTPRoute: HTTPRouteRule name\n* Service: Port name\n\nIf a SectionName is specified, but does not exist on the targeted object,\nthe Policy must fail to attach, and the policy implementation should record\na `ResolvedRefs` or similar Condition in the Policy's status.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "sectionName must be specified when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
|
||||
},
|
||||
{
|
||||
"message": "sectionName must be unique when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validation": {
|
||||
"description": "Validation contains backend TLS validation configuration.",
|
||||
"properties": {
|
||||
"caCertificateRefs": {
|
||||
"description": "CACertificateRefs contains one or more references to Kubernetes objects that\ncontain a PEM-encoded TLS CA certificate bundle, which is used to\nvalidate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\nspecified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\nnot both. If CACertificateRefs is empty or unspecified, the configuration for\nWellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nA CACertificateRef is invalid if:\n\n* It refers to a resource that cannot be resolved (e.g., the referenced resource\n does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n and the Message of the Condition must indicate which reference is invalid and why.\n\n* It refers to an unknown or unsupported kind of resource. In this case, the Reason\n must be set to `InvalidKind` and the Message of the Condition must explain which\n kind of resource is unknown or unsupported.\n\n* It refers to a resource in another namespace. This may change in future\n spec updates.\n\nImplementations MAY choose to perform further validation of the certificate\ncontent (e.g., checking expiry or enforcing specific formats). In such cases,\nan implementation-specific Reason and Message must be set for the invalid reference.\n\nIn all cases, the implementation MUST ensure the `ResolvedRefs` Condition on\nthe BackendTLSPolicy is set to `status: False`, with a Reason and Message\nthat indicate the cause of the error. Connections using an invalid\nCACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error\nresponse. If ALL CACertificateRefs are invalid, the implementation MUST also\nensure the `Accepted` Condition on the BackendTLSPolicy is set to\n`status: False`, with a Reason `NoValidCACertificate`.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support.\nImplementations MAY choose to support attaching multiple certificates to\na backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap,\nwith the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific - More than one reference, other kinds\nof resources, or a single reference that includes multiple certificates.",
|
||||
"items": {
|
||||
"description": "LocalObjectReference identifies an API object within the namespace of the\nreferrer.\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must\nbe rejected by the implementation, with appropriate Conditions set\non the containing object.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"hostname": {
|
||||
"description": "Hostname is used for two purposes in the connection between Gateways and\nbackends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).\n2. Hostname MUST be used for authentication and MUST match the certificate\n served by the matching backend, unless SubjectAltNames is specified.\n3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n but MUST NOT be used for authentication. If you want to use the value\n of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "SubjectAltNames contains one or more Subject Alternative Names.\nWhen specified the certificate served from the backend MUST\nhave at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
|
||||
"items": {
|
||||
"description": "SubjectAltName represents Subject Alternative Name.",
|
||||
"properties": {
|
||||
"hostname": {
|
||||
"description": "Hostname contains Subject Alternative Name specified in DNS name format.\nRequired when Type is set to Hostname, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type determines the format of the Subject Alternative Name. Always required.\n\nSupport: Core",
|
||||
"enum": [
|
||||
"Hostname",
|
||||
"URI"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"uri": {
|
||||
"description": "URI contains Subject Alternative Name specified in a full URI format.\nIt MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part.\nCommon values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\".\nRequired when Type is set to URI, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\\?([^#]*))?(#(.*))?",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "SubjectAltName element must contain Hostname, if Type is set to Hostname",
|
||||
"rule": "!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain Hostname, if Type is not set to Hostname",
|
||||
"rule": "!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must contain URI, if Type is set to URI",
|
||||
"rule": "!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain URI, if Type is not set to URI",
|
||||
"rule": "!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 5,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"wellKnownCACertificates": {
|
||||
"description": "WellKnownCACertificates specifies whether system CA certificates may be used in\nthe TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\nmust be specified with at least one entry for a valid configuration. Only one of\nCACertificateRefs or WellKnownCACertificates may be specified, not both.\nIf an implementation does not support the WellKnownCACertificates field, or\nthe supplied value is not recognized, the implementation MUST ensure the\n`Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with\na Reason `Invalid`.\n\nSupport: Implementation-specific",
|
||||
"enum": [
|
||||
"System"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"hostname"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must not contain both CACertificateRefs and WellKnownCACertificates",
|
||||
"rule": "!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "must specify either CACertificateRefs or WellKnownCACertificates",
|
||||
"rule": "(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"targetRefs",
|
||||
"validation"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status defines the current state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"ancestors": {
|
||||
"description": "Ancestors is a list of ancestor resources (usually Gateways) that are\nassociated with the policy, and the status of the policy with respect to\neach ancestor. When this policy attaches to a parent, the controller that\nmanages the parent and the ancestors MUST add an entry to this list when\nthe controller first sees the policy and SHOULD update the entry as\nappropriate when the relevant ancestor is modified.\n\nNote that choosing the relevant ancestor is left to the Policy designers;\nan important part of Policy design is designing the right object level at\nwhich to namespace this status.\n\nNote also that implementations MUST ONLY populate ancestor status for\nthe Ancestor resources they are responsible for. Implementations MUST\nuse the ControllerName field to uniquely identify the entries in this list\nthat they are responsible for.\n\nNote that to achieve this, the list of PolicyAncestorStatus structs\nMUST be treated as a map with a composite key, made up of the AncestorRef\nand ControllerName fields combined.\n\nA maximum of 16 ancestors will be represented in this list. An empty list\nmeans the Policy is not relevant for any ancestors.\n\nIf this slice is full, implementations MUST NOT add further entries.\nInstead they MUST consider the policy unimplementable and signal that\non any related resources such as the ancestor that would be referenced\nhere. For example, if this list was full on BackendTLSPolicy, no\nadditional Gateways would be able to reference the Service targeted by\nthe BackendTLSPolicy.",
|
||||
"items": {
|
||||
"description": "PolicyAncestorStatus describes the status of a route with respect to an\nassociated Ancestor.\n\nAncestors refer to objects that are either the Target of a policy or above it\nin terms of object hierarchy. For example, if a policy targets a Service, the\nPolicy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and\nthe GatewayClass. Almost always, in this hierarchy, the Gateway will be the most\nuseful object to place Policy status on, so we recommend that implementations\nSHOULD use Gateway as the PolicyAncestorStatus object unless the designers\nhave a _very_ good reason otherwise.\n\nIn the context of policy attachment, the Ancestor is used to distinguish which\nresource results in a distinct application of this policy. For example, if a policy\ntargets a Service, it may have a distinct result per attached Gateway.\n\nPolicies targeting the same resource may have different effects depending on the\nancestors of those resources. For example, different Gateways targeting the same\nService may have different capabilities, especially if they have different underlying\nimplementations.\n\nFor example, in BackendTLSPolicy, the Policy attaches to a Service that is\nused as a backend in a HTTPRoute that is itself attached to a Gateway.\nIn this case, the relevant object for status is the Gateway, and that is the\nancestor object referred to in this status.\n\nNote that a parent is also an ancestor, so for objects where the parent is the\nrelevant object for status, this struct SHOULD still be used.\n\nThis struct is intended to be used in a slice that's effectively a map,\nwith a composite key made up of the AncestorRef and the ControllerName.",
|
||||
"properties": {
|
||||
"ancestorRef": {
|
||||
"description": "AncestorRef corresponds with a ParentRef in the spec that this\nPolicyAncestorStatus struct describes the status of.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"default": "gateway.networking.k8s.io",
|
||||
"description": "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"default": "Gateway",
|
||||
"description": "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\nSupport: Core",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions describes the status of the Policy with respect to the given Ancestor.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"controllerName": {
|
||||
"description": "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestorRef",
|
||||
"conditions",
|
||||
"controllerName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestors"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,171 @@
|
||||
{
|
||||
"description": "BackingImage is where Longhorn stores backing image object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackingImageSpec defines the desired state of the Longhorn backing image",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"dataEngine": {
|
||||
"default": "v1",
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"diskFileSpecMap": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"evictionRequested": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"diskSelector": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"disks": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Deprecated. We are now using DiskFileSpecMap to assign different spec to the file on different disks.",
|
||||
"type": "object"
|
||||
},
|
||||
"minNumberOfCopies": {
|
||||
"type": "integer"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secret": {
|
||||
"type": "string"
|
||||
},
|
||||
"secretNamespace": {
|
||||
"type": "string"
|
||||
},
|
||||
"sourceParameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"sourceType": {
|
||||
"enum": [
|
||||
"download",
|
||||
"upload",
|
||||
"export-from-volume",
|
||||
"restore",
|
||||
"clone"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackingImageStatus defines the observed state of the Longhorn backing image status",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskFileStatusMap": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"lastStateTransitionTime": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"diskLastRefAtMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"realSize": {
|
||||
"description": "Real size of image in bytes, which may be smaller than the size when the file is a sparse file. Will be zero until known (e.g. while a backing image is uploading)",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
},
|
||||
"v2FirstCopyDisk": {
|
||||
"type": "string"
|
||||
},
|
||||
"v2FirstCopyStatus": {
|
||||
"description": "It is pending -> in-progress -> ready/failed",
|
||||
"type": "string"
|
||||
},
|
||||
"virtualSize": {
|
||||
"description": "Virtual size of image in bytes, which may be larger than physical size. Will be zero until known (e.g. while a backing image is uploading)",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
{
|
||||
"description": "BackingImageDataSource is where Longhorn stores backing image data source object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackingImageDataSourceSpec defines the desired state of the Longhorn backing image data source",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskPath": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskUUID": {
|
||||
"type": "string"
|
||||
},
|
||||
"fileTransferred": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodeID": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"sourceType": {
|
||||
"enum": [
|
||||
"download",
|
||||
"upload",
|
||||
"export-from-volume",
|
||||
"restore",
|
||||
"clone"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackingImageDataSourceStatus defines the observed state of the Longhorn backing image data source",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"currentState": {
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"runningParameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"storageIP": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"description": "BackingImageManager is where Longhorn stores backing image manager object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackingImageManagerSpec defines the desired state of the Longhorn backing image manager",
|
||||
"properties": {
|
||||
"backingImages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"diskPath": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskUUID": {
|
||||
"type": "string"
|
||||
},
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeID": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackingImageManagerStatus defines the observed state of the Longhorn backing image manager",
|
||||
"properties": {
|
||||
"apiMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"apiVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"backingImageFileMap": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"currentChecksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"realSize": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"senderManagerAddress": {
|
||||
"type": "string"
|
||||
},
|
||||
"sendingReference": {
|
||||
"type": "integer"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
},
|
||||
"virtualSize": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"currentState": {
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"storageIP": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,492 @@
|
||||
{
|
||||
"description": "A Backup resource is a request for a PostgreSQL backup by the user.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired behavior of the backup.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"cluster": {
|
||||
"description": "The cluster to backup",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"method": {
|
||||
"default": "barmanObjectStore",
|
||||
"description": "The backup method to be used, possible options are `barmanObjectStore`,\n`volumeSnapshot` or `plugin`. Defaults to: `barmanObjectStore`.",
|
||||
"enum": [
|
||||
"barmanObjectStore",
|
||||
"volumeSnapshot",
|
||||
"plugin"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"online": {
|
||||
"description": "Whether the default type of backup with volume snapshots is\nonline/hot (`true`, default) or offline/cold (`false`)\nOverrides the default setting specified in the cluster field '.spec.backup.volumeSnapshot.online'",
|
||||
"type": "boolean"
|
||||
},
|
||||
"onlineConfiguration": {
|
||||
"description": "Configuration parameters to control the online/hot backup with volume snapshots\nOverrides the default settings specified in the cluster '.backup.volumeSnapshot.onlineConfiguration' stanza",
|
||||
"properties": {
|
||||
"immediateCheckpoint": {
|
||||
"description": "Control whether the I/O workload for the backup initial checkpoint will\nbe limited, according to the `checkpoint_completion_target` setting on\nthe PostgreSQL server. If set to true, an immediate checkpoint will be\nused, meaning PostgreSQL will complete the checkpoint as soon as\npossible. `false` by default.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"waitForArchive": {
|
||||
"default": true,
|
||||
"description": "If false, the function will return immediately after the backup is completed,\nwithout waiting for WAL to be archived.\nThis behavior is only useful with backup software that independently monitors WAL archiving.\nOtherwise, WAL required to make the backup consistent might be missing and make the backup useless.\nBy default, or when this parameter is true, pg_backup_stop will wait for WAL to be archived when archiving is\nenabled.\nOn a standby, this means that it will wait only when archive_mode = always.\nIf write activity on the primary is low, it may be useful to run pg_switch_wal on the primary in order to trigger\nan immediate segment switch.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pluginConfiguration": {
|
||||
"description": "Configuration parameters passed to the plugin managing this backup",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the plugin managing this backup",
|
||||
"type": "string"
|
||||
},
|
||||
"parameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Parameters are the configuration parameters passed to the backup\nplugin for this backup",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"target": {
|
||||
"description": "The policy to decide which instance should perform this backup. If empty,\nit defaults to `cluster.spec.backup.target`.\nAvailable options are empty string, `primary` and `prefer-standby`.\n`primary` to have backups run always on primary instances,\n`prefer-standby` to have backups run preferably on the most updated\nstandby, if available.",
|
||||
"enum": [
|
||||
"primary",
|
||||
"prefer-standby"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"cluster"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "BackupSpec is immutable once set",
|
||||
"rule": "oldSelf == self"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Most recently observed status of the backup. This data may not be up to\ndate. Populated by the system. Read-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"azureCredentials": {
|
||||
"description": "The credentials to use to upload data to Azure Blob Storage",
|
||||
"properties": {
|
||||
"connectionString": {
|
||||
"description": "The connection string to be used",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"inheritFromAzureAD": {
|
||||
"description": "Use the Azure AD based authentication without providing explicitly the keys.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"storageAccount": {
|
||||
"description": "The storage account where to upload data",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"storageKey": {
|
||||
"description": "The storage account key to be used in conjunction\nwith the storage account name",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"storageSasToken": {
|
||||
"description": "A shared-access-signature to be used in conjunction with\nthe storage account name",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"useDefaultAzureCredentials": {
|
||||
"description": "Use the default Azure authentication flow, which includes DefaultAzureCredential.\nThis allows authentication using environment variables and managed identities.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"backupId": {
|
||||
"description": "The ID of the Barman backup",
|
||||
"type": "string"
|
||||
},
|
||||
"backupLabelFile": {
|
||||
"description": "Backup label file content as returned by Postgres in case of online (hot) backups",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"backupName": {
|
||||
"description": "The Name of the Barman backup",
|
||||
"type": "string"
|
||||
},
|
||||
"beginLSN": {
|
||||
"description": "The starting xlog",
|
||||
"type": "string"
|
||||
},
|
||||
"beginWal": {
|
||||
"description": "The starting WAL",
|
||||
"type": "string"
|
||||
},
|
||||
"commandError": {
|
||||
"description": "The backup command output in case of error",
|
||||
"type": "string"
|
||||
},
|
||||
"commandOutput": {
|
||||
"description": "Unused. Retained for compatibility with old versions.",
|
||||
"type": "string"
|
||||
},
|
||||
"destinationPath": {
|
||||
"description": "The path where to store the backup (i.e. s3://bucket/path/to/folder)\nthis path, with different destination folders, will be used for WALs\nand for data. This may not be populated in case of errors.",
|
||||
"type": "string"
|
||||
},
|
||||
"encryption": {
|
||||
"description": "Encryption method required to S3 API",
|
||||
"type": "string"
|
||||
},
|
||||
"endLSN": {
|
||||
"description": "The ending xlog",
|
||||
"type": "string"
|
||||
},
|
||||
"endWal": {
|
||||
"description": "The ending WAL",
|
||||
"type": "string"
|
||||
},
|
||||
"endpointCA": {
|
||||
"description": "EndpointCA store the CA bundle of the barman endpoint.\nUseful when using self-signed certificates to avoid\nerrors with certificate issuer and barman-cloud-wal-archive.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"endpointURL": {
|
||||
"description": "Endpoint to be used to upload data to the cloud,\noverriding the automatic endpoint discovery",
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"description": "The detected error",
|
||||
"type": "string"
|
||||
},
|
||||
"googleCredentials": {
|
||||
"description": "The credentials to use to upload data to Google Cloud Storage",
|
||||
"properties": {
|
||||
"applicationCredentials": {
|
||||
"description": "The secret containing the Google Cloud Storage JSON file with the credentials",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"gkeEnvironment": {
|
||||
"description": "If set to true, will presume that it's running inside a GKE environment,\ndefault to false.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"instanceID": {
|
||||
"description": "Information to identify the instance where the backup has been taken from",
|
||||
"properties": {
|
||||
"ContainerID": {
|
||||
"description": "The container ID",
|
||||
"type": "string"
|
||||
},
|
||||
"podName": {
|
||||
"description": "The pod name",
|
||||
"type": "string"
|
||||
},
|
||||
"sessionID": {
|
||||
"description": "The instance manager session ID. This is a unique identifier generated at instance manager\nstartup and changes on every restart (including container reboots). Used to detect if\nthe instance manager was restarted during long-running operations like backups, which\nwould terminate any running backup process.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"majorVersion": {
|
||||
"description": "The PostgreSQL major version that was running when the\nbackup was taken.",
|
||||
"type": "integer"
|
||||
},
|
||||
"method": {
|
||||
"description": "The backup method being used",
|
||||
"type": "string"
|
||||
},
|
||||
"online": {
|
||||
"description": "Whether the backup was online/hot (`true`) or offline/cold (`false`)",
|
||||
"type": "boolean"
|
||||
},
|
||||
"phase": {
|
||||
"description": "The last backup status",
|
||||
"type": "string"
|
||||
},
|
||||
"pluginMetadata": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "A map containing the plugin metadata",
|
||||
"type": "object"
|
||||
},
|
||||
"s3Credentials": {
|
||||
"description": "The credentials to use to upload data to S3",
|
||||
"properties": {
|
||||
"accessKeyId": {
|
||||
"description": "The reference to the access key id",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"inheritFromIAMRole": {
|
||||
"description": "Use the role based authentication without providing explicitly the keys.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"region": {
|
||||
"description": "The reference to the secret containing the region name",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secretAccessKey": {
|
||||
"description": "The reference to the secret access key",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"sessionToken": {
|
||||
"description": "The references to the session key",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"serverName": {
|
||||
"description": "The server name on S3, the cluster name is used if this\nparameter is omitted",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotBackupStatus": {
|
||||
"description": "Status of the volumeSnapshot backup",
|
||||
"properties": {
|
||||
"elements": {
|
||||
"description": "The elements list, populated with the gathered volume snapshots",
|
||||
"items": {
|
||||
"description": "BackupSnapshotElementStatus is a volume snapshot that is part of a volume snapshot method backup",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the snapshot resource name",
|
||||
"type": "string"
|
||||
},
|
||||
"tablespaceName": {
|
||||
"description": "TablespaceName is the name of the snapshotted tablespace. Only set\nwhen type is PG_TABLESPACE",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is tho role of the snapshot in the cluster, such as PG_DATA, PG_WAL and PG_TABLESPACE",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"startedAt": {
|
||||
"description": "When the backup was started",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"stoppedAt": {
|
||||
"description": "When the backup was terminated",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"tablespaceMapFile": {
|
||||
"description": "Tablespace map file content as returned by Postgres in case of online (hot) backups",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
{
|
||||
"description": "Backup is where Longhorn stores backup object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupSpec defines the desired state of the Longhorn backup",
|
||||
"properties": {
|
||||
"backupBlockSize": {
|
||||
"description": "The backup block size. 0 means the legacy default size 2MiB, and -1 indicate the block size is invalid.",
|
||||
"enum": [
|
||||
"-1",
|
||||
"2097152",
|
||||
"16777216"
|
||||
],
|
||||
"format": "int64",
|
||||
"type": "string"
|
||||
},
|
||||
"backupMode": {
|
||||
"description": "The backup mode of this backup.\nCan be \"full\" or \"incremental\"",
|
||||
"enum": [
|
||||
"full",
|
||||
"incremental"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of snapshot backup.",
|
||||
"type": "object"
|
||||
},
|
||||
"snapshotName": {
|
||||
"description": "The snapshot name.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backup.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupStatus defines the observed state of the Longhorn backup",
|
||||
"properties": {
|
||||
"backupCreatedAt": {
|
||||
"description": "The snapshot backup upload finished time.",
|
||||
"type": "string"
|
||||
},
|
||||
"backupTargetName": {
|
||||
"description": "The backup target name.",
|
||||
"type": "string"
|
||||
},
|
||||
"compressionMethod": {
|
||||
"description": "Compression method",
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"description": "The error message when taking the snapshot backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of snapshot backup.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the backup was synced with the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"messages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The error messages when calling longhorn engine on listing or inspecting backups.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"newlyUploadDataSize": {
|
||||
"description": "Size in bytes of newly uploaded data",
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this backup CR.",
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"description": "The snapshot backup progress.",
|
||||
"type": "integer"
|
||||
},
|
||||
"reUploadedDataSize": {
|
||||
"description": "Size in bytes of reuploaded data",
|
||||
"type": "string"
|
||||
},
|
||||
"replicaAddress": {
|
||||
"description": "The address of the replica that runs snapshot backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "The snapshot size.",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotCreatedAt": {
|
||||
"description": "The snapshot creation time.",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotName": {
|
||||
"description": "The snapshot name.",
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"description": "The backup creation state.\nCan be \"\", \"InProgress\", \"Completed\", \"Error\", \"Unknown\".",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "The snapshot backup URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeBackingImageName": {
|
||||
"description": "The volume's backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeCreated": {
|
||||
"description": "The volume creation time.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeName": {
|
||||
"description": "The volume name.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeSize": {
|
||||
"description": "The volume size.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
{
|
||||
"description": "BackupBackingImage is where Longhorn stores backing image backup object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupBackingImageSpec defines the desired state of the Longhorn backing image backup",
|
||||
"properties": {
|
||||
"backingImage": {
|
||||
"description": "The backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"backupTargetName": {
|
||||
"description": "The backup target name.",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of backing image backup.",
|
||||
"type": "object"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backing image backup.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"userCreated": {
|
||||
"description": "Is this CR created by user through API or UI.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"backingImage",
|
||||
"userCreated"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupBackingImageStatus defines the observed state of the Longhorn backing image backup",
|
||||
"properties": {
|
||||
"backingImage": {
|
||||
"description": "The backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"backupCreatedAt": {
|
||||
"description": "The backing image backup upload finished time.",
|
||||
"type": "string"
|
||||
},
|
||||
"checksum": {
|
||||
"description": "The checksum of the backing image.",
|
||||
"type": "string"
|
||||
},
|
||||
"compressionMethod": {
|
||||
"description": "Compression method",
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"description": "The error message when taking the backing image backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of backing image backup.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the backing image backup was synced with the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"managerAddress": {
|
||||
"description": "The address of the backing image manager that runs backing image backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"messages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The error messages when listing or inspecting backing image backup.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this CR.",
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"description": "The backing image backup progress.",
|
||||
"type": "integer"
|
||||
},
|
||||
"secret": {
|
||||
"description": "Record the secret if this backup backing image is encrypted",
|
||||
"type": "string"
|
||||
},
|
||||
"secretNamespace": {
|
||||
"description": "Record the secret namespace if this backup backing image is encrypted",
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "The backing image size.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"description": "The backing image backup creation state.\nCan be \"\", \"InProgress\", \"Completed\", \"Error\", \"Unknown\".",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "The backing image backup URL.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
{
|
||||
"description": "BackupTarget is where Longhorn stores backup target object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupTargetSpec defines the desired state of the Longhorn backup target",
|
||||
"properties": {
|
||||
"backupTargetURL": {
|
||||
"description": "The backup target URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"credentialSecret": {
|
||||
"description": "The backup target credential secret.",
|
||||
"type": "string"
|
||||
},
|
||||
"pollInterval": {
|
||||
"description": "The interval that the cluster needs to run sync with the backup target.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupTargetStatus defines the observed state of the Longhorn backup target",
|
||||
"properties": {
|
||||
"available": {
|
||||
"description": "Available indicates if the remote backup target is available or not.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Records the reason on why the backup target is unavailable.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"lastProbeTime": {
|
||||
"description": "Last time we probed the condition.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastTransitionTime": {
|
||||
"description": "Last time the condition transitioned from one status to another.",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Human-readable message indicating details about last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Unique, one-word, CamelCase reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the condition.\nCan be True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of the condition.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "array"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the controller synced with the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this backup target CR.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
{
|
||||
"description": "BackupVolume is where Longhorn stores backup volume object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupVolumeSpec defines the desired state of the Longhorn backup volume",
|
||||
"properties": {
|
||||
"backupTargetName": {
|
||||
"description": "The backup target name that the backup volume was synced.",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backup volume.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"volumeName": {
|
||||
"description": "The volume name that the backup volume was used to backup.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupVolumeStatus defines the observed state of the Longhorn backup volume",
|
||||
"properties": {
|
||||
"backingImageChecksum": {
|
||||
"description": "the backing image checksum.",
|
||||
"type": "string"
|
||||
},
|
||||
"backingImageName": {
|
||||
"description": "The backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"createdAt": {
|
||||
"description": "The backup volume creation time.",
|
||||
"type": "string"
|
||||
},
|
||||
"dataStored": {
|
||||
"description": "The backup volume block count.",
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The backup volume labels.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"lastBackupAt": {
|
||||
"description": "The latest volume backup time.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastBackupName": {
|
||||
"description": "The latest volume backup name.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastModificationTime": {
|
||||
"description": "The backup volume config last modification time.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the backup volume was synced into the cluster.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"messages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The error messages when call longhorn engine on list or inspect backup volumes.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this backup volume CR.",
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "The backup volume size.",
|
||||
"type": "string"
|
||||
},
|
||||
"storageClassName": {
|
||||
"description": "the storage class name of pv/pvc binding with the volume.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,603 @@
|
||||
{
|
||||
"description": "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"additionalOutputFormats": {
|
||||
"description": "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.",
|
||||
"items": {
|
||||
"description": "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.",
|
||||
"properties": {
|
||||
"type": {
|
||||
"description": "Type is the name of the format type that should be written to the\nCertificate's target Secret.",
|
||||
"enum": [
|
||||
"DER",
|
||||
"CombinedPEM"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"commonName": {
|
||||
"description": "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.",
|
||||
"type": "string"
|
||||
},
|
||||
"dnsNames": {
|
||||
"description": "Requested DNS subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"duration": {
|
||||
"description": "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.",
|
||||
"type": "string"
|
||||
},
|
||||
"emailAddresses": {
|
||||
"description": "Requested email subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"encodeUsagesInRequest": {
|
||||
"description": "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"ipAddresses": {
|
||||
"description": "Requested IP address subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"isCA": {
|
||||
"description": "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"issuerRef": {
|
||||
"description": "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind of the issuer being referred to.\nDefaults to 'Issuer'.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the issuer being referred to.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"keystores": {
|
||||
"description": "Additional keystore output formats to be stored in the Certificate's Secret.",
|
||||
"properties": {
|
||||
"jks": {
|
||||
"description": "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.",
|
||||
"properties": {
|
||||
"alias": {
|
||||
"description": "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.",
|
||||
"type": "string"
|
||||
},
|
||||
"create": {
|
||||
"description": "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority",
|
||||
"type": "boolean"
|
||||
},
|
||||
"password": {
|
||||
"description": "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"type": "string"
|
||||
},
|
||||
"passwordSecretRef": {
|
||||
"description": "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"create"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pkcs12": {
|
||||
"description": "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.",
|
||||
"properties": {
|
||||
"create": {
|
||||
"description": "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority",
|
||||
"type": "boolean"
|
||||
},
|
||||
"password": {
|
||||
"description": "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"type": "string"
|
||||
},
|
||||
"passwordSecretRef": {
|
||||
"description": "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"profile": {
|
||||
"description": "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(e.g., because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.",
|
||||
"enum": [
|
||||
"LegacyRC2",
|
||||
"LegacyDES",
|
||||
"Modern2023"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"create"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"literalSubject": {
|
||||
"description": "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.",
|
||||
"type": "string"
|
||||
},
|
||||
"nameConstraints": {
|
||||
"description": "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.",
|
||||
"properties": {
|
||||
"critical": {
|
||||
"description": "if true then the name constraints are marked critical.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"excluded": {
|
||||
"description": "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted",
|
||||
"properties": {
|
||||
"dnsDomains": {
|
||||
"description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"emailAddresses": {
|
||||
"description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"ipRanges": {
|
||||
"description": "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"uriDomains": {
|
||||
"description": "URIDomains is a list of URI domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"permitted": {
|
||||
"description": "Permitted contains the constraints in which the names must be located.",
|
||||
"properties": {
|
||||
"dnsDomains": {
|
||||
"description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"emailAddresses": {
|
||||
"description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"ipRanges": {
|
||||
"description": "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"uriDomains": {
|
||||
"description": "URIDomains is a list of URI domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"otherNames": {
|
||||
"description": "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"oid": {
|
||||
"description": "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".",
|
||||
"type": "string"
|
||||
},
|
||||
"utf8Value": {
|
||||
"description": "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"privateKey": {
|
||||
"description": "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.",
|
||||
"properties": {
|
||||
"algorithm": {
|
||||
"description": "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.",
|
||||
"enum": [
|
||||
"RSA",
|
||||
"ECDSA",
|
||||
"Ed25519"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"encoding": {
|
||||
"description": "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.",
|
||||
"enum": [
|
||||
"PKCS1",
|
||||
"PKCS8"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"rotationPolicy": {
|
||||
"description": "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Always`.\nThe default was changed from `Never` to `Always` in cert-manager >=v1.18.0.",
|
||||
"enum": [
|
||||
"Never",
|
||||
"Always"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"renewBefore": {
|
||||
"description": "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.",
|
||||
"type": "string"
|
||||
},
|
||||
"renewBeforePercentage": {
|
||||
"description": "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"revisionHistoryLimit": {
|
||||
"description": "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nDefault value is `1`.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"secretTemplate": {
|
||||
"description": "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations is a key value map to be copied to the target Kubernetes Secret.",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels is a key value map to be copied to the target Kubernetes Secret.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"signatureAlgorithm": {
|
||||
"description": "Signature algorithm to use.\nAllowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.\nAllowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.\nAllowed values for Ed25519 keys: PureEd25519.",
|
||||
"enum": [
|
||||
"SHA256WithRSA",
|
||||
"SHA384WithRSA",
|
||||
"SHA512WithRSA",
|
||||
"ECDSAWithSHA256",
|
||||
"ECDSAWithSHA384",
|
||||
"ECDSAWithSHA512",
|
||||
"PureEd25519"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"subject": {
|
||||
"description": "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.",
|
||||
"properties": {
|
||||
"countries": {
|
||||
"description": "Countries to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"localities": {
|
||||
"description": "Cities to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"organizationalUnits": {
|
||||
"description": "Organizational Units to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"organizations": {
|
||||
"description": "Organizations to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"postalCodes": {
|
||||
"description": "Postal codes to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"provinces": {
|
||||
"description": "State/Provinces to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"serialNumber": {
|
||||
"description": "Serial number to be used on the Certificate.",
|
||||
"type": "string"
|
||||
},
|
||||
"streetAddresses": {
|
||||
"description": "Street addresses to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"uris": {
|
||||
"description": "Requested URI subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"usages": {
|
||||
"description": "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.",
|
||||
"items": {
|
||||
"description": "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"",
|
||||
"enum": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"content commitment",
|
||||
"key encipherment",
|
||||
"key agreement",
|
||||
"data encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"encipher only",
|
||||
"decipher only",
|
||||
"any",
|
||||
"server auth",
|
||||
"client auth",
|
||||
"code signing",
|
||||
"email protection",
|
||||
"s/mime",
|
||||
"ipsec end system",
|
||||
"ipsec tunnel",
|
||||
"ipsec user",
|
||||
"timestamping",
|
||||
"ocsp signing",
|
||||
"microsoft sgc",
|
||||
"netscape sgc"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"issuerRef",
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.",
|
||||
"items": {
|
||||
"description": "CertificateCondition contains condition information for a Certificate.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is a human readable description of the details of the last\ntransition, complementing reason.",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Reason is a brief machine readable explanation for the condition's last\ntransition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the condition, one of (`True`, `False`, `Unknown`).",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of the condition, known values are (`Ready`, `Issuing`).",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"failedIssuanceAttempts": {
|
||||
"description": "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).",
|
||||
"type": "integer"
|
||||
},
|
||||
"lastFailureTime": {
|
||||
"description": "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"nextPrivateKeySecretName": {
|
||||
"description": "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.",
|
||||
"type": "string"
|
||||
},
|
||||
"notAfter": {
|
||||
"description": "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"notBefore": {
|
||||
"description": "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"renewalTime": {
|
||||
"description": "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"revision": {
|
||||
"description": "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,190 @@
|
||||
{
|
||||
"description": "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"duration": {
|
||||
"description": "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.",
|
||||
"type": "string"
|
||||
},
|
||||
"extra": {
|
||||
"additionalProperties": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"description": "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"type": "object"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"isCA": {
|
||||
"description": "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"issuerRef": {
|
||||
"description": "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind of the issuer being referred to.\nDefaults to 'Issuer'.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the issuer being referred to.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"request": {
|
||||
"description": "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"uid": {
|
||||
"description": "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"type": "string"
|
||||
},
|
||||
"usages": {
|
||||
"description": "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.",
|
||||
"items": {
|
||||
"description": "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"",
|
||||
"enum": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"content commitment",
|
||||
"key encipherment",
|
||||
"key agreement",
|
||||
"data encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"encipher only",
|
||||
"decipher only",
|
||||
"any",
|
||||
"server auth",
|
||||
"client auth",
|
||||
"code signing",
|
||||
"email protection",
|
||||
"s/mime",
|
||||
"ipsec end system",
|
||||
"ipsec tunnel",
|
||||
"ipsec user",
|
||||
"timestamping",
|
||||
"ocsp signing",
|
||||
"microsoft sgc",
|
||||
"netscape sgc"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"username": {
|
||||
"description": "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"issuerRef",
|
||||
"request"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"description": "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"certificate": {
|
||||
"description": "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.",
|
||||
"items": {
|
||||
"description": "CertificateRequestCondition contains condition information for a CertificateRequest.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is a human readable description of the details of the last\ntransition, complementing reason.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Reason is a brief machine readable explanation for the condition's last\ntransition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the condition, one of (`True`, `False`, `Unknown`).",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"failureTime": {
|
||||
"description": "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,74 @@
|
||||
{
|
||||
"properties": {
|
||||
"data": {
|
||||
"properties": {
|
||||
"changes": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"data": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"data"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"charts": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"namespace",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"deletions": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"apiVersion",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"data"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"description": "CiliumCIDRGroup is a list of external CIDRs (i.e: CIDRs selecting peers\noutside the clusters) that can be referenced as a single entity from\nCiliumNetworkPolicies.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"properties": {
|
||||
"externalCIDRs": {
|
||||
"description": "ExternalCIDRs is a list of CIDRs selecting peers outside the clusters.",
|
||||
"items": {
|
||||
"description": "CIDR specifies a block of IP addresses.\nExample: 192.0.2.1/32",
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 0,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"externalCIDRs"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"description": "CiliumCIDRGroup is a list of external CIDRs (i.e: CIDRs selecting peers\noutside the clusters) that can be referenced as a single entity from\nCiliumNetworkPolicies.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"properties": {
|
||||
"externalCIDRs": {
|
||||
"description": "ExternalCIDRs is a list of CIDRs selecting peers outside the clusters.",
|
||||
"items": {
|
||||
"description": "CIDR specifies a block of IP addresses.\nExample: 192.0.2.1/32",
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 0,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"externalCIDRs"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,550 @@
|
||||
{
|
||||
"description": "CiliumEndpoint is the status of a Cilium policy rule.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"status": {
|
||||
"description": "EndpointStatus is the status of a Cilium endpoint.",
|
||||
"properties": {
|
||||
"controllers": {
|
||||
"description": "Controllers is the list of failing controllers for this endpoint.",
|
||||
"items": {
|
||||
"description": "ControllerStatus is the status of a failing controller.",
|
||||
"properties": {
|
||||
"configuration": {
|
||||
"description": "Configuration is the controller configuration",
|
||||
"properties": {
|
||||
"error-retry": {
|
||||
"description": "Retry on error",
|
||||
"type": "boolean"
|
||||
},
|
||||
"error-retry-base": {
|
||||
"description": "Base error retry back-off time\nFormat: duration",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"interval": {
|
||||
"description": "Regular synchronization interval\nFormat: duration",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the controller",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the controller",
|
||||
"properties": {
|
||||
"consecutive-failure-count": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"failure-count": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"last-failure-msg": {
|
||||
"type": "string"
|
||||
},
|
||||
"last-failure-timestamp": {
|
||||
"type": "string"
|
||||
},
|
||||
"last-success-timestamp": {
|
||||
"type": "string"
|
||||
},
|
||||
"success-count": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"uuid": {
|
||||
"description": "UUID is the UUID of the controller",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"encryption": {
|
||||
"description": "Encryption is the encryption configuration of the node",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the index to the key to use for encryption or 0 if encryption is\ndisabled.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"external-identifiers": {
|
||||
"description": "ExternalIdentifiers is a set of identifiers to identify the endpoint\napart from the pod name. This includes container runtime IDs.",
|
||||
"properties": {
|
||||
"cni-attachment-id": {
|
||||
"description": "ID assigned to this attachment by container runtime",
|
||||
"type": "string"
|
||||
},
|
||||
"container-id": {
|
||||
"description": "ID assigned by container runtime (deprecated, may not be unique)",
|
||||
"type": "string"
|
||||
},
|
||||
"container-name": {
|
||||
"description": "Name assigned to container (deprecated, may not be unique)",
|
||||
"type": "string"
|
||||
},
|
||||
"docker-endpoint-id": {
|
||||
"description": "Docker endpoint ID",
|
||||
"type": "string"
|
||||
},
|
||||
"docker-network-id": {
|
||||
"description": "Docker network ID",
|
||||
"type": "string"
|
||||
},
|
||||
"k8s-namespace": {
|
||||
"description": "K8s namespace for this endpoint (deprecated, may not be unique)",
|
||||
"type": "string"
|
||||
},
|
||||
"k8s-pod-name": {
|
||||
"description": "K8s pod name for this endpoint (deprecated, may not be unique)",
|
||||
"type": "string"
|
||||
},
|
||||
"pod-name": {
|
||||
"description": "K8s pod for this endpoint (deprecated, may not be unique)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"health": {
|
||||
"description": "Health is the overall endpoint & subcomponent health.",
|
||||
"properties": {
|
||||
"bpf": {
|
||||
"description": "bpf",
|
||||
"type": "string"
|
||||
},
|
||||
"connected": {
|
||||
"description": "Is this endpoint reachable",
|
||||
"type": "boolean"
|
||||
},
|
||||
"overallHealth": {
|
||||
"description": "overall health",
|
||||
"type": "string"
|
||||
},
|
||||
"policy": {
|
||||
"description": "policy",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"id": {
|
||||
"description": "ID is the cilium-agent-local ID of the endpoint.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"description": "Identity is the security identity associated with the endpoint",
|
||||
"properties": {
|
||||
"id": {
|
||||
"description": "ID is the numeric identity of the endpoint",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"labels": {
|
||||
"description": "Labels is the list of labels associated with the identity",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"log": {
|
||||
"description": "Log is the list of the last few warning and error log entries",
|
||||
"items": {
|
||||
"description": "EndpointStatusChange Indication of a change of status\n\nswagger:model EndpointStatusChange",
|
||||
"properties": {
|
||||
"code": {
|
||||
"description": "Code indicate type of status change\nEnum: [\"ok\",\"failed\"]",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Status message",
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"description": "state",
|
||||
"type": "string"
|
||||
},
|
||||
"timestamp": {
|
||||
"description": "Timestamp when status change occurred",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"named-ports": {
|
||||
"description": "NamedPorts List of named Layer 4 port and protocol pairs which will be used in Network\nPolicy specs.\n\nswagger:model NamedPorts",
|
||||
"items": {
|
||||
"description": "Port Layer 4 port / protocol pair\n\nswagger:model Port",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Optional layer 4 port name",
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "Layer 4 port number",
|
||||
"type": "integer"
|
||||
},
|
||||
"protocol": {
|
||||
"description": "Layer 4 protocol\nEnum: [\"TCP\",\"UDP\",\"SCTP\",\"ICMP\",\"ICMPV6\",\"ANY\"]",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"networking": {
|
||||
"description": "Networking is the networking properties of the endpoint.",
|
||||
"properties": {
|
||||
"addressing": {
|
||||
"description": "IP4/6 addresses assigned to this Endpoint",
|
||||
"items": {
|
||||
"description": "AddressPair is a pair of IPv4 and/or IPv6 address.",
|
||||
"properties": {
|
||||
"ipv4": {
|
||||
"type": "string"
|
||||
},
|
||||
"ipv6": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"node": {
|
||||
"description": "NodeIP is the IP of the node the endpoint is running on. The IP must\nbe reachable between nodes.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"addressing"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"policy": {
|
||||
"description": "EndpointPolicy represents the endpoint's policy by listing all allowed\ningress and egress identities in combination with L4 port and protocol.",
|
||||
"properties": {
|
||||
"egress": {
|
||||
"description": "EndpointPolicyDirection is the list of allowed identities per direction.",
|
||||
"properties": {
|
||||
"adding": {
|
||||
"description": "Deprecated",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowed": {
|
||||
"description": "AllowedIdentityList is a list of IdentityTuples that species peers that are\nallowed.",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"denied": {
|
||||
"description": "DenyIdentityList is a list of IdentityTuples that species peers that are\ndenied.",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"enforcing": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"removing": {
|
||||
"description": "Deprecated",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"state": {
|
||||
"description": "EndpointPolicyState defines the state of the Policy mode: \"enforcing\", \"non-enforcing\", \"disabled\"",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"enforcing"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ingress": {
|
||||
"description": "EndpointPolicyDirection is the list of allowed identities per direction.",
|
||||
"properties": {
|
||||
"adding": {
|
||||
"description": "Deprecated",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowed": {
|
||||
"description": "AllowedIdentityList is a list of IdentityTuples that species peers that are\nallowed.",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"denied": {
|
||||
"description": "DenyIdentityList is a list of IdentityTuples that species peers that are\ndenied.",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"enforcing": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"removing": {
|
||||
"description": "Deprecated",
|
||||
"items": {
|
||||
"description": "IdentityTuple specifies a peer by identity, destination port and protocol.",
|
||||
"properties": {
|
||||
"dest-port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identity": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"identity-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"protocol": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"state": {
|
||||
"description": "EndpointPolicyState defines the state of the Policy mode: \"enforcing\", \"non-enforcing\", \"disabled\"",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"enforcing"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"service-account": {
|
||||
"description": "ServiceAccount is the service account associated with the endpoint",
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"description": "State is the state of the endpoint.",
|
||||
"enum": [
|
||||
"creating",
|
||||
"waiting-for-identity",
|
||||
"not-ready",
|
||||
"waiting-to-regenerate",
|
||||
"regenerating",
|
||||
"restoring",
|
||||
"ready",
|
||||
"disconnecting",
|
||||
"disconnected",
|
||||
"invalid"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"description": "CiliumIdentity is a CRD that represents an identity managed by Cilium.\nIt is intended as a backing store for identity allocation, acting as the\nglobal coordination backend, and can be used in place of a KVStore (such as\netcd).\nThe name of the CRD is the numeric identity and the labels on the CRD object\nare the kubernetes sourced labels seen by cilium. This is currently the\nonly label source possible when running under kubernetes. Non-kubernetes\nlabels are filtered but all labels, from all sources, are places in the\nSecurityLabels field. These also include the source and are used to define\nthe identity.\nThe labels under metav1.ObjectMeta can be used when searching for\nCiliumIdentity instances that include particular labels. This can be done\nwith invocations such as:\n\n\tkubectl get ciliumid -l 'foo=bar'",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"security-labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "SecurityLabels is the source-of-truth set of labels for this identity.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"security-labels"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,221 @@
|
||||
{
|
||||
"description": "CiliumL2AnnouncementPolicy is a Kubernetes third-party resource which\nis used to defined which nodes should announce what services on the\nL2 network.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec is a human readable description of a L2 announcement policy",
|
||||
"properties": {
|
||||
"externalIPs": {
|
||||
"description": "If true, the external IPs of the services are announced",
|
||||
"type": "boolean"
|
||||
},
|
||||
"interfaces": {
|
||||
"description": "A list of regular expressions that express which network interface(s) should be used\nto announce the services over. If nil, all network interfaces are used.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"loadBalancerIPs": {
|
||||
"description": "If true, the loadbalancer IPs of the services are announced\n\nIf nil this policy applies to all services.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"description": "NodeSelector selects a group of nodes which will announce the IPs for\nthe services selected by the service selector.\n\nIf nil this policy applies to all nodes.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"enum": [
|
||||
"In",
|
||||
"NotIn",
|
||||
"Exists",
|
||||
"DoesNotExist"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"serviceSelector": {
|
||||
"description": "ServiceSelector selects a set of services which will be announced over L2 networks.\nThe loadBalancerClass for a service must be nil or specify a supported class, e.g.\n\"io.cilium/l2-announcer\". Refer to the following document for additional details\nregarding load balancer classes:\n\n https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\n\nIf nil this policy applies to all services.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"enum": [
|
||||
"In",
|
||||
"NotIn",
|
||||
"Exists",
|
||||
"DoesNotExist"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the policy.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Current service state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,185 @@
|
||||
{
|
||||
"description": "CiliumLoadBalancerIPPool is a Kubernetes third-party resource which\nis used to defined pools of IPs which the operator can use to to allocate\nand advertise IPs for Services of type LoadBalancer.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec is a human readable description for a BGP load balancer\nip pool.",
|
||||
"properties": {
|
||||
"allowFirstLastIPs": {
|
||||
"description": "AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.\nIf `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since\nreserving the first and last IPs would make the CIDRs unusable.",
|
||||
"enum": [
|
||||
"Yes",
|
||||
"No"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"blocks": {
|
||||
"description": "Blocks is a list of CIDRs comprising this IP Pool",
|
||||
"items": {
|
||||
"description": "CiliumLoadBalancerIPPoolIPBlock describes a single IP block.",
|
||||
"properties": {
|
||||
"cidr": {
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"start": {
|
||||
"type": "string"
|
||||
},
|
||||
"stop": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"disabled": {
|
||||
"default": false,
|
||||
"description": "Disabled, if set to true means that no new IPs will be allocated from this pool.\nExisting allocations will not be removed from services.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"serviceSelector": {
|
||||
"description": "ServiceSelector selects a set of services which are eligible to receive IPs from this",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"enum": [
|
||||
"In",
|
||||
"NotIn",
|
||||
"Exists",
|
||||
"DoesNotExist"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the IP Pool.\n\nIt might be possible for users to define overlapping IP Pools, we can't validate or enforce non-overlapping pools\nduring object creation. The Cilium operator will do this validation and update the status to reflect the ability\nto allocate IPs from this pool.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Current service state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,185 @@
|
||||
{
|
||||
"description": "CiliumLoadBalancerIPPool is a Kubernetes third-party resource which\nis used to defined pools of IPs which the operator can use to to allocate\nand advertise IPs for Services of type LoadBalancer.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec is a human readable description for a BGP load balancer\nip pool.",
|
||||
"properties": {
|
||||
"allowFirstLastIPs": {
|
||||
"description": "AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.\nIf `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since\nreserving the first and last IPs would make the CIDRs unusable.",
|
||||
"enum": [
|
||||
"Yes",
|
||||
"No"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"blocks": {
|
||||
"description": "Blocks is a list of CIDRs comprising this IP Pool",
|
||||
"items": {
|
||||
"description": "CiliumLoadBalancerIPPoolIPBlock describes a single IP block.",
|
||||
"properties": {
|
||||
"cidr": {
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"start": {
|
||||
"type": "string"
|
||||
},
|
||||
"stop": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"disabled": {
|
||||
"default": false,
|
||||
"description": "Disabled, if set to true means that no new IPs will be allocated from this pool.\nExisting allocations will not be removed from services.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"serviceSelector": {
|
||||
"description": "ServiceSelector selects a set of services which are eligible to receive IPs from this",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"enum": [
|
||||
"In",
|
||||
"NotIn",
|
||||
"Exists",
|
||||
"DoesNotExist"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the IP Pool.\n\nIt might be possible for users to define overlapping IP Pools, we can't validate or enforce non-overlapping pools\nduring object creation. The Cilium operator will do this validation and update the status to reflect the ability\nto allocate IPs from this pool.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Current service state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,818 @@
|
||||
{
|
||||
"description": "CiliumNode represents a node managed by Cilium. It contains a specification\nto control various node specific configuration aspects and a status section\nto represent the status of the node.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired specification/configuration of the node.",
|
||||
"properties": {
|
||||
"addresses": {
|
||||
"description": "Addresses is the list of all node addresses.",
|
||||
"items": {
|
||||
"description": "NodeAddress is a node address.",
|
||||
"properties": {
|
||||
"ip": {
|
||||
"description": "IP is an IP of a node",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of the node address",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"alibaba-cloud": {
|
||||
"description": "AlibabaCloud is the AlibabaCloud IPAM specific configuration.",
|
||||
"properties": {
|
||||
"availability-zone": {
|
||||
"description": "AvailabilityZone is the availability zone to use when allocating\nENIs.",
|
||||
"type": "string"
|
||||
},
|
||||
"cidr-block": {
|
||||
"description": "CIDRBlock is vpc ipv4 CIDR",
|
||||
"type": "string"
|
||||
},
|
||||
"instance-type": {
|
||||
"description": "InstanceType is the ECS instance type, e.g. \"ecs.g6.2xlarge\"",
|
||||
"type": "string"
|
||||
},
|
||||
"security-group-tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "SecurityGroupTags is the list of tags to use when evaluating which\nsecurity groups to use for the ENI.",
|
||||
"type": "object"
|
||||
},
|
||||
"security-groups": {
|
||||
"description": "SecurityGroups is the list of security groups to attach to any ENI\nthat is created and attached to the instance.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"vpc-id": {
|
||||
"description": "VPCID is the VPC ID to use when allocating ENIs.",
|
||||
"type": "string"
|
||||
},
|
||||
"vswitch-tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "VSwitchTags is the list of tags to use when evaluating which\nvSwitch to use for the ENI.",
|
||||
"type": "object"
|
||||
},
|
||||
"vswitches": {
|
||||
"description": "VSwitches is the ID of vSwitch available for ENI",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"azure": {
|
||||
"description": "Azure is the Azure IPAM specific configuration.",
|
||||
"properties": {
|
||||
"interface-name": {
|
||||
"description": "InterfaceName is the name of the interface the cilium-operator\nwill use to allocate all the IPs on",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"bootid": {
|
||||
"description": "BootID is a unique node identifier generated on boot",
|
||||
"type": "string"
|
||||
},
|
||||
"encryption": {
|
||||
"description": "Encryption is the encryption configuration of the node.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the index to the key to use for encryption or 0 if encryption is\ndisabled.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"eni": {
|
||||
"description": "ENI is the AWS ENI specific configuration.",
|
||||
"properties": {
|
||||
"availability-zone": {
|
||||
"description": "AvailabilityZone is the availability zone to use when allocating\nENIs.",
|
||||
"type": "string"
|
||||
},
|
||||
"delete-on-termination": {
|
||||
"description": "DeleteOnTermination defines that the ENI should be deleted when the\nassociated instance is terminated. If the parameter is not set the\ndefault behavior is to delete the ENI on instance termination.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"disable-prefix-delegation": {
|
||||
"description": "DisablePrefixDelegation determines whether ENI prefix delegation should be\ndisabled on this node.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"exclude-interface-tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ExcludeInterfaceTags is the list of tags to use when excluding ENIs for\nCilium IP allocation. Any interface matching this set of tags will not\nbe managed by Cilium.",
|
||||
"type": "object"
|
||||
},
|
||||
"first-interface-index": {
|
||||
"description": "FirstInterfaceIndex is the index of the first ENI to use for IP\nallocation, e.g. if the node has eth0, eth1, eth2 and\nFirstInterfaceIndex is set to 1, then only eth1 and eth2 will be\nused for IP allocation, eth0 will be ignored for PodIP allocation.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"instance-id": {
|
||||
"description": "InstanceID is the AWS InstanceId of the node. The InstanceID is used\nto retrieve AWS metadata for the node.\n\nOBSOLETE: This field is obsolete, please use Spec.InstanceID",
|
||||
"type": "string"
|
||||
},
|
||||
"instance-type": {
|
||||
"description": "InstanceType is the AWS EC2 instance type, e.g. \"m5.large\"",
|
||||
"type": "string"
|
||||
},
|
||||
"max-above-watermark": {
|
||||
"description": "MaxAboveWatermark is the maximum number of addresses to allocate\nbeyond the addresses needed to reach the PreAllocate watermark.\nGoing above the watermark can help reduce the number of API calls to\nallocate IPs, e.g. when a new ENI is allocated, as many secondary\nIPs as possible are allocated. Limiting the amount can help reduce\nwaste of IPs.\n\nOBSOLETE: This field is obsolete, please use Spec.IPAM.MaxAboveWatermark",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"min-allocate": {
|
||||
"description": "MinAllocate is the minimum number of IPs that must be allocated when\nthe node is first bootstrapped. It defines the minimum base socket\nof addresses that must be available. After reaching this watermark,\nthe PreAllocate and MaxAboveWatermark logic takes over to continue\nallocating IPs.\n\nOBSOLETE: This field is obsolete, please use Spec.IPAM.MinAllocate",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"node-subnet-id": {
|
||||
"description": "NodeSubnetID is the subnet of the primary ENI the instance was brought up\nwith. It is used as a sensible default subnet to create ENIs in.",
|
||||
"type": "string"
|
||||
},
|
||||
"pre-allocate": {
|
||||
"description": "PreAllocate defines the number of IP addresses that must be\navailable for allocation in the IPAMspec. It defines the buffer of\naddresses available immediately without requiring cilium-operator to\nget involved.\n\nOBSOLETE: This field is obsolete, please use Spec.IPAM.PreAllocate",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"security-group-tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "SecurityGroupTags is the list of tags to use when evaliating what\nAWS security groups to use for the ENI.",
|
||||
"type": "object"
|
||||
},
|
||||
"security-groups": {
|
||||
"description": "SecurityGroups is the list of security groups to attach to any ENI\nthat is created and attached to the instance.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"subnet-ids": {
|
||||
"description": "SubnetIDs is the list of subnet ids to use when evaluating what AWS\nsubnets to use for ENI and IP allocation.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"subnet-tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "SubnetTags is the list of tags to use when evaluating what AWS\nsubnets to use for ENI and IP allocation.",
|
||||
"type": "object"
|
||||
},
|
||||
"use-primary-address": {
|
||||
"description": "UsePrimaryAddress determines whether an ENI's primary address\nshould be available for allocations on the node",
|
||||
"type": "boolean"
|
||||
},
|
||||
"vpc-id": {
|
||||
"description": "VpcID is the VPC ID to use when allocating ENIs.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"health": {
|
||||
"description": "HealthAddressing is the addressing information for health connectivity\nchecking.",
|
||||
"properties": {
|
||||
"ipv4": {
|
||||
"description": "IPv4 is the IPv4 address of the IPv4 health endpoint.",
|
||||
"type": "string"
|
||||
},
|
||||
"ipv6": {
|
||||
"description": "IPv6 is the IPv6 address of the IPv4 health endpoint.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ingress": {
|
||||
"description": "IngressAddressing is the addressing information for Ingress listener.",
|
||||
"properties": {
|
||||
"ipv4": {
|
||||
"type": "string"
|
||||
},
|
||||
"ipv6": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"instance-id": {
|
||||
"description": "InstanceID is the identifier of the node. This is different from the\nnode name which is typically the FQDN of the node. The InstanceID\ntypically refers to the identifier used by the cloud provider or\nsome other means of identification.",
|
||||
"type": "string"
|
||||
},
|
||||
"ipam": {
|
||||
"description": "IPAM is the address management specification. This section can be\npopulated by a user or it can be automatically populated by an IPAM\noperator.",
|
||||
"properties": {
|
||||
"ipv6-pool": {
|
||||
"additionalProperties": {
|
||||
"description": "AllocationIP is an IP which is available for allocation, or already\nhas been allocated",
|
||||
"properties": {
|
||||
"owner": {
|
||||
"description": "Owner is the owner of the IP. This field is set if the IP has been\nallocated. It will be set to the pod name or another identifier\nrepresenting the usage of the IP\n\nThe owner field is left blank for an entry in Spec.IPAM.Pool and\nfilled out as the IP is used and also added to Status.IPAM.Used.",
|
||||
"type": "string"
|
||||
},
|
||||
"resource": {
|
||||
"description": "Resource is set for both available and allocated IPs, it represents\nwhat resource the IP is associated with, e.g. in combination with\nAWS ENI, this will refer to the ID of the ENI",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "IPv6Pool is the list of IPv6 addresses available to the node for allocation.\nWhen an IPv6 address is used, it will remain on this list but will be added to\nStatus.IPAM.IPv6Used",
|
||||
"type": "object"
|
||||
},
|
||||
"max-above-watermark": {
|
||||
"description": "MaxAboveWatermark is the maximum number of addresses to allocate\nbeyond the addresses needed to reach the PreAllocate watermark.\nGoing above the watermark can help reduce the number of API calls to\nallocate IPs, e.g. when a new ENI is allocated, as many secondary\nIPs as possible are allocated. Limiting the amount can help reduce\nwaste of IPs.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"max-allocate": {
|
||||
"description": "MaxAllocate is the maximum number of IPs that can be allocated to the\nnode. When the current amount of allocated IPs will approach this value,\nthe considered value for PreAllocate will decrease down to 0 in order to\nnot attempt to allocate more addresses than defined.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"min-allocate": {
|
||||
"description": "MinAllocate is the minimum number of IPs that must be allocated when\nthe node is first bootstrapped. It defines the minimum base socket\nof addresses that must be available. After reaching this watermark,\nthe PreAllocate and MaxAboveWatermark logic takes over to continue\nallocating IPs.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"podCIDRs": {
|
||||
"description": "PodCIDRs is the list of CIDRs available to the node for allocation.\nWhen an IP is used, the IP will be added to Status.IPAM.Used",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"pool": {
|
||||
"additionalProperties": {
|
||||
"description": "AllocationIP is an IP which is available for allocation, or already\nhas been allocated",
|
||||
"properties": {
|
||||
"owner": {
|
||||
"description": "Owner is the owner of the IP. This field is set if the IP has been\nallocated. It will be set to the pod name or another identifier\nrepresenting the usage of the IP\n\nThe owner field is left blank for an entry in Spec.IPAM.Pool and\nfilled out as the IP is used and also added to Status.IPAM.Used.",
|
||||
"type": "string"
|
||||
},
|
||||
"resource": {
|
||||
"description": "Resource is set for both available and allocated IPs, it represents\nwhat resource the IP is associated with, e.g. in combination with\nAWS ENI, this will refer to the ID of the ENI",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "Pool is the list of IPv4 addresses available to the node for allocation.\nWhen an IPv4 address is used, it will remain on this list but will be added to\nStatus.IPAM.Used",
|
||||
"type": "object"
|
||||
},
|
||||
"pools": {
|
||||
"description": "Pools contains the list of assigned IPAM pools for this node.",
|
||||
"properties": {
|
||||
"allocated": {
|
||||
"description": "Allocated contains the list of pooled CIDR assigned to this node. The\noperator will add new pod CIDRs to this field, whereas the agent will\nremove CIDRs it has released.",
|
||||
"items": {
|
||||
"description": "IPAMPoolAllocation describes an allocation of an IPAM pool from the operator to the\nnode. It contains the assigned PodCIDRs allocated from this pool",
|
||||
"properties": {
|
||||
"cidrs": {
|
||||
"description": "CIDRs contains a list of pod CIDRs currently allocated from this pool",
|
||||
"items": {
|
||||
"description": "IPAMPodCIDR is a pod CIDR",
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"pool": {
|
||||
"description": "Pool is the name of the IPAM pool backing this allocation",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"pool"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"requested": {
|
||||
"description": "Requested contains a list of IPAM pool requests, i.e. indicates how many\naddresses this node requests out of each pool listed here. This field\nis owned and written to by cilium-agent and read by the operator.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"needed": {
|
||||
"description": "Needed indicates how many IPs out of the above Pool this node requests\nfrom the operator. The operator runs a reconciliation loop to ensure each\nnode always has enough PodCIDRs allocated in each pool to fulfill the\nrequested number of IPs here.",
|
||||
"properties": {
|
||||
"ipv4-addrs": {
|
||||
"description": "IPv4Addrs contains the number of requested IPv4 addresses out of a given\npool",
|
||||
"type": "integer"
|
||||
},
|
||||
"ipv6-addrs": {
|
||||
"description": "IPv6Addrs contains the number of requested IPv6 addresses out of a given\npool",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pool": {
|
||||
"description": "Pool is the name of the IPAM pool backing this request",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"pool"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pre-allocate": {
|
||||
"description": "PreAllocate defines the number of IP addresses that must be\navailable for allocation in the IPAMspec. It defines the buffer of\naddresses available immediately without requiring cilium-operator to\nget involved.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"static-ip-tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "StaticIPTags are used to determine the pool of IPs from which to\nattribute a static IP to the node. For example in AWS this is used to\nfilter Elastic IP Addresses.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nodeidentity": {
|
||||
"description": "NodeIdentity is the Cilium numeric identity allocated for the node, if any.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status defines the realized specification/configuration and status\nof the node.",
|
||||
"properties": {
|
||||
"alibaba-cloud": {
|
||||
"description": "AlibabaCloud is the AlibabaCloud specific status of the node.",
|
||||
"properties": {
|
||||
"enis": {
|
||||
"additionalProperties": {
|
||||
"description": "ENI represents an AlibabaCloud Elastic Network Interface",
|
||||
"properties": {
|
||||
"instance-id": {
|
||||
"description": "InstanceID is the InstanceID using this ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"mac-address": {
|
||||
"description": "MACAddress is the mac address of the ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"network-interface-id": {
|
||||
"description": "NetworkInterfaceID is the ENI id",
|
||||
"type": "string"
|
||||
},
|
||||
"primary-ip-address": {
|
||||
"description": "PrimaryIPAddress is the primary IP on ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"private-ipsets": {
|
||||
"description": "PrivateIPSets is the list of all IPs on the ENI, including PrimaryIPAddress",
|
||||
"items": {
|
||||
"description": "PrivateIPSet is a nested struct in ecs response",
|
||||
"properties": {
|
||||
"primary": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"private-ip-address": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"security-groupids": {
|
||||
"description": "SecurityGroupIDs is the security group ids used by this ENI",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Tags is the tags on this ENI",
|
||||
"type": "object"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the ENI type Primary or Secondary",
|
||||
"type": "string"
|
||||
},
|
||||
"vpc": {
|
||||
"description": "VPC is the vpc to which the ENI belongs",
|
||||
"properties": {
|
||||
"cidr": {
|
||||
"description": "CIDRBlock is the VPC IPv4 CIDR",
|
||||
"type": "string"
|
||||
},
|
||||
"ipv6-cidr": {
|
||||
"description": "IPv6CIDRBlock is the VPC IPv6 CIDR",
|
||||
"type": "string"
|
||||
},
|
||||
"secondary-cidrs": {
|
||||
"description": "SecondaryCIDRs is the list of Secondary CIDRs associated with the VPC",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"vpc-id": {
|
||||
"description": "VPCID is the vpc to which the ENI belongs",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"vswitch": {
|
||||
"description": "VSwitch is the vSwitch the ENI is using",
|
||||
"properties": {
|
||||
"cidr": {
|
||||
"description": "CIDRBlock is the vSwitch IPv4 CIDR",
|
||||
"type": "string"
|
||||
},
|
||||
"ipv6-cidr": {
|
||||
"description": "IPv6CIDRBlock is the vSwitch IPv6 CIDR",
|
||||
"type": "string"
|
||||
},
|
||||
"vswitch-id": {
|
||||
"description": "VSwitchID is the vSwitch to which the ENI belongs",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"zone-id": {
|
||||
"description": "ZoneID is the zone to which the ENI belongs",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "ENIs is the list of ENIs on the node",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"azure": {
|
||||
"description": "Azure is the Azure specific status of the node.",
|
||||
"properties": {
|
||||
"interfaces": {
|
||||
"description": "Interfaces is the list of interfaces on the node",
|
||||
"items": {
|
||||
"description": "AzureInterface represents an Azure Interface",
|
||||
"properties": {
|
||||
"GatewayIP": {
|
||||
"description": "GatewayIP is the interface's subnet's default route\n\nOBSOLETE: This field is obsolete, please use Gateway field instead.",
|
||||
"type": "string"
|
||||
},
|
||||
"addresses": {
|
||||
"description": "Addresses is the list of all IPs associated with the interface,\nincluding all secondary addresses",
|
||||
"items": {
|
||||
"description": "AzureAddress is an IP address assigned to an AzureInterface",
|
||||
"properties": {
|
||||
"ip": {
|
||||
"description": "IP is the ip address of the address",
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"description": "State is the provisioning state of the address",
|
||||
"type": "string"
|
||||
},
|
||||
"subnet": {
|
||||
"description": "Subnet is the subnet the address belongs to",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"cidr": {
|
||||
"description": "CIDR is the range that the interface belongs to.",
|
||||
"type": "string"
|
||||
},
|
||||
"gateway": {
|
||||
"description": "Gateway is the interface's subnet's default route",
|
||||
"type": "string"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID is the identifier",
|
||||
"type": "string"
|
||||
},
|
||||
"mac": {
|
||||
"description": "MAC is the mac address",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the interface",
|
||||
"type": "string"
|
||||
},
|
||||
"security-group": {
|
||||
"description": "SecurityGroup is the security group associated with the interface",
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"description": "State is the provisioning state",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"eni": {
|
||||
"description": "ENI is the AWS ENI specific status of the node.",
|
||||
"properties": {
|
||||
"enis": {
|
||||
"additionalProperties": {
|
||||
"description": "ENI represents an AWS Elastic Network Interface\n\nMore details:\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html",
|
||||
"properties": {
|
||||
"addresses": {
|
||||
"description": "Addresses is the list of all secondary IPs associated with the ENI",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"availability-zone": {
|
||||
"description": "AvailabilityZone is the availability zone of the ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "Description is the description field of the ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID is the ENI ID",
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"description": "IP is the primary IP of the ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"mac": {
|
||||
"description": "MAC is the mac address of the ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"number": {
|
||||
"description": "Number is the interface index, it used in combination with\nFirstInterfaceIndex",
|
||||
"type": "integer"
|
||||
},
|
||||
"prefixes": {
|
||||
"description": "Prefixes is the list of all /28 prefixes associated with the ENI",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"public-ip": {
|
||||
"description": "PublicIP is the public IP associated with the ENI",
|
||||
"type": "string"
|
||||
},
|
||||
"security-groups": {
|
||||
"description": "SecurityGroups are the security groups associated with the ENI",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"subnet": {
|
||||
"description": "Subnet is the subnet the ENI is associated with",
|
||||
"properties": {
|
||||
"cidr": {
|
||||
"description": "CIDR is the CIDR range associated with the subnet",
|
||||
"type": "string"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID is the ID of the subnet",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tags": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Tags is the set of tags of the ENI. Used to detect ENIs which should\nnot be managed by Cilium",
|
||||
"type": "object"
|
||||
},
|
||||
"vpc": {
|
||||
"description": "VPC is the VPC information to which the ENI is attached to",
|
||||
"properties": {
|
||||
"cidrs": {
|
||||
"description": "CIDRs is the list of CIDR ranges associated with the VPC",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"id": {
|
||||
"description": "/ ID is the ID of a VPC",
|
||||
"type": "string"
|
||||
},
|
||||
"primary-cidr": {
|
||||
"description": "PrimaryCIDR is the primary CIDR of the VPC",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "ENIs is the list of ENIs on the node",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ipam": {
|
||||
"description": "IPAM is the IPAM status of the node.",
|
||||
"properties": {
|
||||
"assigned-static-ip": {
|
||||
"description": "AssignedStaticIP is the static IP assigned to the node (ex: public Elastic IP address in AWS)",
|
||||
"type": "string"
|
||||
},
|
||||
"ipv6-used": {
|
||||
"additionalProperties": {
|
||||
"description": "AllocationIP is an IP which is available for allocation, or already\nhas been allocated",
|
||||
"properties": {
|
||||
"owner": {
|
||||
"description": "Owner is the owner of the IP. This field is set if the IP has been\nallocated. It will be set to the pod name or another identifier\nrepresenting the usage of the IP\n\nThe owner field is left blank for an entry in Spec.IPAM.Pool and\nfilled out as the IP is used and also added to Status.IPAM.Used.",
|
||||
"type": "string"
|
||||
},
|
||||
"resource": {
|
||||
"description": "Resource is set for both available and allocated IPs, it represents\nwhat resource the IP is associated with, e.g. in combination with\nAWS ENI, this will refer to the ID of the ENI",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "IPv6Used lists all IPv6 addresses out of Spec.IPAM.IPv6Pool which have been\nallocated and are in use.",
|
||||
"type": "object"
|
||||
},
|
||||
"operator-status": {
|
||||
"description": "Operator is the Operator status of the node",
|
||||
"properties": {
|
||||
"error": {
|
||||
"description": "Error is the error message set by cilium-operator.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pod-cidrs": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"description": "Status describes the status of a pod CIDR",
|
||||
"enum": [
|
||||
"released",
|
||||
"depleted",
|
||||
"in-use"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "PodCIDRs lists the status of each pod CIDR allocated to this node.",
|
||||
"type": "object"
|
||||
},
|
||||
"release-ips": {
|
||||
"additionalProperties": {
|
||||
"description": "IPReleaseStatus defines the valid states in IP release handshake",
|
||||
"enum": [
|
||||
"marked-for-release",
|
||||
"ready-for-release",
|
||||
"do-not-release",
|
||||
"released"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ReleaseIPs tracks the state for every IPv4 address considered for release.\nThe value can be one of the following strings:\n* marked-for-release : Set by operator as possible candidate for IP\n* ready-for-release : Acknowledged as safe to release by agent\n* do-not-release : IP already in use / not owned by the node. Set by agent\n* released : IP successfully released. Set by operator",
|
||||
"type": "object"
|
||||
},
|
||||
"release-ipv6s": {
|
||||
"additionalProperties": {
|
||||
"description": "IPReleaseStatus defines the valid states in IP release handshake",
|
||||
"enum": [
|
||||
"marked-for-release",
|
||||
"ready-for-release",
|
||||
"do-not-release",
|
||||
"released"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ReleaseIPv6s tracks the state for every IPv6 address considered for release.\nThe value can be one of the following strings:\n* marked-for-release : Set by operator as possible candidate for IP\n* ready-for-release : Acknowledged as safe to release by agent\n* do-not-release : IP already in use / not owned by the node. Set by agent\n* released : IP successfully released. Set by operator",
|
||||
"type": "object"
|
||||
},
|
||||
"used": {
|
||||
"additionalProperties": {
|
||||
"description": "AllocationIP is an IP which is available for allocation, or already\nhas been allocated",
|
||||
"properties": {
|
||||
"owner": {
|
||||
"description": "Owner is the owner of the IP. This field is set if the IP has been\nallocated. It will be set to the pod name or another identifier\nrepresenting the usage of the IP\n\nThe owner field is left blank for an entry in Spec.IPAM.Pool and\nfilled out as the IP is used and also added to Status.IPAM.Used.",
|
||||
"type": "string"
|
||||
},
|
||||
"resource": {
|
||||
"description": "Resource is set for both available and allocated IPs, it represents\nwhat resource the IP is associated with, e.g. in combination with\nAWS ENI, this will refer to the ID of the ENI",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "Used lists all IPv4 addresses out of Spec.IPAM.Pool which have been allocated\nand are in use.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
{
|
||||
"description": "CiliumNodeConfig is a list of configuration key-value pairs. It is applied to\nnodes indicated by a label selector.\n\nIf multiple overrides apply to the same node, they will be ordered by name\nwith later Overrides overwriting any conflicting keys.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec is the desired Cilium configuration overrides for a given node",
|
||||
"properties": {
|
||||
"defaults": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Defaults is treated the same as the cilium-config ConfigMap - a set\nof key-value pairs parsed by the agent and operator processes.\nEach key must be a valid config-map data field (i.e. a-z, A-Z, -, _, and .)",
|
||||
"type": "object"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"description": "NodeSelector is a label selector that determines to which nodes\nthis configuration applies.\nIf not supplied, then this config applies to no nodes. If\nempty, then it applies to all nodes.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"defaults",
|
||||
"nodeSelector"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
{
|
||||
"description": "CiliumNodeConfig is a list of configuration key-value pairs. It is applied to\nnodes indicated by a label selector.\n\nIf multiple overrides apply to the same node, they will be ordered by name\nwith later Overrides overwriting any conflicting keys.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec is the desired Cilium configuration overrides for a given node",
|
||||
"properties": {
|
||||
"defaults": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Defaults is treated the same as the cilium-config ConfigMap - a set\nof key-value pairs parsed by the agent and operator processes.\nEach key must be a valid config-map data field (i.e. a-z, A-Z, -, _, and .)",
|
||||
"type": "object"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"description": "NodeSelector is a label selector that determines to which nodes\nthis configuration applies.\nIf not supplied, then this config applies to no nodes. If\nempty, then it applies to all nodes.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"defaults",
|
||||
"nodeSelector"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
{
|
||||
"description": "CiliumPodIPPool defines an IP pool that can be used for pooled IPAM (i.e. the multi-pool IPAM\nmode).",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"properties": {
|
||||
"ipv4": {
|
||||
"description": "IPv4 specifies the IPv4 CIDRs and mask sizes of the pool",
|
||||
"properties": {
|
||||
"cidrs": {
|
||||
"description": "CIDRs is a list of IPv4 CIDRs that are part of the pool.",
|
||||
"items": {
|
||||
"description": "PoolCIDR is an IP pool CIDR.",
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"maskSize": {
|
||||
"description": "MaskSize is the mask size of the pool.",
|
||||
"maximum": 32,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"cidrs",
|
||||
"maskSize"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ipv6": {
|
||||
"description": "IPv6 specifies the IPv6 CIDRs and mask sizes of the pool",
|
||||
"properties": {
|
||||
"cidrs": {
|
||||
"description": "CIDRs is a list of IPv6 CIDRs that are part of the pool.",
|
||||
"items": {
|
||||
"description": "PoolCIDR is an IP pool CIDR.",
|
||||
"format": "cidr",
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"maskSize": {
|
||||
"description": "MaskSize is the mask size of the pool.",
|
||||
"maximum": 128,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"cidrs",
|
||||
"maskSize"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"namespaceSelector": {
|
||||
"description": "NamespaceSelector selects the set of Namespaces that are eligible to use\nthis pool. If both PodSelector and NamespaceSelector are specified, a Pod\nmust match both selectors to be eligible for IP allocation from this pool.\n\nIf NamespaceSelector is empty, the pool can be used by Pods in any namespace\n(subject to PodSelector constraints).",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"enum": [
|
||||
"In",
|
||||
"NotIn",
|
||||
"Exists",
|
||||
"DoesNotExist"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podSelector": {
|
||||
"description": "PodSelector selects the set of Pods that are eligible to receive IPs from\nthis pool when neither the Pod nor its Namespace specify an explicit\n`ipam.cilium.io/*` annotation.\n\nThe selector can match on regular Pod labels and on the following synthetic\nlabels that Cilium adds for convenience:\n\nio.kubernetes.pod.namespace \u2013 the Pod's namespace\nio.kubernetes.pod.name \u2013 the Pod's name\n\nA single Pod must not match more than one pool for the same IP family.\nIf multiple pools match, IP allocation fails for that Pod and a warning event\nis emitted in the namespace of the Pod.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"enum": [
|
||||
"In",
|
||||
"NotIn",
|
||||
"Exists",
|
||||
"DoesNotExist"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"description": "MatchLabelsValue represents the value from the MatchLabels {key,value} pair.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,180 @@
|
||||
{
|
||||
"description": "CloudEventSource defines how a KEDA event will be sent to event sink",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "CloudEventSourceSpec defines the spec of CloudEventSource",
|
||||
"properties": {
|
||||
"authenticationRef": {
|
||||
"description": "AuthenticationRef points to the TriggerAuthentication or ClusterTriggerAuthentication object that\nis used to authenticate the scaler with the environment",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind of the resource being referred to. Defaults to TriggerAuthentication.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clusterName": {
|
||||
"type": "string"
|
||||
},
|
||||
"destination": {
|
||||
"description": "Destination defines the various ways to emit events",
|
||||
"properties": {
|
||||
"azureEventGridTopic": {
|
||||
"properties": {
|
||||
"endpoint": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"endpoint"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"http": {
|
||||
"properties": {
|
||||
"uri": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"uri"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"eventSubscription": {
|
||||
"description": "EventSubscription defines filters for events",
|
||||
"properties": {
|
||||
"excludedEventTypes": {
|
||||
"items": {
|
||||
"enum": [
|
||||
"keda.scaledobject.ready.v1",
|
||||
"keda.scaledobject.failed.v1",
|
||||
"keda.scaledobject.removed.v1",
|
||||
"keda.scaledobject.paused.v1",
|
||||
"keda.scaledobject.unpaused.v1",
|
||||
"keda.scaledjob.ready.v1",
|
||||
"keda.scaledjob.failed.v1",
|
||||
"keda.scaledjob.removed.v1",
|
||||
"keda.scaledjob.paused.v1",
|
||||
"keda.scaledjob.unpaused.v1",
|
||||
"keda.scaledjob.rolloutcleanup.started.v1",
|
||||
"keda.scaledjob.rolloutcleanup.completed.v1",
|
||||
"keda.scaledjob.rolloutcleanup.failed.v1",
|
||||
"keda.authentication.triggerauthentication.created.v1",
|
||||
"keda.authentication.triggerauthentication.updated.v1",
|
||||
"keda.authentication.triggerauthentication.removed.v1",
|
||||
"keda.authentication.clustertriggerauthentication.created.v1",
|
||||
"keda.authentication.clustertriggerauthentication.updated.v1",
|
||||
"keda.authentication.clustertriggerauthentication.removed.v1"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"includedEventTypes": {
|
||||
"items": {
|
||||
"enum": [
|
||||
"keda.scaledobject.ready.v1",
|
||||
"keda.scaledobject.failed.v1",
|
||||
"keda.scaledobject.removed.v1",
|
||||
"keda.scaledobject.paused.v1",
|
||||
"keda.scaledobject.unpaused.v1",
|
||||
"keda.scaledjob.ready.v1",
|
||||
"keda.scaledjob.failed.v1",
|
||||
"keda.scaledjob.removed.v1",
|
||||
"keda.scaledjob.paused.v1",
|
||||
"keda.scaledjob.unpaused.v1",
|
||||
"keda.scaledjob.rolloutcleanup.started.v1",
|
||||
"keda.scaledjob.rolloutcleanup.completed.v1",
|
||||
"keda.scaledjob.rolloutcleanup.failed.v1",
|
||||
"keda.authentication.triggerauthentication.created.v1",
|
||||
"keda.authentication.triggerauthentication.updated.v1",
|
||||
"keda.authentication.triggerauthentication.removed.v1",
|
||||
"keda.authentication.clustertriggerauthentication.created.v1",
|
||||
"keda.authentication.clustertriggerauthentication.updated.v1",
|
||||
"keda.authentication.clustertriggerauthentication.removed.v1"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"destination"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "CloudEventSourceStatus defines the observed state of CloudEventSource",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions an array representation to store multiple Conditions",
|
||||
"items": {
|
||||
"description": "Condition to store the condition state",
|
||||
"properties": {
|
||||
"message": {
|
||||
"description": "A human readable message indicating details about the transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "The reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the condition, one of True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of condition",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,179 @@
|
||||
{
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "CloudEventSourceSpec defines the spec of CloudEventSource",
|
||||
"properties": {
|
||||
"authenticationRef": {
|
||||
"description": "AuthenticationRef points to the TriggerAuthentication or ClusterTriggerAuthentication object that\nis used to authenticate the scaler with the environment",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind of the resource being referred to. Defaults to TriggerAuthentication.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clusterName": {
|
||||
"type": "string"
|
||||
},
|
||||
"destination": {
|
||||
"description": "Destination defines the various ways to emit events",
|
||||
"properties": {
|
||||
"azureEventGridTopic": {
|
||||
"properties": {
|
||||
"endpoint": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"endpoint"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"http": {
|
||||
"properties": {
|
||||
"uri": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"uri"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"eventSubscription": {
|
||||
"description": "EventSubscription defines filters for events",
|
||||
"properties": {
|
||||
"excludedEventTypes": {
|
||||
"items": {
|
||||
"enum": [
|
||||
"keda.scaledobject.ready.v1",
|
||||
"keda.scaledobject.failed.v1",
|
||||
"keda.scaledobject.removed.v1",
|
||||
"keda.scaledobject.paused.v1",
|
||||
"keda.scaledobject.unpaused.v1",
|
||||
"keda.scaledjob.ready.v1",
|
||||
"keda.scaledjob.failed.v1",
|
||||
"keda.scaledjob.removed.v1",
|
||||
"keda.scaledjob.paused.v1",
|
||||
"keda.scaledjob.unpaused.v1",
|
||||
"keda.scaledjob.rolloutcleanup.started.v1",
|
||||
"keda.scaledjob.rolloutcleanup.completed.v1",
|
||||
"keda.scaledjob.rolloutcleanup.failed.v1",
|
||||
"keda.authentication.triggerauthentication.created.v1",
|
||||
"keda.authentication.triggerauthentication.updated.v1",
|
||||
"keda.authentication.triggerauthentication.removed.v1",
|
||||
"keda.authentication.clustertriggerauthentication.created.v1",
|
||||
"keda.authentication.clustertriggerauthentication.updated.v1",
|
||||
"keda.authentication.clustertriggerauthentication.removed.v1"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"includedEventTypes": {
|
||||
"items": {
|
||||
"enum": [
|
||||
"keda.scaledobject.ready.v1",
|
||||
"keda.scaledobject.failed.v1",
|
||||
"keda.scaledobject.removed.v1",
|
||||
"keda.scaledobject.paused.v1",
|
||||
"keda.scaledobject.unpaused.v1",
|
||||
"keda.scaledjob.ready.v1",
|
||||
"keda.scaledjob.failed.v1",
|
||||
"keda.scaledjob.removed.v1",
|
||||
"keda.scaledjob.paused.v1",
|
||||
"keda.scaledjob.unpaused.v1",
|
||||
"keda.scaledjob.rolloutcleanup.started.v1",
|
||||
"keda.scaledjob.rolloutcleanup.completed.v1",
|
||||
"keda.scaledjob.rolloutcleanup.failed.v1",
|
||||
"keda.authentication.triggerauthentication.created.v1",
|
||||
"keda.authentication.triggerauthentication.updated.v1",
|
||||
"keda.authentication.triggerauthentication.removed.v1",
|
||||
"keda.authentication.clustertriggerauthentication.created.v1",
|
||||
"keda.authentication.clustertriggerauthentication.updated.v1",
|
||||
"keda.authentication.clustertriggerauthentication.removed.v1"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"destination"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "CloudEventSourceStatus defines the observed state of CloudEventSource",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions an array representation to store multiple Conditions",
|
||||
"items": {
|
||||
"description": "Condition to store the condition state",
|
||||
"properties": {
|
||||
"message": {
|
||||
"description": "A human readable message indicating details about the transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "The reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the condition, one of True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of condition",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
{
|
||||
"description": "ClusterImageCatalog is the Schema for the clusterimagecatalogs API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired behavior of the ClusterImageCatalog.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"images": {
|
||||
"description": "List of CatalogImages available in the catalog",
|
||||
"items": {
|
||||
"description": "CatalogImage defines the image and major version",
|
||||
"properties": {
|
||||
"image": {
|
||||
"description": "The image reference",
|
||||
"type": "string"
|
||||
},
|
||||
"major": {
|
||||
"description": "The PostgreSQL major version of the image. Must be unique within the catalog.",
|
||||
"minimum": 10,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image",
|
||||
"major"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "Images must have unique major versions",
|
||||
"rule": "self.all(e, self.filter(f, f.major==e.major).size() == 1)"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"images"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
{
|
||||
"description": "ClusterImageSetAvailability is the Schema for the clusterimagesetavailabilities API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "ClusterImageSetAvailabilitySpec defines the desired monitoring configuration.",
|
||||
"properties": {
|
||||
"imageFilter": {
|
||||
"description": "ImageFilter selects which images to monitor.",
|
||||
"properties": {
|
||||
"exclude": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"include": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"unusedImageExpiry": {
|
||||
"description": "UnusedImageExpiry is how long to keep tracking an image after no Pod uses it.\nOnce elapsed the image is removed from status. Example: \"720h\" (30 days).\nZero means unused images are never removed.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "ClusterImageSetAvailabilityStatus defines the observed state.",
|
||||
"properties": {
|
||||
"imageCount": {
|
||||
"description": "ImageCount is the total number of images currently being tracked.",
|
||||
"type": "integer"
|
||||
},
|
||||
"images": {
|
||||
"items": {
|
||||
"description": "MonitoredImage holds the current availability state for a single image.",
|
||||
"properties": {
|
||||
"image": {
|
||||
"description": "Image is the full normalised image reference, e.g. \"docker.io/library/nginx:1.27\".",
|
||||
"type": "string"
|
||||
},
|
||||
"lastError": {
|
||||
"description": "LastError contains the error message from the last failed check, if any.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastMonitor": {
|
||||
"description": "LastMonitor is the timestamp of the last availability check.\nNil means the image has not been checked yet.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"default": "Scheduled",
|
||||
"description": "Status is the result of the last availability check.",
|
||||
"enum": [
|
||||
"Scheduled",
|
||||
"Available",
|
||||
"NotFound",
|
||||
"Unreachable",
|
||||
"InvalidAuth",
|
||||
"UnavailableSecret",
|
||||
"QuotaExceeded"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"unusedSince": {
|
||||
"description": "UnusedSince is the timestamp when the last Pod referencing this image disappeared.\nNil means at least one Pod currently uses this image.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image",
|
||||
"status"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"image"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
{
|
||||
"description": "ClusterImageSetMirror is the Schema for the clusterimagesetmirrors API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "ClusterImageSetMirrorSpec defines the desired state of ClusterImageSetMirror.",
|
||||
"properties": {
|
||||
"cleanup": {
|
||||
"description": "Cleanup defines a cleanup strategy",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"retention": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"imageFilter": {
|
||||
"description": "ImageFilterDefinition is the definition of an image filter",
|
||||
"properties": {
|
||||
"exclude": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"include": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"mirrors": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"cleanup": {
|
||||
"description": "Cleanup defines a cleanup strategy",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"retention": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"credentialSecret": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace where the secret is located.\nThis value is ignored for namespaced resources and the namespace of the parent object is used instead.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority controls the ordering of this mirror in comparaison to similar alternatives (mirrors with same parent priority) when re-routing images.\n0 means no specific ordering (YAML declaration order is preserved).\nPositive values are sorted ascending: lower value = higher priority.",
|
||||
"type": "integer"
|
||||
},
|
||||
"registry": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority controls the ordering of alternatives from this CR relative to the original image and other CRs.\nNegative values place alternatives before the original image; positive values place them after.\nDefault is 0 (original image first, then alternatives in default type order).",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "ClusterImageSetMirrorStatus defines the observed state of ClusterImageSetMirror.",
|
||||
"properties": {
|
||||
"matchingImages": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"mirrors": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"lastError": {
|
||||
"type": "string"
|
||||
},
|
||||
"mirroredAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"image"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"unusedSince": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"image"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,91 @@
|
||||
{
|
||||
"description": "ClusterReplicatedImageSet is the Schema for the clusterreplicatedimagesets API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "ClusterReplicatedImageSetSpec defines the desired state of ClusterReplicatedImageSet.",
|
||||
"properties": {
|
||||
"priority": {
|
||||
"description": "Priority controls the ordering of alternatives from this CR relative to the original image and other CRs.\nNegative values place alternatives before the original image; positive values place them after.\nDefault is 0 (original image first, then alternatives in default type order).",
|
||||
"type": "integer"
|
||||
},
|
||||
"upstreams": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"credentialSecret": {
|
||||
"description": "CredentialSecret is a reference to the secret used to pull matching images.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace where the secret is located.\nThis value is ignored for namespaced resources and the namespace of the parent object is used instead.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"imageFilter": {
|
||||
"description": "ImageFilter defines the rules used to select replicated images.",
|
||||
"properties": {
|
||||
"exclude": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"include": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"description": "Path is a string identifying the image in a registry",
|
||||
"type": "string"
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority controls the ordering of this mirror in comparaison to similar alternatives (replicated upstream with same parent priority) when re-routing images.\n0 means no specific ordering (YAML declaration order is preserved).\nPositive values are sorted ascending: lower value = higher priority.",
|
||||
"type": "integer"
|
||||
},
|
||||
"registry": {
|
||||
"description": "Registry is the registry where the image is located",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"path",
|
||||
"registry"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "ClusterReplicatedImageSetStatus defines the observed state of ClusterReplicatedImageSet.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,741 @@
|
||||
{
|
||||
"description": "ClusterTriggerAuthentication defines how a trigger can authenticate globally",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "TriggerAuthenticationSpec defines the various ways to authenticate",
|
||||
"properties": {
|
||||
"awsSecretManager": {
|
||||
"description": "AwsSecretManager is used to authenticate using AwsSecretManager",
|
||||
"properties": {
|
||||
"credentials": {
|
||||
"properties": {
|
||||
"accessKey": {
|
||||
"properties": {
|
||||
"valueFrom": {
|
||||
"properties": {
|
||||
"secretKeyRef": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"valueFrom"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"accessSecretKey": {
|
||||
"properties": {
|
||||
"valueFrom": {
|
||||
"properties": {
|
||||
"secretKeyRef": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"valueFrom"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"accessToken": {
|
||||
"properties": {
|
||||
"valueFrom": {
|
||||
"properties": {
|
||||
"secretKeyRef": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"valueFrom"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"accessKey",
|
||||
"accessSecretKey"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podIdentity": {
|
||||
"description": "AuthPodIdentity allows users to select the platform native identity\nmechanism",
|
||||
"properties": {
|
||||
"identityAuthorityHost": {
|
||||
"description": "Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"identityId": {
|
||||
"type": "string"
|
||||
},
|
||||
"identityOwner": {
|
||||
"description": "IdentityOwner configures which identity has to be used during auto discovery, keda or the scaled workload. Mutually exclusive with roleArn",
|
||||
"enum": [
|
||||
"keda",
|
||||
"workload"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"identityTenantId": {
|
||||
"description": "Set identityTenantId to override the default Azure tenant id. If this is set, then the IdentityID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"provider": {
|
||||
"description": "PodIdentityProvider contains the list of providers",
|
||||
"enum": [
|
||||
"azure-workload",
|
||||
"gcp",
|
||||
"aws",
|
||||
"aws-eks",
|
||||
"none"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"roleArn": {
|
||||
"description": "RoleArn sets the AWS RoleArn to be used. Mutually exclusive with IdentityOwner",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"provider"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"region": {
|
||||
"type": "string"
|
||||
},
|
||||
"secrets": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
},
|
||||
"secretKey": {
|
||||
"type": "string"
|
||||
},
|
||||
"versionId": {
|
||||
"type": "string"
|
||||
},
|
||||
"versionStage": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"parameter"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secrets"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"azureKeyVault": {
|
||||
"description": "AzureKeyVault is used to authenticate using Azure Key Vault",
|
||||
"properties": {
|
||||
"cloud": {
|
||||
"properties": {
|
||||
"activeDirectoryEndpoint": {
|
||||
"type": "string"
|
||||
},
|
||||
"keyVaultResourceURL": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"credentials": {
|
||||
"properties": {
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientSecret": {
|
||||
"properties": {
|
||||
"valueFrom": {
|
||||
"properties": {
|
||||
"secretKeyRef": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"valueFrom"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tenantId": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"clientId",
|
||||
"clientSecret",
|
||||
"tenantId"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podIdentity": {
|
||||
"description": "AuthPodIdentity allows users to select the platform native identity\nmechanism",
|
||||
"properties": {
|
||||
"identityAuthorityHost": {
|
||||
"description": "Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"identityId": {
|
||||
"type": "string"
|
||||
},
|
||||
"identityOwner": {
|
||||
"description": "IdentityOwner configures which identity has to be used during auto discovery, keda or the scaled workload. Mutually exclusive with roleArn",
|
||||
"enum": [
|
||||
"keda",
|
||||
"workload"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"identityTenantId": {
|
||||
"description": "Set identityTenantId to override the default Azure tenant id. If this is set, then the IdentityID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"provider": {
|
||||
"description": "PodIdentityProvider contains the list of providers",
|
||||
"enum": [
|
||||
"azure-workload",
|
||||
"gcp",
|
||||
"aws",
|
||||
"aws-eks",
|
||||
"none"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"roleArn": {
|
||||
"description": "RoleArn sets the AWS RoleArn to be used. Mutually exclusive with IdentityOwner",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"provider"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secrets": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"parameter"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"vaultUri": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secrets",
|
||||
"vaultUri"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"boundServiceAccountToken": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
},
|
||||
"serviceAccountName": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"parameter",
|
||||
"serviceAccountName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"configMapTargetRef": {
|
||||
"items": {
|
||||
"description": "AuthConfigMapTargetRef is used to authenticate using a reference to a config map",
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name",
|
||||
"parameter"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"env": {
|
||||
"items": {
|
||||
"description": "AuthEnvironment is used to authenticate using environment variables\nin the destination ScaleTarget spec",
|
||||
"properties": {
|
||||
"containerName": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"parameter"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"filePath": {
|
||||
"description": "FilePath specifies a file containing auth parameters as JSON map[string]string.\nWhen set, auth params are read directly from this file instead.",
|
||||
"type": "string"
|
||||
},
|
||||
"gcpSecretManager": {
|
||||
"properties": {
|
||||
"credentials": {
|
||||
"properties": {
|
||||
"clientSecret": {
|
||||
"properties": {
|
||||
"valueFrom": {
|
||||
"properties": {
|
||||
"secretKeyRef": {
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"valueFrom"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"clientSecret"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podIdentity": {
|
||||
"description": "AuthPodIdentity allows users to select the platform native identity\nmechanism",
|
||||
"properties": {
|
||||
"identityAuthorityHost": {
|
||||
"description": "Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"identityId": {
|
||||
"type": "string"
|
||||
},
|
||||
"identityOwner": {
|
||||
"description": "IdentityOwner configures which identity has to be used during auto discovery, keda or the scaled workload. Mutually exclusive with roleArn",
|
||||
"enum": [
|
||||
"keda",
|
||||
"workload"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"identityTenantId": {
|
||||
"description": "Set identityTenantId to override the default Azure tenant id. If this is set, then the IdentityID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"provider": {
|
||||
"description": "PodIdentityProvider contains the list of providers",
|
||||
"enum": [
|
||||
"azure-workload",
|
||||
"gcp",
|
||||
"aws",
|
||||
"aws-eks",
|
||||
"none"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"roleArn": {
|
||||
"description": "RoleArn sets the AWS RoleArn to be used. Mutually exclusive with IdentityOwner",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"provider"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secrets": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"id",
|
||||
"parameter"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secrets"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"hashiCorpVault": {
|
||||
"description": "HashiCorpVault is used to authenticate using Hashicorp Vault",
|
||||
"properties": {
|
||||
"address": {
|
||||
"type": "string"
|
||||
},
|
||||
"authentication": {
|
||||
"description": "VaultAuthentication contains the list of Hashicorp Vault authentication methods",
|
||||
"type": "string"
|
||||
},
|
||||
"credential": {
|
||||
"description": "Credential defines the Hashicorp Vault credentials depending on the authentication method",
|
||||
"properties": {
|
||||
"serviceAccount": {
|
||||
"type": "string"
|
||||
},
|
||||
"serviceAccountName": {
|
||||
"type": "string"
|
||||
},
|
||||
"token": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"mount": {
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"type": "string"
|
||||
},
|
||||
"role": {
|
||||
"type": "string"
|
||||
},
|
||||
"secrets": {
|
||||
"items": {
|
||||
"description": "VaultSecret defines the mapping between the path of the secret in Vault to the parameter",
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"pkiData": {
|
||||
"properties": {
|
||||
"altNames": {
|
||||
"type": "string"
|
||||
},
|
||||
"commonName": {
|
||||
"type": "string"
|
||||
},
|
||||
"format": {
|
||||
"type": "string"
|
||||
},
|
||||
"ipSans": {
|
||||
"type": "string"
|
||||
},
|
||||
"otherSans": {
|
||||
"type": "string"
|
||||
},
|
||||
"ttl": {
|
||||
"type": "string"
|
||||
},
|
||||
"uriSans": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": {
|
||||
"description": "VaultSecretType defines the type of vault secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"parameter",
|
||||
"path"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"address",
|
||||
"authentication",
|
||||
"secrets"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podIdentity": {
|
||||
"description": "AuthPodIdentity allows users to select the platform native identity\nmechanism",
|
||||
"properties": {
|
||||
"identityAuthorityHost": {
|
||||
"description": "Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"identityId": {
|
||||
"type": "string"
|
||||
},
|
||||
"identityOwner": {
|
||||
"description": "IdentityOwner configures which identity has to be used during auto discovery, keda or the scaled workload. Mutually exclusive with roleArn",
|
||||
"enum": [
|
||||
"keda",
|
||||
"workload"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"identityTenantId": {
|
||||
"description": "Set identityTenantId to override the default Azure tenant id. If this is set, then the IdentityID must also be set",
|
||||
"type": "string"
|
||||
},
|
||||
"provider": {
|
||||
"description": "PodIdentityProvider contains the list of providers",
|
||||
"enum": [
|
||||
"azure-workload",
|
||||
"gcp",
|
||||
"aws",
|
||||
"aws-eks",
|
||||
"none"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"roleArn": {
|
||||
"description": "RoleArn sets the AWS RoleArn to be used. Mutually exclusive with IdentityOwner",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"provider"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secretTargetRef": {
|
||||
"items": {
|
||||
"description": "AuthSecretTargetRef is used to authenticate using a reference to a secret",
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameter": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name",
|
||||
"parameter"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "TriggerAuthenticationStatus defines the observed state of TriggerAuthentication",
|
||||
"properties": {
|
||||
"scaledjobs": {
|
||||
"type": "string"
|
||||
},
|
||||
"scaledobjects": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,621 @@
|
||||
{
|
||||
"description": "Database is the Schema for the databases API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired Database.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"allowConnections": {
|
||||
"description": "Maps to the `ALLOW_CONNECTIONS` parameter of `CREATE DATABASE` and\n`ALTER DATABASE`. If false then no one can connect to this database.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"builtinLocale": {
|
||||
"description": "Maps to the `BUILTIN_LOCALE` parameter of `CREATE DATABASE`. This\nsetting cannot be changed. Specifies the locale name when the\nbuiltin provider is used. This option requires `localeProvider` to\nbe set to `builtin`. Available from PostgreSQL 17.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "builtinLocale is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"cluster": {
|
||||
"description": "The name of the PostgreSQL cluster hosting the database.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"collationVersion": {
|
||||
"description": "Maps to the `COLLATION_VERSION` parameter of `CREATE DATABASE`. This\nsetting cannot be changed.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "collationVersion is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"connectionLimit": {
|
||||
"description": "Maps to the `CONNECTION LIMIT` clause of `CREATE DATABASE` and\n`ALTER DATABASE`. How many concurrent connections can be made to\nthis database. -1 (the default) means no limit.",
|
||||
"type": "integer"
|
||||
},
|
||||
"databaseReclaimPolicy": {
|
||||
"default": "retain",
|
||||
"description": "The policy for end-of-life maintenance of this database.",
|
||||
"enum": [
|
||||
"delete",
|
||||
"retain"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"encoding": {
|
||||
"description": "Maps to the `ENCODING` parameter of `CREATE DATABASE`. This setting\ncannot be changed. Character set encoding to use in the database.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "encoding is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Ensure the PostgreSQL database is `present` or `absent` - defaults to \"present\".",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"extensions": {
|
||||
"description": "The list of extensions to be managed in the database",
|
||||
"items": {
|
||||
"description": "ExtensionSpec configures an extension in a database",
|
||||
"properties": {
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Specifies whether an object (e.g schema) should be present or absent\nin the database. If set to `present`, the object will be created if\nit does not exist. If set to `absent`, the extension/schema will be\nremoved if it exists.",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the object (extension, schema, FDW, server)",
|
||||
"type": "string"
|
||||
},
|
||||
"schema": {
|
||||
"description": "The name of the schema in which to install the extension's objects,\nin case the extension allows its contents to be relocated. If not\nspecified (default), and the extension's control file does not\nspecify a schema either, the current default object creation schema\nis used.",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"description": "The version of the extension to install. If empty, the operator will\ninstall the default version (whatever is specified in the\nextension's control file)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"fdws": {
|
||||
"description": "The list of foreign data wrappers to be managed in the database",
|
||||
"items": {
|
||||
"description": "FDWSpec configures an Foreign Data Wrapper in a database",
|
||||
"properties": {
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Specifies whether an object (e.g schema) should be present or absent\nin the database. If set to `present`, the object will be created if\nit does not exist. If set to `absent`, the extension/schema will be\nremoved if it exists.",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"handler": {
|
||||
"description": "Name of the handler function (e.g., \"postgres_fdw_handler\").\nThis will be empty if no handler is specified. In that case,\nthe default handler is registered when the FDW extension is created.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the object (extension, schema, FDW, server)",
|
||||
"type": "string"
|
||||
},
|
||||
"options": {
|
||||
"description": "Options specifies the configuration options for the FDW.",
|
||||
"items": {
|
||||
"description": "OptionSpec holds the name, value and the ensure field for an option",
|
||||
"properties": {
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Specifies whether an option should be present or absent in\nthe database. If set to `present`, the option will be\ncreated if it does not exist. If set to `absent`, the\noption will be removed if it exists.",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the option",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the option",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"owner": {
|
||||
"description": "Owner specifies the database role that will own the Foreign Data Wrapper.\nThe role must have superuser privileges in the target database.",
|
||||
"type": "string"
|
||||
},
|
||||
"usage": {
|
||||
"description": "List of roles for which `USAGE` privileges on the FDW are granted or revoked.",
|
||||
"items": {
|
||||
"description": "UsageSpec configures a usage for a foreign data wrapper",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the usage",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "name is required",
|
||||
"rule": "self != ''"
|
||||
}
|
||||
]
|
||||
},
|
||||
"type": {
|
||||
"default": "grant",
|
||||
"description": "The type of usage",
|
||||
"enum": [
|
||||
"grant",
|
||||
"revoke"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"validator": {
|
||||
"description": "Name of the validator function (e.g., \"postgres_fdw_validator\").\nThis will be empty if no validator is specified. In that case,\nthe default validator is registered when the FDW extension is created.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"icuLocale": {
|
||||
"description": "Maps to the `ICU_LOCALE` parameter of `CREATE DATABASE`. This\nsetting cannot be changed. Specifies the ICU locale when the ICU\nprovider is used. This option requires `localeProvider` to be set to\n`icu`. Available from PostgreSQL 15.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "icuLocale is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"icuRules": {
|
||||
"description": "Maps to the `ICU_RULES` parameter of `CREATE DATABASE`. This setting\ncannot be changed. Specifies additional collation rules to customize\nthe behavior of the default collation. This option requires\n`localeProvider` to be set to `icu`. Available from PostgreSQL 16.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "icuRules is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"isTemplate": {
|
||||
"description": "Maps to the `IS_TEMPLATE` parameter of `CREATE DATABASE` and `ALTER\nDATABASE`. If true, this database is considered a template and can\nbe cloned by any user with `CREATEDB` privileges.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"locale": {
|
||||
"description": "Maps to the `LOCALE` parameter of `CREATE DATABASE`. This setting\ncannot be changed. Sets the default collation order and character\nclassification in the new database.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "locale is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"localeCType": {
|
||||
"description": "Maps to the `LC_CTYPE` parameter of `CREATE DATABASE`. This setting\ncannot be changed.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "localeCType is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"localeCollate": {
|
||||
"description": "Maps to the `LC_COLLATE` parameter of `CREATE DATABASE`. This\nsetting cannot be changed.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "localeCollate is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"localeProvider": {
|
||||
"description": "Maps to the `LOCALE_PROVIDER` parameter of `CREATE DATABASE`. This\nsetting cannot be changed. This option sets the locale provider for\ndatabases created in the new cluster. Available from PostgreSQL 16.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "localeProvider is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the database to create inside PostgreSQL. This setting cannot be changed.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "name is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
},
|
||||
{
|
||||
"message": "the name postgres is reserved",
|
||||
"rule": "self != 'postgres'"
|
||||
},
|
||||
{
|
||||
"message": "the name template0 is reserved",
|
||||
"rule": "self != 'template0'"
|
||||
},
|
||||
{
|
||||
"message": "the name template1 is reserved",
|
||||
"rule": "self != 'template1'"
|
||||
}
|
||||
]
|
||||
},
|
||||
"owner": {
|
||||
"description": "Maps to the `OWNER` parameter of `CREATE DATABASE`.\nMaps to the `OWNER TO` command of `ALTER DATABASE`.\nThe role name of the user who owns the database inside PostgreSQL.",
|
||||
"type": "string"
|
||||
},
|
||||
"schemas": {
|
||||
"description": "The list of schemas to be managed in the database",
|
||||
"items": {
|
||||
"description": "SchemaSpec configures a schema in a database",
|
||||
"properties": {
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Specifies whether an object (e.g schema) should be present or absent\nin the database. If set to `present`, the object will be created if\nit does not exist. If set to `absent`, the extension/schema will be\nremoved if it exists.",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the object (extension, schema, FDW, server)",
|
||||
"type": "string"
|
||||
},
|
||||
"owner": {
|
||||
"description": "The role name of the user who owns the schema inside PostgreSQL.\nIt maps to the `AUTHORIZATION` parameter of `CREATE SCHEMA` and the\n`OWNER TO` command of `ALTER SCHEMA`.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"servers": {
|
||||
"description": "The list of foreign servers to be managed in the database",
|
||||
"items": {
|
||||
"description": "ServerSpec configures a server of a foreign data wrapper",
|
||||
"properties": {
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Specifies whether an object (e.g schema) should be present or absent\nin the database. If set to `present`, the object will be created if\nit does not exist. If set to `absent`, the extension/schema will be\nremoved if it exists.",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"fdw": {
|
||||
"description": "The name of the Foreign Data Wrapper (FDW)",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "fdw is required",
|
||||
"rule": "self != ''"
|
||||
}
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the object (extension, schema, FDW, server)",
|
||||
"type": "string"
|
||||
},
|
||||
"options": {
|
||||
"description": "Options specifies the configuration options for the server\n(key is the option name, value is the option value).",
|
||||
"items": {
|
||||
"description": "OptionSpec holds the name, value and the ensure field for an option",
|
||||
"properties": {
|
||||
"ensure": {
|
||||
"default": "present",
|
||||
"description": "Specifies whether an option should be present or absent in\nthe database. If set to `present`, the option will be\ncreated if it does not exist. If set to `absent`, the\noption will be removed if it exists.",
|
||||
"enum": [
|
||||
"present",
|
||||
"absent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the option",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the option",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"usage": {
|
||||
"description": "List of roles for which `USAGE` privileges on the server are granted or revoked.",
|
||||
"items": {
|
||||
"description": "UsageSpec configures a usage for a foreign data wrapper",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the usage",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "name is required",
|
||||
"rule": "self != ''"
|
||||
}
|
||||
]
|
||||
},
|
||||
"type": {
|
||||
"default": "grant",
|
||||
"description": "The type of usage",
|
||||
"enum": [
|
||||
"grant",
|
||||
"revoke"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"fdw",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"tablespace": {
|
||||
"description": "Maps to the `TABLESPACE` parameter of `CREATE DATABASE`.\nMaps to the `SET TABLESPACE` command of `ALTER DATABASE`.\nThe name of the tablespace (in PostgreSQL) that will be associated\nwith the new database. This tablespace will be the default\ntablespace used for objects created in this database.",
|
||||
"type": "string"
|
||||
},
|
||||
"template": {
|
||||
"description": "Maps to the `TEMPLATE` parameter of `CREATE DATABASE`. This setting\ncannot be changed. The name of the template from which to create\nthis database.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "template is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"cluster",
|
||||
"name",
|
||||
"owner"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "builtinLocale is only available when localeProvider is set to `builtin`",
|
||||
"rule": "!has(self.builtinLocale) || self.localeProvider == 'builtin'"
|
||||
},
|
||||
{
|
||||
"message": "icuLocale is only available when localeProvider is set to `icu`",
|
||||
"rule": "!has(self.icuLocale) || self.localeProvider == 'icu'"
|
||||
},
|
||||
{
|
||||
"message": "icuRules is only available when localeProvider is set to `icu`",
|
||||
"rule": "!has(self.icuRules) || self.localeProvider == 'icu'"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Most recently observed status of the Database. This data may not be up to\ndate. Populated by the system. Read-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"applied": {
|
||||
"description": "Applied is true if the database was reconciled correctly",
|
||||
"type": "boolean"
|
||||
},
|
||||
"extensions": {
|
||||
"description": "Extensions is the status of the managed extensions",
|
||||
"items": {
|
||||
"description": "DatabaseObjectStatus is the status of the managed database objects",
|
||||
"properties": {
|
||||
"applied": {
|
||||
"description": "True of the object has been installed successfully in\nthe database",
|
||||
"type": "boolean"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the object reconciliation message",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the object",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"applied",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"fdws": {
|
||||
"description": "FDWs is the status of the managed FDWs",
|
||||
"items": {
|
||||
"description": "DatabaseObjectStatus is the status of the managed database objects",
|
||||
"properties": {
|
||||
"applied": {
|
||||
"description": "True of the object has been installed successfully in\nthe database",
|
||||
"type": "boolean"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the object reconciliation message",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the object",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"applied",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the reconciliation output message",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "A sequence number representing the latest\ndesired state that was synchronized",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"schemas": {
|
||||
"description": "Schemas is the status of the managed schemas",
|
||||
"items": {
|
||||
"description": "DatabaseObjectStatus is the status of the managed database objects",
|
||||
"properties": {
|
||||
"applied": {
|
||||
"description": "True of the object has been installed successfully in\nthe database",
|
||||
"type": "boolean"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the object reconciliation message",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the object",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"applied",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"servers": {
|
||||
"description": "Servers is the status of the managed servers",
|
||||
"items": {
|
||||
"description": "DatabaseObjectStatus is the status of the managed database objects",
|
||||
"properties": {
|
||||
"applied": {
|
||||
"description": "True of the object has been installed successfully in\nthe database",
|
||||
"type": "boolean"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the object reconciliation message",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the object",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"applied",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,446 @@
|
||||
{
|
||||
"description": "Engine is where Longhorn stores engine object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "EngineSpec defines the desired state of the Longhorn engine",
|
||||
"properties": {
|
||||
"active": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"backupVolume": {
|
||||
"type": "string"
|
||||
},
|
||||
"dataEngine": {
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"desireState": {
|
||||
"type": "string"
|
||||
},
|
||||
"disableFrontend": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"frontend": {
|
||||
"enum": [
|
||||
"blockdev",
|
||||
"iscsi",
|
||||
"nvmf",
|
||||
"ublk",
|
||||
""
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"logRequested": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodeID": {
|
||||
"type": "string"
|
||||
},
|
||||
"rebuildConcurrentSyncLimit": {
|
||||
"description": "RebuildConcurrentSyncLimit controls the maximum number of file synchronization operations that can run\nconcurrently during a single replica rebuild.\nIt is determined by the global setting or the volume spec field with the same name.",
|
||||
"maximum": 5,
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"replicaAddressMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"requestedBackupRestore": {
|
||||
"type": "string"
|
||||
},
|
||||
"requestedDataSource": {
|
||||
"type": "string"
|
||||
},
|
||||
"revisionCounterDisabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"salvageRequested": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"snapshotMaxCount": {
|
||||
"type": "integer"
|
||||
},
|
||||
"snapshotMaxSize": {
|
||||
"format": "int64",
|
||||
"type": "string"
|
||||
},
|
||||
"ublkNumberOfQueue": {
|
||||
"description": "ublkNumberOfQueue controls the number of queues for ublk frontend.",
|
||||
"type": "integer"
|
||||
},
|
||||
"ublkQueueDepth": {
|
||||
"description": "ublkQueueDepth controls the depth of each queue for ublk frontend.",
|
||||
"type": "integer"
|
||||
},
|
||||
"unmapMarkSnapChainRemovedEnabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"upgradedReplicaAddressMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"volumeName": {
|
||||
"type": "string"
|
||||
},
|
||||
"volumeSize": {
|
||||
"format": "int64",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "EngineStatus defines the observed state of the Longhorn engine",
|
||||
"properties": {
|
||||
"backupStatus": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"backupURL": {
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"replicaAddress": {
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotName": {
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"cloneStatus": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"error": {
|
||||
"type": "string"
|
||||
},
|
||||
"fromReplicaAddress": {
|
||||
"type": "string"
|
||||
},
|
||||
"isCloning": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"snapshotName": {
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"conditions": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"lastProbeTime": {
|
||||
"description": "Last time we probed the condition.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastTransitionTime": {
|
||||
"description": "Last time the condition transitioned from one status to another.",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Human-readable message indicating details about last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Unique, one-word, CamelCase reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the condition.\nCan be True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of the condition.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "array"
|
||||
},
|
||||
"currentImage": {
|
||||
"type": "string"
|
||||
},
|
||||
"currentReplicaAddressMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"currentSize": {
|
||||
"format": "int64",
|
||||
"type": "string"
|
||||
},
|
||||
"currentState": {
|
||||
"type": "string"
|
||||
},
|
||||
"endpoint": {
|
||||
"type": "string"
|
||||
},
|
||||
"instanceManagerName": {
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"type": "string"
|
||||
},
|
||||
"isExpanding": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"lastExpansionError": {
|
||||
"type": "string"
|
||||
},
|
||||
"lastExpansionFailedAt": {
|
||||
"type": "string"
|
||||
},
|
||||
"lastRestoredBackup": {
|
||||
"type": "string"
|
||||
},
|
||||
"logFetched": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"purgeStatus": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"error": {
|
||||
"type": "string"
|
||||
},
|
||||
"isPurging": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"rebuildConcurrentSyncLimit": {
|
||||
"description": "RebuildConcurrentSyncLimit controls the maximum number of file synchronization operations that can run\nconcurrently during a single replica rebuild.\nIt is determined by the global setting or the volume spec field with the same name.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"rebuildStatus": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"appliedRebuildingMBps": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"error": {
|
||||
"type": "string"
|
||||
},
|
||||
"fromReplicaAddress": {
|
||||
"description": "Deprecated. We are now using FromReplicaAddressList to list all source replicas.",
|
||||
"type": "string"
|
||||
},
|
||||
"fromReplicaAddressList": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"isRebuilding": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"replicaModeMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"replicaTransitionTimeMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ReplicaTransitionTimeMap records the time a replica in ReplicaModeMap transitions from one mode to another (or\nfrom not being in the ReplicaModeMap to being in it). This information is sometimes required by other controllers\n(e.g. the volume controller uses it to determine the correct value for replica.Spec.lastHealthyAt).",
|
||||
"type": "object"
|
||||
},
|
||||
"restoreStatus": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"backupURL": {
|
||||
"type": "string"
|
||||
},
|
||||
"currentRestoringBackup": {
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"type": "string"
|
||||
},
|
||||
"filename": {
|
||||
"type": "string"
|
||||
},
|
||||
"isRestoring": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"lastRestored": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"salvageExecuted": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"snapshotMaxCount": {
|
||||
"type": "integer"
|
||||
},
|
||||
"snapshotMaxSize": {
|
||||
"format": "int64",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshots": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"children": {
|
||||
"additionalProperties": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"created": {
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"parent": {
|
||||
"type": "string"
|
||||
},
|
||||
"removed": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"size": {
|
||||
"type": "string"
|
||||
},
|
||||
"usercreated": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"snapshotsError": {
|
||||
"type": "string"
|
||||
},
|
||||
"started": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"starting": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"storageIP": {
|
||||
"type": "string"
|
||||
},
|
||||
"ublkID": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"unmapMarkSnapChainRemovedEnabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
{
|
||||
"description": "EngineImage is where Longhorn stores engine image object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "EngineImageSpec defines the desired state of the Longhorn engine image",
|
||||
"properties": {
|
||||
"image": {
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "EngineImageStatus defines the observed state of the Longhorn engine image",
|
||||
"properties": {
|
||||
"buildDate": {
|
||||
"type": "string"
|
||||
},
|
||||
"cliAPIMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"cliAPIVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"conditions": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"lastProbeTime": {
|
||||
"description": "Last time we probed the condition.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastTransitionTime": {
|
||||
"description": "Last time the condition transitioned from one status to another.",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Human-readable message indicating details about last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Unique, one-word, CamelCase reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the condition.\nCan be True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of the condition.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "array"
|
||||
},
|
||||
"controllerAPIMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"controllerAPIVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"dataFormatMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"dataFormatVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"gitCommit": {
|
||||
"type": "string"
|
||||
},
|
||||
"incompatible": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"noRefSince": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeDeploymentMap": {
|
||||
"additionalProperties": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"refCount": {
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
{
|
||||
"description": "FailoverQuorum contains the information about the current failover\nquorum status of a PG cluster. It is updated by the instance manager\nof the primary node and reset to zero by the operator to trigger\nan update.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"status": {
|
||||
"description": "Most recently observed status of the failover quorum.",
|
||||
"properties": {
|
||||
"method": {
|
||||
"description": "Contains the latest reported Method value.",
|
||||
"type": "string"
|
||||
},
|
||||
"primary": {
|
||||
"description": "Primary is the name of the primary instance that updated\nthis object the latest time.",
|
||||
"type": "string"
|
||||
},
|
||||
"standbyNames": {
|
||||
"description": "StandbyNames is the list of potentially synchronous\ninstance names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"standbyNumber": {
|
||||
"description": "StandbyNumber is the number of synchronous standbys that transactions\nneed to wait for replies from.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
{
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"icon": {
|
||||
"type": "string"
|
||||
},
|
||||
"instance": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"networkRestricted": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"properties": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"url": {
|
||||
"type": "string"
|
||||
},
|
||||
"urlFrom": {
|
||||
"properties": {
|
||||
"httpRouteRef": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ingressRef": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ingressRouteRef": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"routeRef": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"group",
|
||||
"icon"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1,196 @@
|
||||
{
|
||||
"description": "GatewayClass describes a class of Gateways available to the user for creating\nGateway resources.\n\nIt is recommended that this resource be used as a template for Gateways. This\nmeans that a Gateway is based on the state of the GatewayClass at the time it\nwas created and changes to the GatewayClass or associated parameters are not\npropagated down to existing Gateways. This recommendation is intended to\nlimit the blast radius of changes to GatewayClass or associated parameters.\nIf implementations choose to propagate GatewayClass changes to existing\nGateways, that MUST be clearly documented by the implementation.\n\nWhenever one or more Gateways are using a GatewayClass, implementations SHOULD\nadd the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the\nassociated GatewayClass. This ensures that a GatewayClass associated with a\nGateway is not deleted while in use.\n\nGatewayClass is a Cluster level resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired state of GatewayClass.",
|
||||
"properties": {
|
||||
"controllerName": {
|
||||
"description": "ControllerName is the name of the controller that is managing Gateways of\nthis class. The value of this field MUST be a domain prefixed path.\n\nExample: \"example.net/gateway-controller\".\n\nThis field is not mutable and cannot be empty.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "Value is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description": "Description helps describe a GatewayClass with more details.",
|
||||
"maxLength": 64,
|
||||
"type": "string"
|
||||
},
|
||||
"parametersRef": {
|
||||
"description": "ParametersRef is a reference to a resource that contains the configuration\nparameters corresponding to the GatewayClass. This is optional if the\ncontroller does not require any additional configuration.\n\nParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,\nor an implementation-specific custom resource. The resource can be\ncluster-scoped or namespace-scoped.\n\nIf the referent cannot be found, refers to an unsupported kind, or when\nthe data within that resource is malformed, the GatewayClass SHOULD be\nrejected with the \"Accepted\" status condition set to \"False\" and an\n\"InvalidParameters\" reason.\n\nA Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,\nthe merging behavior is implementation specific.\nIt is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\nSupport: Implementation-specific",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the referent.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the referent.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the referent.\nThis field is required when referring to a Namespace-scoped resource and\nMUST be unset when referring to a Cluster-scoped resource.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"controllerName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"default": {
|
||||
"conditions": [
|
||||
{
|
||||
"lastTransitionTime": "1970-01-01T00:00:00Z",
|
||||
"message": "Waiting for controller",
|
||||
"reason": "Pending",
|
||||
"status": "Unknown",
|
||||
"type": "Accepted"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Status defines the current state of GatewayClass.\n\nImplementations MUST populate status on all GatewayClass resources which\nspecify their controller name.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"default": [
|
||||
{
|
||||
"lastTransitionTime": "1970-01-01T00:00:00Z",
|
||||
"message": "Waiting for controller",
|
||||
"reason": "Pending",
|
||||
"status": "Unknown",
|
||||
"type": "Accepted"
|
||||
}
|
||||
],
|
||||
"description": "Conditions is the current status from the controller for\nthis GatewayClass.\n\nControllers should prefer to publish conditions using values\nof GatewayClassConditionType for the type of each Condition.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"supportedFeatures": {
|
||||
"description": "SupportedFeatures is the set of features the GatewayClass support.\nIt MUST be sorted in ascending alphabetical order by the Name key.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "FeatureName is used to describe distinct features that are covered by\nconformance tests.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 64,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,196 @@
|
||||
{
|
||||
"description": "GatewayClass describes a class of Gateways available to the user for creating\nGateway resources.\n\nIt is recommended that this resource be used as a template for Gateways. This\nmeans that a Gateway is based on the state of the GatewayClass at the time it\nwas created and changes to the GatewayClass or associated parameters are not\npropagated down to existing Gateways. This recommendation is intended to\nlimit the blast radius of changes to GatewayClass or associated parameters.\nIf implementations choose to propagate GatewayClass changes to existing\nGateways, that MUST be clearly documented by the implementation.\n\nWhenever one or more Gateways are using a GatewayClass, implementations SHOULD\nadd the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the\nassociated GatewayClass. This ensures that a GatewayClass associated with a\nGateway is not deleted while in use.\n\nGatewayClass is a Cluster level resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired state of GatewayClass.",
|
||||
"properties": {
|
||||
"controllerName": {
|
||||
"description": "ControllerName is the name of the controller that is managing Gateways of\nthis class. The value of this field MUST be a domain prefixed path.\n\nExample: \"example.net/gateway-controller\".\n\nThis field is not mutable and cannot be empty.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "Value is immutable",
|
||||
"rule": "self == oldSelf"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description": "Description helps describe a GatewayClass with more details.",
|
||||
"maxLength": 64,
|
||||
"type": "string"
|
||||
},
|
||||
"parametersRef": {
|
||||
"description": "ParametersRef is a reference to a resource that contains the configuration\nparameters corresponding to the GatewayClass. This is optional if the\ncontroller does not require any additional configuration.\n\nParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,\nor an implementation-specific custom resource. The resource can be\ncluster-scoped or namespace-scoped.\n\nIf the referent cannot be found, refers to an unsupported kind, or when\nthe data within that resource is malformed, the GatewayClass SHOULD be\nrejected with the \"Accepted\" status condition set to \"False\" and an\n\"InvalidParameters\" reason.\n\nA Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,\nthe merging behavior is implementation specific.\nIt is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\nSupport: Implementation-specific",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the referent.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the referent.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the referent.\nThis field is required when referring to a Namespace-scoped resource and\nMUST be unset when referring to a Cluster-scoped resource.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"controllerName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"default": {
|
||||
"conditions": [
|
||||
{
|
||||
"lastTransitionTime": "1970-01-01T00:00:00Z",
|
||||
"message": "Waiting for controller",
|
||||
"reason": "Pending",
|
||||
"status": "Unknown",
|
||||
"type": "Accepted"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Status defines the current state of GatewayClass.\n\nImplementations MUST populate status on all GatewayClass resources which\nspecify their controller name.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"default": [
|
||||
{
|
||||
"lastTransitionTime": "1970-01-01T00:00:00Z",
|
||||
"message": "Waiting for controller",
|
||||
"reason": "Pending",
|
||||
"status": "Unknown",
|
||||
"type": "Accepted"
|
||||
}
|
||||
],
|
||||
"description": "Conditions is the current status from the controller for\nthis GatewayClass.\n\nControllers should prefer to publish conditions using values\nof GatewayClassConditionType for the type of each Condition.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"supportedFeatures": {
|
||||
"description": "SupportedFeatures is the set of features the GatewayClass support.\nIt MUST be sorted in ascending alphabetical order by the Name key.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "FeatureName is used to describe distinct features that are covered by\nconformance tests.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 64,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,302 @@
|
||||
{
|
||||
"description": "HTTPScaledObject is the Schema for the httpscaledobjects API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "HTTPScaledObjectSpec defines the desired state of HTTPScaledObject",
|
||||
"properties": {
|
||||
"coldStartTimeoutFailoverRef": {
|
||||
"description": "(optional) The name of the failover service to route HTTP requests to when the target is not available",
|
||||
"properties": {
|
||||
"port": {
|
||||
"description": "The port to route to",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"portName": {
|
||||
"description": "The port to route to referenced by name",
|
||||
"type": "string"
|
||||
},
|
||||
"service": {
|
||||
"description": "The name of the service to route to",
|
||||
"type": "string"
|
||||
},
|
||||
"timeoutSeconds": {
|
||||
"default": 30,
|
||||
"description": "The timeout in seconds to wait before routing to the failover service (Default 30)",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"service"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must define either the 'portName' or the 'port'",
|
||||
"rule": "has(self.portName) != has(self.port)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"headers": {
|
||||
"description": "The custom headers used to route. Once Hosts and PathPrefixes have been matched,\nit will look for requests which have headers that match all the headers defined\nin .spec.headers, it will be routed to the Service and Port specified in\nthe scaleTargetRef. Interceptor will take precedence for most specific header match.\nIf the headers can't be matched, then use first one without .spec.headers supplied\nIf that doesn't exist then routing will fail.",
|
||||
"items": {
|
||||
"description": "Header contains the definition for matching on header name and/or value",
|
||||
"properties": {
|
||||
"name": {
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"hosts": {
|
||||
"description": "The hosts to route. All requests which the \"Host\" header\nmatches any .spec.hosts (and the Request Target matches any\n.spec.pathPrefixes) will be routed to the Service and Port specified in\nthe scaleTargetRef.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"initialCooldownPeriod": {
|
||||
"description": "(optional) Initial period before scaling",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"pathPrefixes": {
|
||||
"description": "The paths to route. All requests which the Request Target matches any\n.spec.pathPrefixes (and the \"Host\" header matches any .spec.hosts)\nwill be routed to the Service and Port specified in\nthe scaleTargetRef.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"replicas": {
|
||||
"description": "(optional) Replica information",
|
||||
"properties": {
|
||||
"max": {
|
||||
"description": "Maximum amount of replicas to have in the deployment (Default 100)",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"min": {
|
||||
"description": "Minimum amount of replicas to have in the deployment (Default 0)",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"scaleTargetRef": {
|
||||
"description": "The name of the deployment to route HTTP requests to (and to autoscale).\nIncluding validation as a requirement to define either the PortName or the Port",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "The port to route to",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"portName": {
|
||||
"description": "The port to route to referenced by name",
|
||||
"type": "string"
|
||||
},
|
||||
"service": {
|
||||
"description": "The name of the service to route to",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"service"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must define either the 'portName' or the 'port'",
|
||||
"rule": "has(self.portName) != has(self.port)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"scaledownPeriod": {
|
||||
"description": "(optional) Cooldown period value",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"scalingMetric": {
|
||||
"description": "(optional) Configuration for the metric used for scaling",
|
||||
"properties": {
|
||||
"concurrency": {
|
||||
"description": "Scaling based on concurrent requests for a given target",
|
||||
"properties": {
|
||||
"targetValue": {
|
||||
"default": 100,
|
||||
"description": "Target value for rate scaling",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requestRate": {
|
||||
"description": "Scaling based the average rate during an specific time window for a given target",
|
||||
"properties": {
|
||||
"granularity": {
|
||||
"default": "1s",
|
||||
"description": "Time granularity for rate calculation",
|
||||
"type": "string"
|
||||
},
|
||||
"targetValue": {
|
||||
"default": 100,
|
||||
"description": "Target value for rate scaling",
|
||||
"type": "integer"
|
||||
},
|
||||
"window": {
|
||||
"default": "1m",
|
||||
"description": "Time window for rate calculation",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"targetPendingRequests": {
|
||||
"description": "(optional) DEPRECATED (use ScalingMetric instead) Target metric value",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"timeouts": {
|
||||
"description": "(optional) Timeouts that override the global ones",
|
||||
"properties": {
|
||||
"conditionWait": {
|
||||
"description": "How long to wait for the backing workload to have 1 or more replicas before connecting and sending the HTTP request (Default is set by the KEDA_CONDITION_WAIT_TIMEOUT environment variable)",
|
||||
"type": "string"
|
||||
},
|
||||
"responseHeader": {
|
||||
"description": "How long to wait between when the HTTP request is sent to the backing app and when response headers need to arrive (Default is set by the KEDA_RESPONSE_HEADER_TIMEOUT environment variable)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"scaleTargetRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "HTTPScaledObjectStatus defines the observed state of HTTPScaledObject",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions of the HTTPScaledObject.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"targetService": {
|
||||
"description": "TargetService reflects details about the scaled service.",
|
||||
"type": "string"
|
||||
},
|
||||
"targetWorkload": {
|
||||
"description": "TargetWorkload reflects details about the scaled workload.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
{
|
||||
"description": "ImageCatalog is the Schema for the imagecatalogs API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired behavior of the ImageCatalog.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"images": {
|
||||
"description": "List of CatalogImages available in the catalog",
|
||||
"items": {
|
||||
"description": "CatalogImage defines the image and major version",
|
||||
"properties": {
|
||||
"image": {
|
||||
"description": "The image reference",
|
||||
"type": "string"
|
||||
},
|
||||
"major": {
|
||||
"description": "The PostgreSQL major version of the image. Must be unique within the catalog.",
|
||||
"minimum": 10,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image",
|
||||
"major"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "Images must have unique major versions",
|
||||
"rule": "self.all(e, self.filter(f, f.major==e.major).size() == 1)"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"images"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
{
|
||||
"description": "ImageSetMirror is the Schema for the imagesetmirrors API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "ImageSetMirrorSpec defines the desired state of ImageSetMirror.",
|
||||
"properties": {
|
||||
"cleanup": {
|
||||
"description": "Cleanup defines a cleanup strategy",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"retention": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"imageFilter": {
|
||||
"description": "ImageFilterDefinition is the definition of an image filter",
|
||||
"properties": {
|
||||
"exclude": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"include": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"mirrors": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"cleanup": {
|
||||
"description": "Cleanup defines a cleanup strategy",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"retention": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"credentialSecret": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace where the secret is located.\nThis value is ignored for namespaced resources and the namespace of the parent object is used instead.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority controls the ordering of this mirror in comparaison to similar alternatives (mirrors with same parent priority) when re-routing images.\n0 means no specific ordering (YAML declaration order is preserved).\nPositive values are sorted ascending: lower value = higher priority.",
|
||||
"type": "integer"
|
||||
},
|
||||
"registry": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority controls the ordering of alternatives from this CR relative to the original image and other CRs.\nNegative values place alternatives before the original image; positive values place them after.\nDefault is 0 (original image first, then alternatives in default type order).",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "ImageSetMirrorStatus defines the observed state of ImageSetMirror.",
|
||||
"properties": {
|
||||
"matchingImages": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"mirrors": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"lastError": {
|
||||
"type": "string"
|
||||
},
|
||||
"mirroredAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"image"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"unusedSince": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"image"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,458 @@
|
||||
{
|
||||
"description": "IngressRoute is the CRD implementation of a Traefik HTTP Router.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "IngressRouteSpec defines the desired state of IngressRoute.",
|
||||
"properties": {
|
||||
"entryPoints": {
|
||||
"description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"parentRefs": {
|
||||
"description": "ParentRefs defines references to parent IngressRoute resources for multi-layer routing.\nWhen set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.\nMore info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs",
|
||||
"items": {
|
||||
"description": "IngressRouteRef is a reference to an IngressRoute resource.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced IngressRoute resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced IngressRoute resource.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"routes": {
|
||||
"description": "Routes defines the list of routes.",
|
||||
"items": {
|
||||
"description": "Route holds the HTTP route configuration.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind defines the kind of the route.\nRule is the only supported kind.\nIf not defined, defaults to Rule.",
|
||||
"enum": [
|
||||
"Rule"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"match": {
|
||||
"description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/",
|
||||
"type": "string"
|
||||
},
|
||||
"middlewares": {
|
||||
"description": "Middlewares defines the list of references to Middleware resources.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/",
|
||||
"items": {
|
||||
"description": "MiddlewareRef is a reference to a Middleware resource.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Middleware resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Middleware resource.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"observability": {
|
||||
"description": "Observability defines the observability configuration for a router.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/",
|
||||
"properties": {
|
||||
"accessLogs": {
|
||||
"description": "AccessLogs enables access logs for this router.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"metrics": {
|
||||
"description": "Metrics enables metrics for this router.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"traceVerbosity": {
|
||||
"default": "minimal",
|
||||
"description": "TraceVerbosity defines the verbosity level of the tracing for this router.",
|
||||
"enum": [
|
||||
"minimal",
|
||||
"detailed"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"tracing": {
|
||||
"description": "Tracing enables tracing for this router.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority",
|
||||
"maximum": 9223372036854775000,
|
||||
"type": "integer"
|
||||
},
|
||||
"services": {
|
||||
"description": "Services defines the list of Service.\nIt can contain any combination of TraefikService and/or reference to a Kubernetes Service.",
|
||||
"items": {
|
||||
"description": "Service defines an upstream HTTP service to proxy traffic to.",
|
||||
"properties": {
|
||||
"healthCheck": {
|
||||
"description": "Healthcheck defines health checks for ExternalName services.",
|
||||
"properties": {
|
||||
"followRedirects": {
|
||||
"description": "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true",
|
||||
"type": "boolean"
|
||||
},
|
||||
"headers": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Headers defines custom headers to be sent to the health check endpoint.",
|
||||
"type": "object"
|
||||
},
|
||||
"hostname": {
|
||||
"description": "Hostname defines the value of hostname in the Host header of the health check request.",
|
||||
"type": "string"
|
||||
},
|
||||
"interval": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "Interval defines the frequency of the health check calls for healthy targets.\nDefault: 30s",
|
||||
"x-kubernetes-int-or-string": true
|
||||
},
|
||||
"method": {
|
||||
"description": "Method defines the healthcheck method.",
|
||||
"type": "string"
|
||||
},
|
||||
"mode": {
|
||||
"description": "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http",
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path defines the server URL path for the health check endpoint.",
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "Port defines the server URL port for the health check endpoint.",
|
||||
"type": "integer"
|
||||
},
|
||||
"scheme": {
|
||||
"description": "Scheme replaces the server URL scheme for the health check endpoint.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status defines the expected HTTP status code of the response to the health check request.",
|
||||
"type": "integer"
|
||||
},
|
||||
"timeout": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s",
|
||||
"x-kubernetes-int-or-string": true
|
||||
},
|
||||
"unhealthyInterval": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.\nWhen UnhealthyInterval is not defined, it defaults to the Interval value.\nDefault: 30s",
|
||||
"x-kubernetes-int-or-string": true
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind defines the kind of the Service.",
|
||||
"enum": [
|
||||
"Service",
|
||||
"TraefikService"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.",
|
||||
"type": "string"
|
||||
},
|
||||
"nativeLB": {
|
||||
"description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodePortLB": {
|
||||
"description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"passHostHeader": {
|
||||
"description": "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"passiveHealthCheck": {
|
||||
"description": "PassiveHealthCheck defines passive health checks for ExternalName services.",
|
||||
"properties": {
|
||||
"failureWindow": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.",
|
||||
"x-kubernetes-int-or-string": true
|
||||
},
|
||||
"maxFailedAttempts": {
|
||||
"description": "MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"port": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.",
|
||||
"x-kubernetes-int-or-string": true
|
||||
},
|
||||
"responseForwarding": {
|
||||
"description": "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.",
|
||||
"properties": {
|
||||
"flushInterval": {
|
||||
"description": "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"scheme": {
|
||||
"description": "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.",
|
||||
"type": "string"
|
||||
},
|
||||
"serversTransport": {
|
||||
"description": "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.",
|
||||
"type": "string"
|
||||
},
|
||||
"sticky": {
|
||||
"description": "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie defines the sticky cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"description": "Domain defines the host to which the cookie will be sent.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value",
|
||||
"type": "string"
|
||||
},
|
||||
"httpOnly": {
|
||||
"description": "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"maxAge": {
|
||||
"description": "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.",
|
||||
"type": "integer"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name defines the Cookie name.",
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value",
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"description": "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite",
|
||||
"enum": [
|
||||
"none",
|
||||
"lax",
|
||||
"strict"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"description": "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"strategy": {
|
||||
"description": "Strategy defines the load balancing strategy between the servers.\nSupported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).\nRoundRobin value is deprecated and supported for backward compatibility.",
|
||||
"enum": [
|
||||
"wrr",
|
||||
"p2c",
|
||||
"hrw",
|
||||
"leasttime",
|
||||
"RoundRobin"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"weight": {
|
||||
"description": "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syntax": {
|
||||
"description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"match"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS defines the TLS configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls",
|
||||
"properties": {
|
||||
"certResolver": {
|
||||
"description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/",
|
||||
"type": "string"
|
||||
},
|
||||
"domains": {
|
||||
"description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains",
|
||||
"items": {
|
||||
"description": "Domain holds a domain name with SANs.",
|
||||
"properties": {
|
||||
"main": {
|
||||
"description": "Main defines the main domain name.",
|
||||
"type": "string"
|
||||
},
|
||||
"sans": {
|
||||
"description": "SANs defines the subject alternative domain names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"options": {
|
||||
"description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secretName": {
|
||||
"description": "SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.",
|
||||
"type": "string"
|
||||
},
|
||||
"store": {
|
||||
"description": "Store defines the reference to the TLSStore, that will be used to store certificates.\nPlease note that only `default` TLSStore can be used.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"routes"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,241 @@
|
||||
{
|
||||
"description": "IngressRouteTCP is the CRD implementation of a Traefik TCP Router.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "IngressRouteTCPSpec defines the desired state of IngressRouteTCP.",
|
||||
"properties": {
|
||||
"entryPoints": {
|
||||
"description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"routes": {
|
||||
"description": "Routes defines the list of routes.",
|
||||
"items": {
|
||||
"description": "RouteTCP holds the TCP route configuration.",
|
||||
"properties": {
|
||||
"match": {
|
||||
"description": "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/",
|
||||
"type": "string"
|
||||
},
|
||||
"middlewares": {
|
||||
"description": "Middlewares defines the list of references to MiddlewareTCP resources.",
|
||||
"items": {
|
||||
"description": "ObjectReference is a generic reference to a Traefik resource.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Traefik resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Traefik resource.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"priority": {
|
||||
"description": "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority",
|
||||
"maximum": 9223372036854775000,
|
||||
"type": "integer"
|
||||
},
|
||||
"services": {
|
||||
"description": "Services defines the list of TCP services.",
|
||||
"items": {
|
||||
"description": "ServiceTCP defines an upstream TCP service to proxy traffic to.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Kubernetes Service.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Kubernetes Service.",
|
||||
"type": "string"
|
||||
},
|
||||
"nativeLB": {
|
||||
"description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodePortLB": {
|
||||
"description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"port": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.",
|
||||
"x-kubernetes-int-or-string": true
|
||||
},
|
||||
"proxyProtocol": {
|
||||
"description": "ProxyProtocol defines the PROXY protocol configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol\n\nDeprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.",
|
||||
"properties": {
|
||||
"version": {
|
||||
"description": "Version defines the PROXY Protocol version to use.",
|
||||
"maximum": 2,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"serversTransport": {
|
||||
"description": "ServersTransport defines the name of ServersTransportTCP resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.",
|
||||
"type": "string"
|
||||
},
|
||||
"terminationDelay": {
|
||||
"description": "TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates\nit has closed the writing capability of its connection, to close the reading capability as well,\nhence fully terminating the connection.\nIt is a duration in milliseconds, defaulting to 100.\nA negative value means an infinite deadline (i.e. the reading capability is never closed).\n\nDeprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead.",
|
||||
"type": "integer"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS determines whether to use TLS when dialing with the backend.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"weight": {
|
||||
"description": "Weight defines the weight used when balancing requests between multiple Kubernetes Service.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"port"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syntax": {
|
||||
"description": "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax\n\nDeprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.",
|
||||
"enum": [
|
||||
"v3",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"match"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS defines the TLS configuration on a layer 4 / TCP Route.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls",
|
||||
"properties": {
|
||||
"certResolver": {
|
||||
"description": "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/",
|
||||
"type": "string"
|
||||
},
|
||||
"domains": {
|
||||
"description": "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains",
|
||||
"items": {
|
||||
"description": "Domain holds a domain name with SANs.",
|
||||
"properties": {
|
||||
"main": {
|
||||
"description": "Main defines the main domain name.",
|
||||
"type": "string"
|
||||
},
|
||||
"sans": {
|
||||
"description": "SANs defines the subject alternative domain names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"options": {
|
||||
"description": "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Traefik resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Traefik resource.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"passthrough": {
|
||||
"description": "Passthrough defines whether a TLS router will terminate the TLS connection.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.",
|
||||
"type": "string"
|
||||
},
|
||||
"store": {
|
||||
"description": "Store defines the reference to the TLSStore, that will be used to store certificates.\nPlease note that only `default` TLSStore can be used.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Traefik resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Traefik resource.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"routes"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
{
|
||||
"description": "IngressRouteUDP is a CRD implementation of a Traefik UDP Router.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.",
|
||||
"properties": {
|
||||
"entryPoints": {
|
||||
"description": "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/\nDefault: all.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"routes": {
|
||||
"description": "Routes defines the list of routes.",
|
||||
"items": {
|
||||
"description": "RouteUDP holds the UDP route configuration.",
|
||||
"properties": {
|
||||
"services": {
|
||||
"description": "Services defines the list of UDP services.",
|
||||
"items": {
|
||||
"description": "ServiceUDP defines an upstream UDP service to proxy traffic to.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name defines the name of the referenced Kubernetes Service.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace defines the namespace of the referenced Kubernetes Service.",
|
||||
"type": "string"
|
||||
},
|
||||
"nativeLB": {
|
||||
"description": "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodePortLB": {
|
||||
"description": "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"port": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "integer"
|
||||
},
|
||||
{
|
||||
"type": "string"
|
||||
}
|
||||
],
|
||||
"description": "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.",
|
||||
"x-kubernetes-int-or-string": true
|
||||
},
|
||||
"weight": {
|
||||
"description": "Weight defines the weight used when balancing requests between multiple Kubernetes Service.",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"port"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"routes"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,331 @@
|
||||
{
|
||||
"description": "InstanceManager is where Longhorn stores instance manager object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "InstanceManagerSpec defines the desired state of the Longhorn instance manager",
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"type": "string"
|
||||
},
|
||||
"dataEngineSpec": {
|
||||
"properties": {
|
||||
"v2": {
|
||||
"properties": {
|
||||
"cpuMask": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeID": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"enum": [
|
||||
"aio",
|
||||
"engine",
|
||||
"replica"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "InstanceManagerStatus defines the observed state of the Longhorn instance manager",
|
||||
"properties": {
|
||||
"apiMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"apiVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"backingImages": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"currentChecksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskUUID": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"conditions": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"lastProbeTime": {
|
||||
"description": "Last time we probed the condition.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastTransitionTime": {
|
||||
"description": "Last time the condition transitioned from one status to another.",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Human-readable message indicating details about last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Unique, one-word, CamelCase reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the condition.\nCan be True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of the condition.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "array"
|
||||
},
|
||||
"currentState": {
|
||||
"type": "string"
|
||||
},
|
||||
"dataEngineStatus": {
|
||||
"properties": {
|
||||
"v2": {
|
||||
"properties": {
|
||||
"cpuMask": {
|
||||
"type": "string"
|
||||
},
|
||||
"interruptModeEnabled": {
|
||||
"description": "InterruptModeEnabled indicates whether the V2 data engine is running in\ninterrupt mode (true) or polling mode (false). Set by Longhorn manager;\nread-only to users.",
|
||||
"enum": [
|
||||
"",
|
||||
"true",
|
||||
"false"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"instanceEngines": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"spec": {
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"additionalProperties": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"endpoint": {
|
||||
"type": "string"
|
||||
},
|
||||
"errorMsg": {
|
||||
"type": "string"
|
||||
},
|
||||
"listen": {
|
||||
"type": "string"
|
||||
},
|
||||
"portEnd": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"portStart": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"resourceVersion": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
},
|
||||
"targetPortEnd": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"targetPortStart": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
},
|
||||
"ublkID": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"instanceReplicas": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"spec": {
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"additionalProperties": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"endpoint": {
|
||||
"type": "string"
|
||||
},
|
||||
"errorMsg": {
|
||||
"type": "string"
|
||||
},
|
||||
"listen": {
|
||||
"type": "string"
|
||||
},
|
||||
"portEnd": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"portStart": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"resourceVersion": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
},
|
||||
"targetPortEnd": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"targetPortStart": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
},
|
||||
"ublkID": {
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ip": {
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"proxyApiMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"proxyApiVersion": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,155 @@
|
||||
{
|
||||
"description": "ManagedApplication represents a managed application.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "ManagedApplicationSpec describes the ManagedApplication.",
|
||||
"properties": {
|
||||
"apiKeys": {
|
||||
"description": "APIKeys references the API keys used to authenticate the application when calling APIs.",
|
||||
"items": {
|
||||
"description": "APIKey describes an API key used to authenticate the application when calling APIs.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"description": "SecretName references the name of the secret containing the API key.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"suspended": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"title": {
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is the API key value.",
|
||||
"maxLength": 4096,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "secretName and value are mutually exclusive",
|
||||
"rule": "[has(self.secretName), has(self.value)].filter(x, x).size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
},
|
||||
"appId": {
|
||||
"description": "AppID is the identifier of the ManagedApplication.\nIt should be unique.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"notes": {
|
||||
"description": "Notes contains notes about application.",
|
||||
"type": "string"
|
||||
},
|
||||
"owner": {
|
||||
"description": "Owner represents the owner of the ManagedApplication.\nIt should be:\n- `sub` when using OIDC\n- `externalID` when using external IDP",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"appId",
|
||||
"owner"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this ManagedApplication.",
|
||||
"properties": {
|
||||
"apiKeyVersions": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the ManagedApplication.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,326 @@
|
||||
{
|
||||
"description": "ManagedSubscription defines a Subscription managed by the API manager as the result of a pre-negotiation with its\nAPI consumers. This subscription grant consuming access to a set of APIs to a set of Applications.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this ManagedSubscription.",
|
||||
"properties": {
|
||||
"apiBundles": {
|
||||
"description": "APIBundles defines a set of APIBundle that will be accessible.\nMultiple ManagedSubscriptions can select the same APIBundles.",
|
||||
"items": {
|
||||
"description": "APIBundleReference references an APIBundle.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIBundle.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apiBundles",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"apiPlan": {
|
||||
"description": "APIPlan defines which APIPlan will be used.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIPlan.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be accessible.\nMultiple ManagedSubscriptions can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be accessible.\nMultiple ManagedSubscriptions can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"applications": {
|
||||
"description": "Applications references the Applications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same AppID.\nDeprecated: Use ManagedApplications instead.",
|
||||
"items": {
|
||||
"description": "ApplicationReference references an Application.",
|
||||
"properties": {
|
||||
"appId": {
|
||||
"description": "AppID is the public identifier of the application.\nIn the case of OIDC, it corresponds to the clientId.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"appId"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
},
|
||||
"claims": {
|
||||
"description": "Claims specifies an expression that validate claims in order to authorize the request.",
|
||||
"type": "string"
|
||||
},
|
||||
"managedApplications": {
|
||||
"description": "ManagedApplications references the ManagedApplications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same ManagedApplication.",
|
||||
"items": {
|
||||
"description": "ManagedApplicationReference references a ManagedApplication.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the ManagedApplication.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated managed applications",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"operationFilter": {
|
||||
"description": "OperationFilter specifies the allowed operations on APIs and APIVersions.\nIf not set, all operations are available.\nAn empty OperationFilter prohibits all operations.",
|
||||
"properties": {
|
||||
"include": {
|
||||
"description": "Include defines the names of OperationSets that will be accessible.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"weight": {
|
||||
"description": "Weight specifies the evaluation order of the APIPlan.\nWhen multiple ManagedSubscriptions targets the same API and Application with different APIPlan,\nthe APIPlan with the highest weight will be enforced. If weights are equal, alphabetical order is used.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"apiPlan"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this ManagedSubscription.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions is the list of status conditions.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the ManagedSubscription.",
|
||||
"type": "string"
|
||||
},
|
||||
"resolvedApis": {
|
||||
"description": "ResolvedAPIs is the list of APIs that were successfully resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"unresolvedApis": {
|
||||
"description": "UnresolvedAPIs is the list of APIs that could not be resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,459 @@
|
||||
{
|
||||
"description": "AccessControlPolicy defines an access control policy.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "AccessControlPolicySpec configures an access control policy.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "AccessControlPolicyAPIKey configure an APIKey control policy.",
|
||||
"properties": {
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.",
|
||||
"type": "object"
|
||||
},
|
||||
"keySource": {
|
||||
"description": "KeySource defines how to extract API keys from requests.",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie is the name of a cookie.",
|
||||
"type": "string"
|
||||
},
|
||||
"header": {
|
||||
"description": "Header is the name of a header.",
|
||||
"type": "string"
|
||||
},
|
||||
"headerAuthScheme": {
|
||||
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
||||
"type": "string"
|
||||
},
|
||||
"query": {
|
||||
"description": "Query is the name of a query parameter.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"keys": {
|
||||
"description": "Keys define the set of authorized keys to access a protected resource.",
|
||||
"items": {
|
||||
"description": "AccessControlPolicyAPIKeyKey defines an API key.",
|
||||
"properties": {
|
||||
"id": {
|
||||
"description": "ID is the unique identifier of the key.",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.",
|
||||
"type": "object"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is the SHAKE-256 hash (using 64 bytes) of the API key.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"id",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"keySource"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"basicAuth": {
|
||||
"description": "AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.",
|
||||
"properties": {
|
||||
"forwardUsernameHeader": {
|
||||
"type": "string"
|
||||
},
|
||||
"realm": {
|
||||
"type": "string"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"users": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"jwt": {
|
||||
"description": "AccessControlPolicyJWT configures a JWT access control policy.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"jwksFile": {
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"publicKey": {
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecret": {
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecretBase64Encoded": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"tokenQueryKey": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oAuthIntro": {
|
||||
"description": "AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientConfig": {
|
||||
"description": "AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.",
|
||||
"properties": {
|
||||
"headers": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Headers to set when sending requests to the Authorization Server.",
|
||||
"type": "object"
|
||||
},
|
||||
"maxRetries": {
|
||||
"default": 3,
|
||||
"description": "MaxRetries defines the number of retries for introspection requests.",
|
||||
"type": "integer"
|
||||
},
|
||||
"timeoutSeconds": {
|
||||
"default": 5,
|
||||
"description": "TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.",
|
||||
"type": "integer"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS configures TLS communication with the Authorization Server.",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"description": "CA sets the CA bundle used to sign the Authorization Server certificate.",
|
||||
"type": "string"
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify skips the Authorization Server certificate validation.\nFor testing purposes only, do not use in production.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tokenTypeHint": {
|
||||
"description": "TokenTypeHint is a hint to pass to the Authorization Server.\nSee https://tools.ietf.org/html/rfc7662#section-2.1 for more information.",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL of the Authorization Server.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"tokenSource": {
|
||||
"description": "TokenSource describes how to extract tokens from HTTP requests.\nIf multiple sources are set, the order is the following: header > query > cookie.",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie is the name of a cookie.",
|
||||
"type": "string"
|
||||
},
|
||||
"header": {
|
||||
"description": "Header is the name of a header.",
|
||||
"type": "string"
|
||||
},
|
||||
"headerAuthScheme": {
|
||||
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
||||
"type": "string"
|
||||
},
|
||||
"query": {
|
||||
"description": "Query is the name of a query parameter.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"clientConfig",
|
||||
"tokenSource"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidc": {
|
||||
"description": "AccessControlPolicyOIDC holds the OIDC authentication configuration.",
|
||||
"properties": {
|
||||
"authParams": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"disableAuthRedirectionPaths": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"issuer": {
|
||||
"type": "string"
|
||||
},
|
||||
"logoutUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"redirectUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secret": {
|
||||
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "name is unique within a namespace to reference a secret resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "namespace defines the space within which the secret name must be unique.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"session": {
|
||||
"description": "Session holds session configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"refresh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"stateCookie": {
|
||||
"description": "StateCookie holds state cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidcGoogle": {
|
||||
"description": "AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.",
|
||||
"properties": {
|
||||
"authParams": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"emails": {
|
||||
"description": "Emails are the allowed emails to connect.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"logoutUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"redirectUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"secret": {
|
||||
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "name is unique within a namespace to reference a secret resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "namespace defines the space within which the secret name must be unique.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"session": {
|
||||
"description": "Session holds session configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"refresh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"stateCookie": {
|
||||
"description": "StateCookie holds state cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this access control policy.",
|
||||
"properties": {
|
||||
"specHash": {
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,487 @@
|
||||
{
|
||||
"description": "AIService is a Kubernetes-like Service to interact with a text-based LLM provider. It defines the parameters and credentials required to interact with various LLM providers.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this AIService.",
|
||||
"properties": {
|
||||
"anthropic": {
|
||||
"description": "Anthropic configures Anthropic backend.",
|
||||
"properties": {
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"azureOpenai": {
|
||||
"description": "AzureOpenAI configures AzureOpenAI.",
|
||||
"properties": {
|
||||
"apiKeySecret": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"deploymentName": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseUrl",
|
||||
"deploymentName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"bedrock": {
|
||||
"description": "Bedrock configures Bedrock backend.",
|
||||
"properties": {
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"region": {
|
||||
"type": "string"
|
||||
},
|
||||
"systemMessage": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"cohere": {
|
||||
"description": "Cohere configures Cohere backend.",
|
||||
"properties": {
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"deepSeek": {
|
||||
"description": "DeepSeek configures DeepSeek.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"gemini": {
|
||||
"description": "Gemini configures Gemini backend.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"mistral": {
|
||||
"description": "Mistral configures Mistral AI backend.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ollama": {
|
||||
"description": "Ollama configures Ollama backend.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseUrl"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"openai": {
|
||||
"description": "OpenAI configures OpenAI.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"qWen": {
|
||||
"description": "QWen configures QWen.",
|
||||
"properties": {
|
||||
"baseUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"type": "string"
|
||||
},
|
||||
"params": {
|
||||
"description": "Params holds the LLM hyperparameters.",
|
||||
"properties": {
|
||||
"frequencyPenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer"
|
||||
},
|
||||
"presencePenalty": {
|
||||
"type": "number"
|
||||
},
|
||||
"temperature": {
|
||||
"type": "number"
|
||||
},
|
||||
"topP": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"token": {
|
||||
"description": "SecretReference references a kubernetes secret.",
|
||||
"properties": {
|
||||
"secretName": {
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,340 @@
|
||||
{
|
||||
"description": "API defines an HTTP interface that is exposed to external clients. It specifies the supported versions\nand provides instructions for accessing its documentation. Once instantiated, an API object is associated\nwith an Ingress, IngressRoute, or HTTPRoute resource, enabling the exposure of the described API to the outside world.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "APISpec describes the API.",
|
||||
"properties": {
|
||||
"cors": {
|
||||
"description": "Cors defines the Cross-Origin Resource Sharing configuration.",
|
||||
"properties": {
|
||||
"addVaryHeader": {
|
||||
"description": "AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowCredentials": {
|
||||
"description": "AllowCredentials defines whether the request can include user credentials.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowHeadersList": {
|
||||
"description": "AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowMethodsList": {
|
||||
"description": "AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginListRegex": {
|
||||
"description": "AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginsList": {
|
||||
"description": "AllowOriginsList is a list of allowable origins. Can also be a wildcard origin \"*\".",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"exposeHeadersList": {
|
||||
"description": "ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"maxAge": {
|
||||
"description": "MaxAge defines the time that a preflight request may be cached.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description explains what the API does.",
|
||||
"type": "string"
|
||||
},
|
||||
"openApiSpec": {
|
||||
"description": "OpenAPISpec defines the API contract as an OpenAPI specification.",
|
||||
"properties": {
|
||||
"operationSets": {
|
||||
"description": "OperationSets defines the sets of operations to be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"items": {
|
||||
"description": "OperationSet gives a name to a set of matching OpenAPI operations.\nThis set of operations can then be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"properties": {
|
||||
"matchers": {
|
||||
"description": "Matchers defines a list of alternative rules for matching OpenAPI operations.",
|
||||
"items": {
|
||||
"description": "OperationMatcher defines criteria for matching an OpenAPI operation.",
|
||||
"minProperties": 1,
|
||||
"properties": {
|
||||
"methods": {
|
||||
"description": "Methods specifies the HTTP methods to be included for selection.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 10,
|
||||
"type": "array"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the exact path of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathPrefix": {
|
||||
"description": "PathPrefix specifies the path prefix of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathRegex": {
|
||||
"description": "PathRegex specifies a regular expression pattern for matching operations based on their paths.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path, pathPrefix and pathRegex are mutually exclusive",
|
||||
"rule": "[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the OperationSet to reference in APICatalogItems or ManagedSubscriptions.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"matchers",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
},
|
||||
"override": {
|
||||
"description": "Override holds data used to override OpenAPI specification.",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"url": {
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"servers"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.\nThe Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.\nIt's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.\nThe Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.\nThe URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validateRequestMethodAndPath": {
|
||||
"description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path or url must be defined",
|
||||
"rule": "has(self.path) || has(self.url)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the human-readable name of the API that will be used on the portal.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"versions": {
|
||||
"description": "Versions are the different APIVersions available.",
|
||||
"items": {
|
||||
"description": "APIVersionRef references an APIVersion.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIVersion.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this API.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the API.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,270 @@
|
||||
{
|
||||
"description": "APIAuth defines the authentication configuration for APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIAuth.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "APIKey configures API key authentication.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"isDefault": {
|
||||
"description": "IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.\nOnly one APIAuth per namespace should have isDefault set to true.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"jwt": {
|
||||
"description": "JWT configures JWT authentication.",
|
||||
"properties": {
|
||||
"appIdClaim": {
|
||||
"description": "AppIDClaim is the name of the claim holding the identifier of the application.\nThis field is sometimes named `client_id`.",
|
||||
"type": "string"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ForwardHeaders specifies additional headers to forward with the request.",
|
||||
"type": "object"
|
||||
},
|
||||
"jwksFile": {
|
||||
"description": "JWKSFile contains the JWKS file content for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSURL, and TrustedIssuers.",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid HTTPS URL",
|
||||
"rule": "isURL(self) && self.startsWith('https://')"
|
||||
}
|
||||
]
|
||||
},
|
||||
"publicKey": {
|
||||
"description": "PublicKey is the PEM-encoded public key for JWT verification.\nMutually exclusive with SigningSecretName, JWKSFile, JWKSURL, and TrustedIssuers.",
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecretName": {
|
||||
"description": "SigningSecretName is the name of the Kubernetes Secret containing the signing secret.\nThe secret must be of type Opaque and contain a key named 'value'.\nMutually exclusive with PublicKey, JWKSFile, JWKSURL, and TrustedIssuers.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"description": "StripAuthorizationHeader determines whether to strip the Authorization header before forwarding the request.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"tokenNameClaim": {
|
||||
"description": "TokenNameClaim is the name of the claim holding the name of the token.\nThis name, if provided, will be used in the metrics.",
|
||||
"type": "string"
|
||||
},
|
||||
"tokenQueryKey": {
|
||||
"description": "TokenQueryKey specifies the query parameter name for the JWT token.",
|
||||
"type": "string"
|
||||
},
|
||||
"trustedIssuers": {
|
||||
"description": "TrustedIssuers defines multiple JWKS providers with optional issuer validation.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and JWKSURL.",
|
||||
"items": {
|
||||
"description": "TrustedIssuer represents a trusted JWT issuer with its associated JWKS endpoint for token verification.",
|
||||
"properties": {
|
||||
"issuer": {
|
||||
"description": "Issuer is the expected value of the \"iss\" claim.\nIf specified, tokens must have this exact issuer to be validated against this JWKS.\nThe issuer value must match exactly, including trailing slashes and URL encoding.\nIf omitted, this JWKS acts as a fallback for any issuer.",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS from.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid HTTPS URL",
|
||||
"rule": "isURL(self) && self.startsWith('https://')"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"jwksUrl"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"appIdClaim"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "exactly one of signingSecretName, publicKey, jwksFile, jwksUrl, or trustedIssuers must be specified",
|
||||
"rule": "[has(self.signingSecretName), has(self.publicKey), has(self.jwksFile), has(self.jwksUrl), has(self.trustedIssuers)].filter(x, x).size() == 1"
|
||||
},
|
||||
{
|
||||
"message": "trustedIssuers must not be empty when specified",
|
||||
"rule": "!has(self.trustedIssuers) || size(self.trustedIssuers) > 0"
|
||||
},
|
||||
{
|
||||
"message": "only one entry in trustedIssuers may omit the issuer field",
|
||||
"rule": "!has(self.trustedIssuers) || self.trustedIssuers.filter(x, !has(x.issuer) || x.issuer == \"\").size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ldap": {
|
||||
"description": "LDAP configures LDAP authentication.",
|
||||
"properties": {
|
||||
"attribute": {
|
||||
"default": "cn",
|
||||
"description": "Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.\nThe bind DN is formed as <Attribute>=<Username>,<BaseDN>.",
|
||||
"type": "string"
|
||||
},
|
||||
"baseDn": {
|
||||
"description": "BaseDN is the base domain name that should be used for bind and search queries.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindDn": {
|
||||
"description": "BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.\nIf empty, an anonymous bind will be done.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindPasswordSecretName": {
|
||||
"description": "BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.\nThe secret must contain a key named 'password'.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"certificateAuthority": {
|
||||
"description": "CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the\nconnection uses TLS but that the certificate was signed by a custom Certificate Authority.",
|
||||
"type": "string"
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify controls whether the server's certificate chain and host name is verified.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"searchFilter": {
|
||||
"description": "SearchFilter is used to filter LDAP search queries.\nExample: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))\n%s can be used as a placeholder for the username.",
|
||||
"type": "string"
|
||||
},
|
||||
"startTls": {
|
||||
"description": "StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid LDAP URL",
|
||||
"rule": "isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseDn",
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"isDefault"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "exactly one authentication method must be specified",
|
||||
"rule": "[has(self.apiKey), has(self.jwt), has(self.ldap)].filter(x, x).size() == 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIAuth.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIAuth.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,212 @@
|
||||
{
|
||||
"description": "APIBundle defines a set of APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIBundle.",
|
||||
"properties": {
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be accessible to the configured audience.\nMultiple APIBundles can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be accessible to the configured audience.\nMultiple APIBundles can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the human-readable name of the APIBundle that will be used on the portal.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIBundle.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions is the list of status conditions.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIBundle.",
|
||||
"type": "string"
|
||||
},
|
||||
"resolvedApis": {
|
||||
"description": "ResolvedAPIs is the list of APIs that were successfully resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"unresolvedApis": {
|
||||
"description": "UnresolvedAPIs is the list of APIs that could not be resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,284 @@
|
||||
{
|
||||
"description": "APICatalogItem defines APIs that will be part of the API catalog on the portal.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APICatalogItem.",
|
||||
"properties": {
|
||||
"apiBundles": {
|
||||
"description": "APIBundles defines a set of APIBundle that will be visible to the configured audience.\nMultiple APICatalogItem can select the same APIBundles.",
|
||||
"items": {
|
||||
"description": "APIBundleReference references an APIBundle.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIBundle.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apiBundles",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"apiPlan": {
|
||||
"description": "APIPlan defines which APIPlan will be available.\nIf multiple APICatalogItem specify the same API with different APIPlan, the API consumer will be able to pick\na plan from this list.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the APIPlan.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be visible to the configured audience.\nMultiple APICatalogItem can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be visible to the configured audience.\nMultiple APICatalogItem can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"everyone": {
|
||||
"description": "Everyone indicates that all users will see these APIs.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups are the consumer groups that will see the APIs.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"operationFilter": {
|
||||
"description": "OperationFilter specifies the visible operations on APIs and APIVersions.\nIf not set, all operations are available.\nAn empty OperationFilter prohibits all operations.",
|
||||
"properties": {
|
||||
"include": {
|
||||
"description": "Include defines the names of OperationSets that will be accessible.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "groups and everyone are mutually exclusive",
|
||||
"rule": "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true"
|
||||
},
|
||||
{
|
||||
"message": "groups is required when everyone is false",
|
||||
"rule": "(has(self.everyone) && self.everyone) || (has(self.groups) && self.groups.size() > 0)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APICatalogItem.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions is the list of status conditions.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APICatalogItem.",
|
||||
"type": "string"
|
||||
},
|
||||
"resolvedApis": {
|
||||
"description": "ResolvedAPIs is the list of APIs that were successfully resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"unresolvedApis": {
|
||||
"description": "UnresolvedAPIs is the list of APIs that could not be resolved.",
|
||||
"items": {
|
||||
"description": "ResolvedAPIReference references a resolved API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,190 @@
|
||||
{
|
||||
"description": "APIPlan defines API Plan policy.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIPlan.",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description describes the plan.",
|
||||
"type": "string"
|
||||
},
|
||||
"quota": {
|
||||
"description": "Quota defines the quota policy.",
|
||||
"properties": {
|
||||
"bucket": {
|
||||
"default": "subscription",
|
||||
"description": "Bucket defines the bucket strategy for the quota.",
|
||||
"enum": [
|
||||
"subscription",
|
||||
"application-api",
|
||||
"application"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"limit": {
|
||||
"description": "Limit is the maximum number of requests per sliding Period.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"period": {
|
||||
"description": "Period is the unit of time for the Limit.",
|
||||
"format": "duration",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be between 1s and 9999h",
|
||||
"rule": "self >= duration('1s') && self <= duration('9999h')"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"limit"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"rateLimit": {
|
||||
"description": "RateLimit defines the rate limit policy.",
|
||||
"properties": {
|
||||
"bucket": {
|
||||
"default": "subscription",
|
||||
"description": "Bucket defines the bucket strategy for the rate limit.",
|
||||
"enum": [
|
||||
"subscription",
|
||||
"application-api",
|
||||
"application"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"limit": {
|
||||
"description": "Limit is the number of requests per Period used to calculate the regeneration rate.\nTraffic will converge to this rate over time by delaying requests when possible, and dropping them when throttling alone is not enough.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"period": {
|
||||
"description": "Period is the time unit used to express the rate.\nCombined with Limit, it defines the rate at which request capacity regenerates (Limit \u00f7 Period).",
|
||||
"format": "duration",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be between 1s and 1h",
|
||||
"rule": "self >= duration('1s') && self <= duration('1h')"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"limit"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the human-readable name of the plan.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"title"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIPlan.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIPlan.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,207 @@
|
||||
{
|
||||
"description": "APIPortal defines a developer portal for accessing the documentation of APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIPortal.",
|
||||
"properties": {
|
||||
"auth": {
|
||||
"description": "Auth references the APIPortalAuth resource for authentication configuration.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the APIPortalAuth resource.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description of the APIPortal.",
|
||||
"type": "string"
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the public facing name of the APIPortal.",
|
||||
"type": "string"
|
||||
},
|
||||
"trustedUrls": {
|
||||
"description": "TrustedURLs are the urls that are trusted by the OAuth 2.0 authorization server.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 1,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URLs",
|
||||
"rule": "self.all(x, isURL(x))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"ui": {
|
||||
"description": "UI holds the UI customization options.",
|
||||
"properties": {
|
||||
"logoUrl": {
|
||||
"description": "LogoURL is the public URL of the logo.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"trustedUrls"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIPortal.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIPortal.",
|
||||
"type": "string"
|
||||
},
|
||||
"oidc": {
|
||||
"description": "OIDC is the OIDC configuration for accessing the exposed APIPortal WebUI.",
|
||||
"properties": {
|
||||
"clientId": {
|
||||
"description": "ClientID is the OIDC ClientID for accessing the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"companyClaim": {
|
||||
"description": "CompanyClaim is the name of the JWT claim containing the user company.",
|
||||
"type": "string"
|
||||
},
|
||||
"emailClaim": {
|
||||
"description": "EmailClaim is the name of the JWT claim containing the user email.",
|
||||
"type": "string"
|
||||
},
|
||||
"firstnameClaim": {
|
||||
"description": "FirstnameClaim is the name of the JWT claim containing the user firstname.",
|
||||
"type": "string"
|
||||
},
|
||||
"generic": {
|
||||
"description": "Generic indicates whether or not the APIPortal authentication relies on Generic OIDC.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"groupsClaim": {
|
||||
"description": "GroupsClaim is the name of the JWT claim containing the user groups.",
|
||||
"type": "string"
|
||||
},
|
||||
"issuer": {
|
||||
"description": "Issuer is the OIDC issuer for accessing the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastnameClaim": {
|
||||
"description": "LastnameClaim is the name of the JWT claim containing the user lastname.",
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is the OIDC scopes for getting user attributes during the authentication to the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "SecretName is the name of the secret containing the OIDC ClientSecret for accessing the exposed APIPortal WebUI.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAttributes": {
|
||||
"description": "SyncedAttributes configure the user attributes to sync.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"userIdClaim": {
|
||||
"description": "UserIDClaim is the name of the JWT claim containing the user ID.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,297 @@
|
||||
{
|
||||
"description": "APIPortalAuth defines the authentication configuration for an APIPortal.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIPortalAuth.",
|
||||
"properties": {
|
||||
"ldap": {
|
||||
"description": "LDAP configures the LDAP authentication.",
|
||||
"properties": {
|
||||
"attribute": {
|
||||
"default": "cn",
|
||||
"description": "Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.\nThe bind DN is formed as <Attribute>=<Username>,<BaseDN>.",
|
||||
"type": "string"
|
||||
},
|
||||
"attributes": {
|
||||
"description": "Attributes configures LDAP attribute mappings for user attributes.",
|
||||
"properties": {
|
||||
"company": {
|
||||
"description": "Company is the LDAP attribute for user company.",
|
||||
"type": "string"
|
||||
},
|
||||
"email": {
|
||||
"description": "Email is the LDAP attribute for user email.",
|
||||
"type": "string"
|
||||
},
|
||||
"firstname": {
|
||||
"description": "Firstname is the LDAP attribute for user first name.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastname": {
|
||||
"description": "Lastname is the LDAP attribute for user last name.",
|
||||
"type": "string"
|
||||
},
|
||||
"userId": {
|
||||
"description": "UserID is the LDAP attribute for user ID mapping.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"baseDn": {
|
||||
"description": "BaseDN is the base domain name that should be used for bind and search queries.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindDn": {
|
||||
"description": "BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.\nIf empty, an anonymous bind will be done.",
|
||||
"type": "string"
|
||||
},
|
||||
"bindPasswordSecretName": {
|
||||
"description": "BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.\nThe secret must contain a key named 'password'.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"certificateAuthority": {
|
||||
"description": "CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the\nconnection uses TLS but that the certificate was signed by a custom Certificate Authority.",
|
||||
"type": "string"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups configures group extraction.",
|
||||
"properties": {
|
||||
"memberOfAttribute": {
|
||||
"default": "memberOf",
|
||||
"description": "MemberOfAttribute is the LDAP attribute containing group memberships (e.g., \"memberOf\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify controls whether the server's certificate chain and host name is verified.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"searchFilter": {
|
||||
"description": "SearchFilter is used to filter LDAP search queries.\nExample: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))\n%s can be used as a placeholder for the username.",
|
||||
"type": "string"
|
||||
},
|
||||
"startTls": {
|
||||
"description": "StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"syncedAttributes": {
|
||||
"description": "SyncedAttributes are the user attributes to synchronize with Hub platform.",
|
||||
"items": {
|
||||
"enum": [
|
||||
"groups",
|
||||
"userId",
|
||||
"firstname",
|
||||
"lastname",
|
||||
"email",
|
||||
"company"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 6,
|
||||
"type": "array"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid LDAP URL",
|
||||
"rule": "isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"baseDn",
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidc": {
|
||||
"description": "OIDC configures the OIDC authentication.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"description": "Claims configures JWT claim mappings for user attributes.",
|
||||
"properties": {
|
||||
"company": {
|
||||
"description": "Company is the JWT claim for user company.",
|
||||
"type": "string"
|
||||
},
|
||||
"email": {
|
||||
"description": "Email is the JWT claim for user email.",
|
||||
"type": "string"
|
||||
},
|
||||
"firstname": {
|
||||
"description": "Firstname is the JWT claim for user first name.",
|
||||
"type": "string"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups is the JWT claim for user groups. This field is required for authorization.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastname": {
|
||||
"description": "Lastname is the JWT claim for user last name.",
|
||||
"type": "string"
|
||||
},
|
||||
"userId": {
|
||||
"description": "UserID is the JWT claim for user ID mapping.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"groups"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"issuerUrl": {
|
||||
"description": "IssuerURL is the OIDC provider issuer URL.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is a list of OAuth2 scopes.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "SecretName is the name of the Kubernetes Secret containing clientId and clientSecret keys.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAttributes": {
|
||||
"description": "SyncedAttributes are the user attributes to synchronize with Hub platform.",
|
||||
"items": {
|
||||
"enum": [
|
||||
"groups",
|
||||
"userId",
|
||||
"firstname",
|
||||
"lastname",
|
||||
"email",
|
||||
"company"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 6,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"claims",
|
||||
"issuerUrl",
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "exactly one of oidc or ldap must be specified",
|
||||
"rule": "[has(self.oidc), has(self.ldap)].filter(x, x).size() == 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIPortalAuth.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIPortalAuth.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,164 @@
|
||||
{
|
||||
"description": "APIRateLimit defines how group of consumers are rate limited on a set of APIs.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIRateLimit.",
|
||||
"properties": {
|
||||
"apiSelector": {
|
||||
"description": "APISelector selects the APIs that will be rate limited.\nMultiple APIRateLimits can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"apis": {
|
||||
"description": "APIs defines a set of APIs that will be rate limited.\nMultiple APIRateLimits can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.",
|
||||
"items": {
|
||||
"description": "APIReference references an API.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the API.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "duplicated apis",
|
||||
"rule": "self.all(x, self.exists_one(y, x.name == y.name))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"everyone": {
|
||||
"description": "Everyone indicates that all users will, by default, be rate limited with this configuration.\nIf an APIRateLimit explicitly target a group, the default rate limit will be ignored.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups are the consumer groups that will be rate limited.\nMultiple APIRateLimits can target the same set of consumer groups, the most restrictive one applies.\nWhen a consumer belongs to multiple groups, the least restrictive APIRateLimit applies.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"limit": {
|
||||
"description": "Limit is the maximum number of token in the bucket.",
|
||||
"type": "integer",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a positive number",
|
||||
"rule": "self >= 0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"period": {
|
||||
"description": "Period is the unit of time for the Limit.",
|
||||
"format": "duration",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be between 1s and 1h",
|
||||
"rule": "self >= duration('1s') && self <= duration('1h')"
|
||||
}
|
||||
]
|
||||
},
|
||||
"strategy": {
|
||||
"description": "Strategy defines how the bucket state will be synchronized between the different Traefik Hub instances.\nIt can be, either \"local\" or \"distributed\".",
|
||||
"enum": [
|
||||
"local",
|
||||
"distributed"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"limit"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "groups and everyone are mutually exclusive",
|
||||
"rule": "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIRateLimit.",
|
||||
"properties": {
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIRateLimit.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,332 @@
|
||||
{
|
||||
"description": "APIVersion defines a version of an API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "The desired behavior of this APIVersion.",
|
||||
"properties": {
|
||||
"cors": {
|
||||
"description": "Cors defines the Cross-Origin Resource Sharing configuration.",
|
||||
"properties": {
|
||||
"addVaryHeader": {
|
||||
"description": "AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowCredentials": {
|
||||
"description": "AllowCredentials defines whether the request can include user credentials.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"allowHeadersList": {
|
||||
"description": "AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowMethodsList": {
|
||||
"description": "AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginListRegex": {
|
||||
"description": "AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"allowOriginsList": {
|
||||
"description": "AllowOriginsList is a list of allowable origins. Can also be a wildcard origin \"*\".",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"exposeHeadersList": {
|
||||
"description": "ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"maxAge": {
|
||||
"description": "MaxAge defines the time that a preflight request may be cached.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description explains what the APIVersion does.",
|
||||
"type": "string"
|
||||
},
|
||||
"openApiSpec": {
|
||||
"description": "OpenAPISpec defines the API contract as an OpenAPI specification.",
|
||||
"properties": {
|
||||
"operationSets": {
|
||||
"description": "OperationSets defines the sets of operations to be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"items": {
|
||||
"description": "OperationSet gives a name to a set of matching OpenAPI operations.\nThis set of operations can then be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.",
|
||||
"properties": {
|
||||
"matchers": {
|
||||
"description": "Matchers defines a list of alternative rules for matching OpenAPI operations.",
|
||||
"items": {
|
||||
"description": "OperationMatcher defines criteria for matching an OpenAPI operation.",
|
||||
"minProperties": 1,
|
||||
"properties": {
|
||||
"methods": {
|
||||
"description": "Methods specifies the HTTP methods to be included for selection.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"maxItems": 10,
|
||||
"type": "array"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the exact path of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathPrefix": {
|
||||
"description": "PathPrefix specifies the path prefix of the operations to select.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pathRegex": {
|
||||
"description": "PathRegex specifies a regular expression pattern for matching operations based on their paths.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path, pathPrefix and pathRegex are mutually exclusive",
|
||||
"rule": "[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the OperationSet to reference in APICatalogItems or ManagedSubscriptions.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"matchers",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"type": "array"
|
||||
},
|
||||
"override": {
|
||||
"description": "Override holds data used to override OpenAPI specification.",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"url": {
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 100,
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"servers"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"path": {
|
||||
"description": "Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.\nThe Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.\nIt's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.\nThe Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"maxLength": 255,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must start with a '/'",
|
||||
"rule": "self.startsWith('/')"
|
||||
},
|
||||
{
|
||||
"message": "cannot contains '../'",
|
||||
"rule": "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.\nThe URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.",
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid URL",
|
||||
"rule": "isURL(self)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validateRequestMethodAndPath": {
|
||||
"description": "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "path or url must be defined",
|
||||
"rule": "has(self.path) || has(self.url)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"release": {
|
||||
"description": "Release is the version number of the API.\nThis value must follow the SemVer format: https://semver.org/",
|
||||
"maxLength": 100,
|
||||
"type": "string",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must be a valid semver version",
|
||||
"rule": "self.matches(r\"\"\"^v?(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$\"\"\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"description": "Title is the public facing name of the APIVersion.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"release"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this APIVersion.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"hash": {
|
||||
"description": "Hash is a hash representing the APIVersion.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,405 @@
|
||||
{
|
||||
"description": "AppProject provides a logical grouping of applications, providing controls for:\n* where the apps may deploy to (cluster whitelist)\n* what may be deployed (repository whitelist, resource whitelist/blacklist)\n* who can access these applications (roles, OIDC group claims bindings)\n* and what they can do (RBAC policies)\n* automation access to these roles (JWT tokens)",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "AppProjectSpec is the specification of an AppProject",
|
||||
"properties": {
|
||||
"clusterResourceBlacklist": {
|
||||
"description": "ClusterResourceBlacklist contains list of blacklisted cluster level resources",
|
||||
"items": {
|
||||
"description": "ClusterResourceRestrictionItem is a cluster resource that is restricted by the project's whitelist or blacklist",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the restricted resource. Glob patterns using Go's filepath.Match syntax are supported.\nUnlike the group and kind fields, if no name is specified, all resources of the specified group/kind are matched.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"clusterResourceWhitelist": {
|
||||
"description": "ClusterResourceWhitelist contains list of whitelisted cluster level resources",
|
||||
"items": {
|
||||
"description": "ClusterResourceRestrictionItem is a cluster resource that is restricted by the project's whitelist or blacklist",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the restricted resource. Glob patterns using Go's filepath.Match syntax are supported.\nUnlike the group and kind fields, if no name is specified, all resources of the specified group/kind are matched.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"description": {
|
||||
"description": "Description contains optional project description",
|
||||
"maxLength": 255,
|
||||
"type": "string"
|
||||
},
|
||||
"destinationServiceAccounts": {
|
||||
"description": "DestinationServiceAccounts holds information about the service accounts to be impersonated for the application sync operation for each destination.",
|
||||
"items": {
|
||||
"description": "ApplicationDestinationServiceAccount holds information about the service account to be impersonated for the application sync operation.",
|
||||
"properties": {
|
||||
"defaultServiceAccount": {
|
||||
"description": "DefaultServiceAccount to be used for impersonation during the sync operation",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace specifies the target namespace for the application's resources.",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "Server specifies the URL of the target cluster's Kubernetes control plane API.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"defaultServiceAccount",
|
||||
"server"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"destinations": {
|
||||
"description": "Destinations contains list of destinations available for deployment",
|
||||
"items": {
|
||||
"description": "ApplicationDestination holds information about the application's destination",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is an alternate way of specifying the target cluster by its symbolic name. This must be set if Server is not set.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace specifies the target namespace for the application's resources.\nThe namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "Server specifies the URL of the target cluster's Kubernetes control plane API. This must be set if Name is not set.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"namespaceResourceBlacklist": {
|
||||
"description": "NamespaceResourceBlacklist contains list of blacklisted namespace level resources",
|
||||
"items": {
|
||||
"description": "GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying\nconcepts during lookup stages without having partially valid types",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"namespaceResourceWhitelist": {
|
||||
"description": "NamespaceResourceWhitelist contains list of whitelisted namespace level resources",
|
||||
"items": {
|
||||
"description": "GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying\nconcepts during lookup stages without having partially valid types",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"orphanedResources": {
|
||||
"description": "OrphanedResources specifies if controller should monitor orphaned resources of apps in this project",
|
||||
"properties": {
|
||||
"ignore": {
|
||||
"description": "Ignore contains a list of resources that are to be excluded from orphaned resources monitoring",
|
||||
"items": {
|
||||
"description": "OrphanedResourceKey is a reference to a resource to be ignored from",
|
||||
"properties": {
|
||||
"group": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"warn": {
|
||||
"description": "Warn indicates if warning condition should be created for apps which have orphaned resources",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"permitOnlyProjectScopedClusters": {
|
||||
"description": "PermitOnlyProjectScopedClusters determines whether destinations can only reference clusters which are project-scoped",
|
||||
"type": "boolean"
|
||||
},
|
||||
"roles": {
|
||||
"description": "Roles are user defined RBAC roles associated with this project",
|
||||
"items": {
|
||||
"description": "ProjectRole represents a role that has access to a project",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description is a description of the role",
|
||||
"type": "string"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups are a list of OIDC group claims bound to this role",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"jwtTokens": {
|
||||
"description": "JWTTokens are a list of generated JWT tokens bound to this role",
|
||||
"items": {
|
||||
"description": "JWTToken holds the issuedAt and expiresAt values of a token",
|
||||
"properties": {
|
||||
"exp": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"iat": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"id": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"iat"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is a name for this role",
|
||||
"type": "string"
|
||||
},
|
||||
"policies": {
|
||||
"description": "Policies Stores a list of casbin formatted strings that define access policies for the role in the project",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"signatureKeys": {
|
||||
"description": "SignatureKeys contains a list of PGP key IDs that commits in Git must be signed with in order to be allowed for sync",
|
||||
"items": {
|
||||
"description": "SignatureKey is the specification of a key required to verify commit signatures with",
|
||||
"properties": {
|
||||
"keyID": {
|
||||
"description": "The ID of the key in hexadecimal notation",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"keyID"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"sourceNamespaces": {
|
||||
"description": "SourceNamespaces defines the namespaces application resources are allowed to be created in",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"sourceRepos": {
|
||||
"description": "SourceRepos contains list of repository URLs which can be used for deployment",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"syncWindows": {
|
||||
"description": "SyncWindows controls when syncs can be run for apps in this project",
|
||||
"items": {
|
||||
"description": "SyncWindow contains the kind, time, duration and attributes that are used to assign the syncWindows to apps",
|
||||
"properties": {
|
||||
"andOperator": {
|
||||
"description": "UseAndOperator use AND operator for matching applications, namespaces and clusters instead of the default OR operator",
|
||||
"type": "boolean"
|
||||
},
|
||||
"applications": {
|
||||
"description": "Applications contains a list of applications that the window will apply to",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"clusters": {
|
||||
"description": "Clusters contains a list of clusters that the window will apply to",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"description": {
|
||||
"description": "Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example",
|
||||
"type": "string"
|
||||
},
|
||||
"duration": {
|
||||
"description": "Duration is the amount of time the sync window will be open",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind defines if the window allows or blocks syncs",
|
||||
"type": "string"
|
||||
},
|
||||
"manualSync": {
|
||||
"description": "ManualSync enables manual syncs when they would otherwise be blocked",
|
||||
"type": "boolean"
|
||||
},
|
||||
"namespaces": {
|
||||
"description": "Namespaces contains a list of namespaces that the window will apply to",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"schedule": {
|
||||
"description": "Schedule is the time the window will begin, specified in cron format",
|
||||
"type": "string"
|
||||
},
|
||||
"timeZone": {
|
||||
"description": "TimeZone of the sync that will be applied to the schedule",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "AppProjectStatus contains status information for AppProject CRs",
|
||||
"properties": {
|
||||
"jwtTokensByRole": {
|
||||
"additionalProperties": {
|
||||
"description": "JWTTokens represents a list of JWT tokens",
|
||||
"properties": {
|
||||
"items": {
|
||||
"items": {
|
||||
"description": "JWTToken holds the issuedAt and expiresAt values of a token",
|
||||
"properties": {
|
||||
"exp": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"iat": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"id": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"iat"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "JWTTokensByRole contains a list of JWT tokens issued for a given role",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,373 @@
|
||||
{
|
||||
"description": "BackendTLSPolicy provides a way to configure how a Gateway\nconnects to a Backend via TLS.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"options": {
|
||||
"additionalProperties": {
|
||||
"description": "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.",
|
||||
"maxLength": 4096,
|
||||
"minLength": 0,
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Options are a list of key/value pairs to enable extended TLS\nconfiguration for each implementation. For example, configuring the\nminimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid\nany ambiguity, implementation-specific definitions MUST use\ndomain-prefixed names, such as `example.com/my-custom-option`.\nUn-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific",
|
||||
"maxProperties": 16,
|
||||
"type": "object"
|
||||
},
|
||||
"targetRefs": {
|
||||
"description": "TargetRefs identifies an API object to apply the policy to.\nOnly Services have Extended support. Implementations MAY support\nadditional objects, with Implementation Specific support.\nNote that this config applies to the entire referenced resource\nby default, but this default may change in the future to provide\na more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, and `name` must\n be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nWhen more than one BackendTLSPolicy selects the same target and\nsectionName, implementations MUST determine precedence using the\nfollowing criteria, continuing on ties:\n\n* The older policy by creation timestamp takes precedence. For\n example, a policy with a creation timestamp of \"2021-07-15\n 01:02:03\" MUST be given precedence over a policy with a\n creation timestamp of \"2021-07-15 01:02:04\".\n* The policy appearing first in alphabetical order by {name}.\n For example, a policy named `bar` is given precedence over a\n policy named `baz`.\n\nFor any BackendTLSPolicy that does not take precedence, the\nimplementation MUST ensure the `Accepted` Condition is set to\n`status: False`, with Reason `Conflicted`.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
|
||||
"items": {
|
||||
"description": "LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a\ndirect policy to. This should be used as part of Policy resources that can\ntarget single resources. For more information on how this policy attachment\nmode works, and a sample Policy resource, refer to the policy attachment\ndocumentation for Gateway API.\n\nNote: This should only be used for direct policy attachment when references\nto SectionName are actually needed. In all other cases,\nLocalPolicyTargetReference should be used.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the target resource.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the target resource.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the target resource.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. When\nunspecified, this targetRef targets the entire resource. In the following\nresources, SectionName is interpreted as the following:\n\n* Gateway: Listener name\n* HTTPRoute: HTTPRouteRule name\n* Service: Port name\n\nIf a SectionName is specified, but does not exist on the targeted object,\nthe Policy must fail to attach, and the policy implementation should record\na `ResolvedRefs` or similar Condition in the Policy's status.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "sectionName must be specified when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
|
||||
},
|
||||
{
|
||||
"message": "sectionName must be unique when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validation": {
|
||||
"description": "Validation contains backend TLS validation configuration.",
|
||||
"properties": {
|
||||
"caCertificateRefs": {
|
||||
"description": "CACertificateRefs contains one or more references to Kubernetes objects that\ncontain a PEM-encoded TLS CA certificate bundle, which is used to\nvalidate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\nspecified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\nnot both. If CACertificateRefs is empty or unspecified, the configuration for\nWellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nA CACertificateRef is invalid if:\n\n* It refers to a resource that cannot be resolved (e.g., the referenced resource\n does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n and the Message of the Condition must indicate which reference is invalid and why.\n\n* It refers to an unknown or unsupported kind of resource. In this case, the Reason\n must be set to `InvalidKind` and the Message of the Condition must explain which\n kind of resource is unknown or unsupported.\n\n* It refers to a resource in another namespace. This may change in future\n spec updates.\n\nImplementations MAY choose to perform further validation of the certificate\ncontent (e.g., checking expiry or enforcing specific formats). In such cases,\nan implementation-specific Reason and Message must be set for the invalid reference.\n\nIn all cases, the implementation MUST ensure the `ResolvedRefs` Condition on\nthe BackendTLSPolicy is set to `status: False`, with a Reason and Message\nthat indicate the cause of the error. Connections using an invalid\nCACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error\nresponse. If ALL CACertificateRefs are invalid, the implementation MUST also\nensure the `Accepted` Condition on the BackendTLSPolicy is set to\n`status: False`, with a Reason `NoValidCACertificate`.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support.\nImplementations MAY choose to support attaching multiple certificates to\na backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap,\nwith the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific - More than one reference, other kinds\nof resources, or a single reference that includes multiple certificates.",
|
||||
"items": {
|
||||
"description": "LocalObjectReference identifies an API object within the namespace of the\nreferrer.\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must\nbe rejected by the implementation, with appropriate Conditions set\non the containing object.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"hostname": {
|
||||
"description": "Hostname is used for two purposes in the connection between Gateways and\nbackends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).\n2. Hostname MUST be used for authentication and MUST match the certificate\n served by the matching backend, unless SubjectAltNames is specified.\n3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n but MUST NOT be used for authentication. If you want to use the value\n of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "SubjectAltNames contains one or more Subject Alternative Names.\nWhen specified the certificate served from the backend MUST\nhave at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
|
||||
"items": {
|
||||
"description": "SubjectAltName represents Subject Alternative Name.",
|
||||
"properties": {
|
||||
"hostname": {
|
||||
"description": "Hostname contains Subject Alternative Name specified in DNS name format.\nRequired when Type is set to Hostname, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type determines the format of the Subject Alternative Name. Always required.\n\nSupport: Core",
|
||||
"enum": [
|
||||
"Hostname",
|
||||
"URI"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"uri": {
|
||||
"description": "URI contains Subject Alternative Name specified in a full URI format.\nIt MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part.\nCommon values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\".\nRequired when Type is set to URI, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\\?([^#]*))?(#(.*))?",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "SubjectAltName element must contain Hostname, if Type is set to Hostname",
|
||||
"rule": "!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain Hostname, if Type is not set to Hostname",
|
||||
"rule": "!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must contain URI, if Type is set to URI",
|
||||
"rule": "!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain URI, if Type is not set to URI",
|
||||
"rule": "!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 5,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"wellKnownCACertificates": {
|
||||
"description": "WellKnownCACertificates specifies whether system CA certificates may be used in\nthe TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\nmust be specified with at least one entry for a valid configuration. Only one of\nCACertificateRefs or WellKnownCACertificates may be specified, not both.\nIf an implementation does not support the WellKnownCACertificates field, or\nthe supplied value is not recognized, the implementation MUST ensure the\n`Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with\na Reason `Invalid`.\n\nSupport: Implementation-specific",
|
||||
"enum": [
|
||||
"System"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"hostname"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must not contain both CACertificateRefs and WellKnownCACertificates",
|
||||
"rule": "!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "must specify either CACertificateRefs or WellKnownCACertificates",
|
||||
"rule": "(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"targetRefs",
|
||||
"validation"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status defines the current state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"ancestors": {
|
||||
"description": "Ancestors is a list of ancestor resources (usually Gateways) that are\nassociated with the policy, and the status of the policy with respect to\neach ancestor. When this policy attaches to a parent, the controller that\nmanages the parent and the ancestors MUST add an entry to this list when\nthe controller first sees the policy and SHOULD update the entry as\nappropriate when the relevant ancestor is modified.\n\nNote that choosing the relevant ancestor is left to the Policy designers;\nan important part of Policy design is designing the right object level at\nwhich to namespace this status.\n\nNote also that implementations MUST ONLY populate ancestor status for\nthe Ancestor resources they are responsible for. Implementations MUST\nuse the ControllerName field to uniquely identify the entries in this list\nthat they are responsible for.\n\nNote that to achieve this, the list of PolicyAncestorStatus structs\nMUST be treated as a map with a composite key, made up of the AncestorRef\nand ControllerName fields combined.\n\nA maximum of 16 ancestors will be represented in this list. An empty list\nmeans the Policy is not relevant for any ancestors.\n\nIf this slice is full, implementations MUST NOT add further entries.\nInstead they MUST consider the policy unimplementable and signal that\non any related resources such as the ancestor that would be referenced\nhere. For example, if this list was full on BackendTLSPolicy, no\nadditional Gateways would be able to reference the Service targeted by\nthe BackendTLSPolicy.",
|
||||
"items": {
|
||||
"description": "PolicyAncestorStatus describes the status of a route with respect to an\nassociated Ancestor.\n\nAncestors refer to objects that are either the Target of a policy or above it\nin terms of object hierarchy. For example, if a policy targets a Service, the\nPolicy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and\nthe GatewayClass. Almost always, in this hierarchy, the Gateway will be the most\nuseful object to place Policy status on, so we recommend that implementations\nSHOULD use Gateway as the PolicyAncestorStatus object unless the designers\nhave a _very_ good reason otherwise.\n\nIn the context of policy attachment, the Ancestor is used to distinguish which\nresource results in a distinct application of this policy. For example, if a policy\ntargets a Service, it may have a distinct result per attached Gateway.\n\nPolicies targeting the same resource may have different effects depending on the\nancestors of those resources. For example, different Gateways targeting the same\nService may have different capabilities, especially if they have different underlying\nimplementations.\n\nFor example, in BackendTLSPolicy, the Policy attaches to a Service that is\nused as a backend in a HTTPRoute that is itself attached to a Gateway.\nIn this case, the relevant object for status is the Gateway, and that is the\nancestor object referred to in this status.\n\nNote that a parent is also an ancestor, so for objects where the parent is the\nrelevant object for status, this struct SHOULD still be used.\n\nThis struct is intended to be used in a slice that's effectively a map,\nwith a composite key made up of the AncestorRef and the ControllerName.",
|
||||
"properties": {
|
||||
"ancestorRef": {
|
||||
"description": "AncestorRef corresponds with a ParentRef in the spec that this\nPolicyAncestorStatus struct describes the status of.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"default": "gateway.networking.k8s.io",
|
||||
"description": "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"default": "Gateway",
|
||||
"description": "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\nSupport: Core",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions describes the status of the Policy with respect to the given Ancestor.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"controllerName": {
|
||||
"description": "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestorRef",
|
||||
"conditions",
|
||||
"controllerName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestors"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,373 @@
|
||||
{
|
||||
"description": "BackendTLSPolicy provides a way to configure how a Gateway\nconnects to a Backend via TLS.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Spec defines the desired state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"options": {
|
||||
"additionalProperties": {
|
||||
"description": "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.",
|
||||
"maxLength": 4096,
|
||||
"minLength": 0,
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Options are a list of key/value pairs to enable extended TLS\nconfiguration for each implementation. For example, configuring the\nminimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid\nany ambiguity, implementation-specific definitions MUST use\ndomain-prefixed names, such as `example.com/my-custom-option`.\nUn-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific",
|
||||
"maxProperties": 16,
|
||||
"type": "object"
|
||||
},
|
||||
"targetRefs": {
|
||||
"description": "TargetRefs identifies an API object to apply the policy to.\nOnly Services have Extended support. Implementations MAY support\nadditional objects, with Implementation Specific support.\nNote that this config applies to the entire referenced resource\nby default, but this default may change in the future to provide\na more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, and `name` must\n be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nWhen more than one BackendTLSPolicy selects the same target and\nsectionName, implementations MUST determine precedence using the\nfollowing criteria, continuing on ties:\n\n* The older policy by creation timestamp takes precedence. For\n example, a policy with a creation timestamp of \"2021-07-15\n 01:02:03\" MUST be given precedence over a policy with a\n creation timestamp of \"2021-07-15 01:02:04\".\n* The policy appearing first in alphabetical order by {name}.\n For example, a policy named `bar` is given precedence over a\n policy named `baz`.\n\nFor any BackendTLSPolicy that does not take precedence, the\nimplementation MUST ensure the `Accepted` Condition is set to\n`status: False`, with Reason `Conflicted`.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
|
||||
"items": {
|
||||
"description": "LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a\ndirect policy to. This should be used as part of Policy resources that can\ntarget single resources. For more information on how this policy attachment\nmode works, and a sample Policy resource, refer to the policy attachment\ndocumentation for Gateway API.\n\nNote: This should only be used for direct policy attachment when references\nto SectionName are actually needed. In all other cases,\nLocalPolicyTargetReference should be used.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the target resource.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the target resource.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the target resource.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. When\nunspecified, this targetRef targets the entire resource. In the following\nresources, SectionName is interpreted as the following:\n\n* Gateway: Listener name\n* HTTPRoute: HTTPRouteRule name\n* Service: Port name\n\nIf a SectionName is specified, but does not exist on the targeted object,\nthe Policy must fail to attach, and the policy implementation should record\na `ResolvedRefs` or similar Condition in the Policy's status.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "sectionName must be specified when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
|
||||
},
|
||||
{
|
||||
"message": "sectionName must be unique when targetRefs includes 2 or more references to the same target",
|
||||
"rule": "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
|
||||
}
|
||||
]
|
||||
},
|
||||
"validation": {
|
||||
"description": "Validation contains backend TLS validation configuration.",
|
||||
"properties": {
|
||||
"caCertificateRefs": {
|
||||
"description": "CACertificateRefs contains one or more references to Kubernetes objects that\ncontain a PEM-encoded TLS CA certificate bundle, which is used to\nvalidate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\nspecified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\nnot both. If CACertificateRefs is empty or unspecified, the configuration for\nWellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nA CACertificateRef is invalid if:\n\n* It refers to a resource that cannot be resolved (e.g., the referenced resource\n does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n and the Message of the Condition must indicate which reference is invalid and why.\n\n* It refers to an unknown or unsupported kind of resource. In this case, the Reason\n must be set to `InvalidKind` and the Message of the Condition must explain which\n kind of resource is unknown or unsupported.\n\n* It refers to a resource in another namespace. This may change in future\n spec updates.\n\nImplementations MAY choose to perform further validation of the certificate\ncontent (e.g., checking expiry or enforcing specific formats). In such cases,\nan implementation-specific Reason and Message must be set for the invalid reference.\n\nIn all cases, the implementation MUST ensure the `ResolvedRefs` Condition on\nthe BackendTLSPolicy is set to `status: False`, with a Reason and Message\nthat indicate the cause of the error. Connections using an invalid\nCACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error\nresponse. If ALL CACertificateRefs are invalid, the implementation MUST also\nensure the `Accepted` Condition on the BackendTLSPolicy is set to\n`status: False`, with a Reason `NoValidCACertificate`.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support.\nImplementations MAY choose to support attaching multiple certificates to\na backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap,\nwith the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific - More than one reference, other kinds\nof resources, or a single reference that includes multiple certificates.",
|
||||
"items": {
|
||||
"description": "LocalObjectReference identifies an API object within the namespace of the\nreferrer.\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must\nbe rejected by the implementation, with appropriate Conditions set\non the containing object.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"group",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"hostname": {
|
||||
"description": "Hostname is used for two purposes in the connection between Gateways and\nbackends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).\n2. Hostname MUST be used for authentication and MUST match the certificate\n served by the matching backend, unless SubjectAltNames is specified.\n3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n but MUST NOT be used for authentication. If you want to use the value\n of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "SubjectAltNames contains one or more Subject Alternative Names.\nWhen specified the certificate served from the backend MUST\nhave at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
|
||||
"items": {
|
||||
"description": "SubjectAltName represents Subject Alternative Name.",
|
||||
"properties": {
|
||||
"hostname": {
|
||||
"description": "Hostname contains Subject Alternative Name specified in DNS name format.\nRequired when Type is set to Hostname, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type determines the format of the Subject Alternative Name. Always required.\n\nSupport: Core",
|
||||
"enum": [
|
||||
"Hostname",
|
||||
"URI"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"uri": {
|
||||
"description": "URI contains Subject Alternative Name specified in a full URI format.\nIt MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part.\nCommon values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\".\nRequired when Type is set to URI, ignored otherwise.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\\?([^#]*))?(#(.*))?",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "SubjectAltName element must contain Hostname, if Type is set to Hostname",
|
||||
"rule": "!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain Hostname, if Type is not set to Hostname",
|
||||
"rule": "!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must contain URI, if Type is set to URI",
|
||||
"rule": "!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
|
||||
},
|
||||
{
|
||||
"message": "SubjectAltName element must not contain URI, if Type is not set to URI",
|
||||
"rule": "!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 5,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"wellKnownCACertificates": {
|
||||
"description": "WellKnownCACertificates specifies whether system CA certificates may be used in\nthe TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\nmust be specified with at least one entry for a valid configuration. Only one of\nCACertificateRefs or WellKnownCACertificates may be specified, not both.\nIf an implementation does not support the WellKnownCACertificates field, or\nthe supplied value is not recognized, the implementation MUST ensure the\n`Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with\na Reason `Invalid`.\n\nSupport: Implementation-specific",
|
||||
"enum": [
|
||||
"System"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"hostname"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "must not contain both CACertificateRefs and WellKnownCACertificates",
|
||||
"rule": "!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
},
|
||||
{
|
||||
"message": "must specify either CACertificateRefs or WellKnownCACertificates",
|
||||
"rule": "(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"targetRefs",
|
||||
"validation"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status defines the current state of BackendTLSPolicy.",
|
||||
"properties": {
|
||||
"ancestors": {
|
||||
"description": "Ancestors is a list of ancestor resources (usually Gateways) that are\nassociated with the policy, and the status of the policy with respect to\neach ancestor. When this policy attaches to a parent, the controller that\nmanages the parent and the ancestors MUST add an entry to this list when\nthe controller first sees the policy and SHOULD update the entry as\nappropriate when the relevant ancestor is modified.\n\nNote that choosing the relevant ancestor is left to the Policy designers;\nan important part of Policy design is designing the right object level at\nwhich to namespace this status.\n\nNote also that implementations MUST ONLY populate ancestor status for\nthe Ancestor resources they are responsible for. Implementations MUST\nuse the ControllerName field to uniquely identify the entries in this list\nthat they are responsible for.\n\nNote that to achieve this, the list of PolicyAncestorStatus structs\nMUST be treated as a map with a composite key, made up of the AncestorRef\nand ControllerName fields combined.\n\nA maximum of 16 ancestors will be represented in this list. An empty list\nmeans the Policy is not relevant for any ancestors.\n\nIf this slice is full, implementations MUST NOT add further entries.\nInstead they MUST consider the policy unimplementable and signal that\non any related resources such as the ancestor that would be referenced\nhere. For example, if this list was full on BackendTLSPolicy, no\nadditional Gateways would be able to reference the Service targeted by\nthe BackendTLSPolicy.",
|
||||
"items": {
|
||||
"description": "PolicyAncestorStatus describes the status of a route with respect to an\nassociated Ancestor.\n\nAncestors refer to objects that are either the Target of a policy or above it\nin terms of object hierarchy. For example, if a policy targets a Service, the\nPolicy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and\nthe GatewayClass. Almost always, in this hierarchy, the Gateway will be the most\nuseful object to place Policy status on, so we recommend that implementations\nSHOULD use Gateway as the PolicyAncestorStatus object unless the designers\nhave a _very_ good reason otherwise.\n\nIn the context of policy attachment, the Ancestor is used to distinguish which\nresource results in a distinct application of this policy. For example, if a policy\ntargets a Service, it may have a distinct result per attached Gateway.\n\nPolicies targeting the same resource may have different effects depending on the\nancestors of those resources. For example, different Gateways targeting the same\nService may have different capabilities, especially if they have different underlying\nimplementations.\n\nFor example, in BackendTLSPolicy, the Policy attaches to a Service that is\nused as a backend in a HTTPRoute that is itself attached to a Gateway.\nIn this case, the relevant object for status is the Gateway, and that is the\nancestor object referred to in this status.\n\nNote that a parent is also an ancestor, so for objects where the parent is the\nrelevant object for status, this struct SHOULD still be used.\n\nThis struct is intended to be used in a slice that's effectively a map,\nwith a composite key made up of the AncestorRef and the ControllerName.",
|
||||
"properties": {
|
||||
"ancestorRef": {
|
||||
"description": "AncestorRef corresponds with a ParentRef in the spec that this\nPolicyAncestorStatus struct describes the status of.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"default": "gateway.networking.k8s.io",
|
||||
"description": "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"default": "Gateway",
|
||||
"description": "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referent.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\nSupport: Core",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"sectionName": {
|
||||
"description": "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions describes the status of the Policy with respect to the given Ancestor.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 8,
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"controllerName": {
|
||||
"description": "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestorRef",
|
||||
"conditions",
|
||||
"controllerName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"maxItems": 16,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ancestors"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,171 @@
|
||||
{
|
||||
"description": "BackingImage is where Longhorn stores backing image object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackingImageSpec defines the desired state of the Longhorn backing image",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"dataEngine": {
|
||||
"default": "v1",
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"diskFileSpecMap": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"evictionRequested": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"diskSelector": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"disks": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Deprecated. We are now using DiskFileSpecMap to assign different spec to the file on different disks.",
|
||||
"type": "object"
|
||||
},
|
||||
"minNumberOfCopies": {
|
||||
"type": "integer"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secret": {
|
||||
"type": "string"
|
||||
},
|
||||
"secretNamespace": {
|
||||
"type": "string"
|
||||
},
|
||||
"sourceParameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"sourceType": {
|
||||
"enum": [
|
||||
"download",
|
||||
"upload",
|
||||
"export-from-volume",
|
||||
"restore",
|
||||
"clone"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackingImageStatus defines the observed state of the Longhorn backing image status",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskFileStatusMap": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"dataEngine": {
|
||||
"enum": [
|
||||
"v1",
|
||||
"v2"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"lastStateTransitionTime": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"diskLastRefAtMap": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"realSize": {
|
||||
"description": "Real size of image in bytes, which may be smaller than the size when the file is a sparse file. Will be zero until known (e.g. while a backing image is uploading)",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
},
|
||||
"v2FirstCopyDisk": {
|
||||
"type": "string"
|
||||
},
|
||||
"v2FirstCopyStatus": {
|
||||
"description": "It is pending -> in-progress -> ready/failed",
|
||||
"type": "string"
|
||||
},
|
||||
"virtualSize": {
|
||||
"description": "Virtual size of image in bytes, which may be larger than physical size. Will be zero until known (e.g. while a backing image is uploading)",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
{
|
||||
"description": "BackingImageDataSource is where Longhorn stores backing image data source object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackingImageDataSourceSpec defines the desired state of the Longhorn backing image data source",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskPath": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskUUID": {
|
||||
"type": "string"
|
||||
},
|
||||
"fileTransferred": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"nodeID": {
|
||||
"type": "string"
|
||||
},
|
||||
"parameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"sourceType": {
|
||||
"enum": [
|
||||
"download",
|
||||
"upload",
|
||||
"export-from-volume",
|
||||
"restore",
|
||||
"clone"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackingImageDataSourceStatus defines the observed state of the Longhorn backing image data source",
|
||||
"properties": {
|
||||
"checksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"currentState": {
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"runningParameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"storageIP": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"description": "BackingImageManager is where Longhorn stores backing image manager object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackingImageManagerSpec defines the desired state of the Longhorn backing image manager",
|
||||
"properties": {
|
||||
"backingImages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"diskPath": {
|
||||
"type": "string"
|
||||
},
|
||||
"diskUUID": {
|
||||
"type": "string"
|
||||
},
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeID": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackingImageManagerStatus defines the observed state of the Longhorn backing image manager",
|
||||
"properties": {
|
||||
"apiMinVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"apiVersion": {
|
||||
"type": "integer"
|
||||
},
|
||||
"backingImageFileMap": {
|
||||
"additionalProperties": {
|
||||
"properties": {
|
||||
"currentChecksum": {
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"type": "integer"
|
||||
},
|
||||
"realSize": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"senderManagerAddress": {
|
||||
"type": "string"
|
||||
},
|
||||
"sendingReference": {
|
||||
"type": "integer"
|
||||
},
|
||||
"size": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"type": "string"
|
||||
},
|
||||
"uuid": {
|
||||
"type": "string"
|
||||
},
|
||||
"virtualSize": {
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"currentState": {
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"type": "string"
|
||||
},
|
||||
"storageIP": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,492 @@
|
||||
{
|
||||
"description": "A Backup resource is a request for a PostgreSQL backup by the user.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired behavior of the backup.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"cluster": {
|
||||
"description": "The cluster to backup",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"method": {
|
||||
"default": "barmanObjectStore",
|
||||
"description": "The backup method to be used, possible options are `barmanObjectStore`,\n`volumeSnapshot` or `plugin`. Defaults to: `barmanObjectStore`.",
|
||||
"enum": [
|
||||
"barmanObjectStore",
|
||||
"volumeSnapshot",
|
||||
"plugin"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"online": {
|
||||
"description": "Whether the default type of backup with volume snapshots is\nonline/hot (`true`, default) or offline/cold (`false`)\nOverrides the default setting specified in the cluster field '.spec.backup.volumeSnapshot.online'",
|
||||
"type": "boolean"
|
||||
},
|
||||
"onlineConfiguration": {
|
||||
"description": "Configuration parameters to control the online/hot backup with volume snapshots\nOverrides the default settings specified in the cluster '.backup.volumeSnapshot.onlineConfiguration' stanza",
|
||||
"properties": {
|
||||
"immediateCheckpoint": {
|
||||
"description": "Control whether the I/O workload for the backup initial checkpoint will\nbe limited, according to the `checkpoint_completion_target` setting on\nthe PostgreSQL server. If set to true, an immediate checkpoint will be\nused, meaning PostgreSQL will complete the checkpoint as soon as\npossible. `false` by default.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"waitForArchive": {
|
||||
"default": true,
|
||||
"description": "If false, the function will return immediately after the backup is completed,\nwithout waiting for WAL to be archived.\nThis behavior is only useful with backup software that independently monitors WAL archiving.\nOtherwise, WAL required to make the backup consistent might be missing and make the backup useless.\nBy default, or when this parameter is true, pg_backup_stop will wait for WAL to be archived when archiving is\nenabled.\nOn a standby, this means that it will wait only when archive_mode = always.\nIf write activity on the primary is low, it may be useful to run pg_switch_wal on the primary in order to trigger\nan immediate segment switch.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pluginConfiguration": {
|
||||
"description": "Configuration parameters passed to the plugin managing this backup",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the plugin managing this backup",
|
||||
"type": "string"
|
||||
},
|
||||
"parameters": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Parameters are the configuration parameters passed to the backup\nplugin for this backup",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"target": {
|
||||
"description": "The policy to decide which instance should perform this backup. If empty,\nit defaults to `cluster.spec.backup.target`.\nAvailable options are empty string, `primary` and `prefer-standby`.\n`primary` to have backups run always on primary instances,\n`prefer-standby` to have backups run preferably on the most updated\nstandby, if available.",
|
||||
"enum": [
|
||||
"primary",
|
||||
"prefer-standby"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"cluster"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "BackupSpec is immutable once set",
|
||||
"rule": "oldSelf == self"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Most recently observed status of the backup. This data may not be up to\ndate. Populated by the system. Read-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"azureCredentials": {
|
||||
"description": "The credentials to use to upload data to Azure Blob Storage",
|
||||
"properties": {
|
||||
"connectionString": {
|
||||
"description": "The connection string to be used",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"inheritFromAzureAD": {
|
||||
"description": "Use the Azure AD based authentication without providing explicitly the keys.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"storageAccount": {
|
||||
"description": "The storage account where to upload data",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"storageKey": {
|
||||
"description": "The storage account key to be used in conjunction\nwith the storage account name",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"storageSasToken": {
|
||||
"description": "A shared-access-signature to be used in conjunction with\nthe storage account name",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"useDefaultAzureCredentials": {
|
||||
"description": "Use the default Azure authentication flow, which includes DefaultAzureCredential.\nThis allows authentication using environment variables and managed identities.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"backupId": {
|
||||
"description": "The ID of the Barman backup",
|
||||
"type": "string"
|
||||
},
|
||||
"backupLabelFile": {
|
||||
"description": "Backup label file content as returned by Postgres in case of online (hot) backups",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"backupName": {
|
||||
"description": "The Name of the Barman backup",
|
||||
"type": "string"
|
||||
},
|
||||
"beginLSN": {
|
||||
"description": "The starting xlog",
|
||||
"type": "string"
|
||||
},
|
||||
"beginWal": {
|
||||
"description": "The starting WAL",
|
||||
"type": "string"
|
||||
},
|
||||
"commandError": {
|
||||
"description": "The backup command output in case of error",
|
||||
"type": "string"
|
||||
},
|
||||
"commandOutput": {
|
||||
"description": "Unused. Retained for compatibility with old versions.",
|
||||
"type": "string"
|
||||
},
|
||||
"destinationPath": {
|
||||
"description": "The path where to store the backup (i.e. s3://bucket/path/to/folder)\nthis path, with different destination folders, will be used for WALs\nand for data. This may not be populated in case of errors.",
|
||||
"type": "string"
|
||||
},
|
||||
"encryption": {
|
||||
"description": "Encryption method required to S3 API",
|
||||
"type": "string"
|
||||
},
|
||||
"endLSN": {
|
||||
"description": "The ending xlog",
|
||||
"type": "string"
|
||||
},
|
||||
"endWal": {
|
||||
"description": "The ending WAL",
|
||||
"type": "string"
|
||||
},
|
||||
"endpointCA": {
|
||||
"description": "EndpointCA store the CA bundle of the barman endpoint.\nUseful when using self-signed certificates to avoid\nerrors with certificate issuer and barman-cloud-wal-archive.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"endpointURL": {
|
||||
"description": "Endpoint to be used to upload data to the cloud,\noverriding the automatic endpoint discovery",
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"description": "The detected error",
|
||||
"type": "string"
|
||||
},
|
||||
"googleCredentials": {
|
||||
"description": "The credentials to use to upload data to Google Cloud Storage",
|
||||
"properties": {
|
||||
"applicationCredentials": {
|
||||
"description": "The secret containing the Google Cloud Storage JSON file with the credentials",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"gkeEnvironment": {
|
||||
"description": "If set to true, will presume that it's running inside a GKE environment,\ndefault to false.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"instanceID": {
|
||||
"description": "Information to identify the instance where the backup has been taken from",
|
||||
"properties": {
|
||||
"ContainerID": {
|
||||
"description": "The container ID",
|
||||
"type": "string"
|
||||
},
|
||||
"podName": {
|
||||
"description": "The pod name",
|
||||
"type": "string"
|
||||
},
|
||||
"sessionID": {
|
||||
"description": "The instance manager session ID. This is a unique identifier generated at instance manager\nstartup and changes on every restart (including container reboots). Used to detect if\nthe instance manager was restarted during long-running operations like backups, which\nwould terminate any running backup process.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"majorVersion": {
|
||||
"description": "The PostgreSQL major version that was running when the\nbackup was taken.",
|
||||
"type": "integer"
|
||||
},
|
||||
"method": {
|
||||
"description": "The backup method being used",
|
||||
"type": "string"
|
||||
},
|
||||
"online": {
|
||||
"description": "Whether the backup was online/hot (`true`) or offline/cold (`false`)",
|
||||
"type": "boolean"
|
||||
},
|
||||
"phase": {
|
||||
"description": "The last backup status",
|
||||
"type": "string"
|
||||
},
|
||||
"pluginMetadata": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "A map containing the plugin metadata",
|
||||
"type": "object"
|
||||
},
|
||||
"s3Credentials": {
|
||||
"description": "The credentials to use to upload data to S3",
|
||||
"properties": {
|
||||
"accessKeyId": {
|
||||
"description": "The reference to the access key id",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"inheritFromIAMRole": {
|
||||
"description": "Use the role based authentication without providing explicitly the keys.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"region": {
|
||||
"description": "The reference to the secret containing the region name",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secretAccessKey": {
|
||||
"description": "The reference to the secret access key",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"sessionToken": {
|
||||
"description": "The references to the session key",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the referent.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"serverName": {
|
||||
"description": "The server name on S3, the cluster name is used if this\nparameter is omitted",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotBackupStatus": {
|
||||
"description": "Status of the volumeSnapshot backup",
|
||||
"properties": {
|
||||
"elements": {
|
||||
"description": "The elements list, populated with the gathered volume snapshots",
|
||||
"items": {
|
||||
"description": "BackupSnapshotElementStatus is a volume snapshot that is part of a volume snapshot method backup",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the snapshot resource name",
|
||||
"type": "string"
|
||||
},
|
||||
"tablespaceName": {
|
||||
"description": "TablespaceName is the name of the snapshotted tablespace. Only set\nwhen type is PG_TABLESPACE",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is tho role of the snapshot in the cluster, such as PG_DATA, PG_WAL and PG_TABLESPACE",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"startedAt": {
|
||||
"description": "When the backup was started",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"stoppedAt": {
|
||||
"description": "When the backup was terminated",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"tablespaceMapFile": {
|
||||
"description": "Tablespace map file content as returned by Postgres in case of online (hot) backups",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"spec"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
{
|
||||
"description": "Backup is where Longhorn stores backup object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupSpec defines the desired state of the Longhorn backup",
|
||||
"properties": {
|
||||
"backupBlockSize": {
|
||||
"description": "The backup block size. 0 means the legacy default size 2MiB, and -1 indicate the block size is invalid.",
|
||||
"enum": [
|
||||
"-1",
|
||||
"2097152",
|
||||
"16777216"
|
||||
],
|
||||
"format": "int64",
|
||||
"type": "string"
|
||||
},
|
||||
"backupMode": {
|
||||
"description": "The backup mode of this backup.\nCan be \"full\" or \"incremental\"",
|
||||
"enum": [
|
||||
"full",
|
||||
"incremental"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of snapshot backup.",
|
||||
"type": "object"
|
||||
},
|
||||
"snapshotName": {
|
||||
"description": "The snapshot name.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backup.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupStatus defines the observed state of the Longhorn backup",
|
||||
"properties": {
|
||||
"backupCreatedAt": {
|
||||
"description": "The snapshot backup upload finished time.",
|
||||
"type": "string"
|
||||
},
|
||||
"backupTargetName": {
|
||||
"description": "The backup target name.",
|
||||
"type": "string"
|
||||
},
|
||||
"compressionMethod": {
|
||||
"description": "Compression method",
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"description": "The error message when taking the snapshot backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of snapshot backup.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the backup was synced with the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"messages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The error messages when calling longhorn engine on listing or inspecting backups.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"newlyUploadDataSize": {
|
||||
"description": "Size in bytes of newly uploaded data",
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this backup CR.",
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"description": "The snapshot backup progress.",
|
||||
"type": "integer"
|
||||
},
|
||||
"reUploadedDataSize": {
|
||||
"description": "Size in bytes of reuploaded data",
|
||||
"type": "string"
|
||||
},
|
||||
"replicaAddress": {
|
||||
"description": "The address of the replica that runs snapshot backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "The snapshot size.",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotCreatedAt": {
|
||||
"description": "The snapshot creation time.",
|
||||
"type": "string"
|
||||
},
|
||||
"snapshotName": {
|
||||
"description": "The snapshot name.",
|
||||
"type": "string"
|
||||
},
|
||||
"state": {
|
||||
"description": "The backup creation state.\nCan be \"\", \"InProgress\", \"Completed\", \"Error\", \"Unknown\".",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "The snapshot backup URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeBackingImageName": {
|
||||
"description": "The volume's backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeCreated": {
|
||||
"description": "The volume creation time.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeName": {
|
||||
"description": "The volume name.",
|
||||
"type": "string"
|
||||
},
|
||||
"volumeSize": {
|
||||
"description": "The volume size.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
{
|
||||
"description": "BackupBackingImage is where Longhorn stores backing image backup object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupBackingImageSpec defines the desired state of the Longhorn backing image backup",
|
||||
"properties": {
|
||||
"backingImage": {
|
||||
"description": "The backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"backupTargetName": {
|
||||
"description": "The backup target name.",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of backing image backup.",
|
||||
"type": "object"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backing image backup.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"userCreated": {
|
||||
"description": "Is this CR created by user through API or UI.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"backingImage",
|
||||
"userCreated"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupBackingImageStatus defines the observed state of the Longhorn backing image backup",
|
||||
"properties": {
|
||||
"backingImage": {
|
||||
"description": "The backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"backupCreatedAt": {
|
||||
"description": "The backing image backup upload finished time.",
|
||||
"type": "string"
|
||||
},
|
||||
"checksum": {
|
||||
"description": "The checksum of the backing image.",
|
||||
"type": "string"
|
||||
},
|
||||
"compressionMethod": {
|
||||
"description": "Compression method",
|
||||
"type": "string"
|
||||
},
|
||||
"error": {
|
||||
"description": "The error message when taking the backing image backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The labels of backing image backup.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the backing image backup was synced with the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"managerAddress": {
|
||||
"description": "The address of the backing image manager that runs backing image backup.",
|
||||
"type": "string"
|
||||
},
|
||||
"messages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The error messages when listing or inspecting backing image backup.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this CR.",
|
||||
"type": "string"
|
||||
},
|
||||
"progress": {
|
||||
"description": "The backing image backup progress.",
|
||||
"type": "integer"
|
||||
},
|
||||
"secret": {
|
||||
"description": "Record the secret if this backup backing image is encrypted",
|
||||
"type": "string"
|
||||
},
|
||||
"secretNamespace": {
|
||||
"description": "Record the secret namespace if this backup backing image is encrypted",
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "The backing image size.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"state": {
|
||||
"description": "The backing image backup creation state.\nCan be \"\", \"InProgress\", \"Completed\", \"Error\", \"Unknown\".",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "The backing image backup URL.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
{
|
||||
"description": "BackupTarget is where Longhorn stores backup target object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupTargetSpec defines the desired state of the Longhorn backup target",
|
||||
"properties": {
|
||||
"backupTargetURL": {
|
||||
"description": "The backup target URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"credentialSecret": {
|
||||
"description": "The backup target credential secret.",
|
||||
"type": "string"
|
||||
},
|
||||
"pollInterval": {
|
||||
"description": "The interval that the cluster needs to run sync with the backup target.",
|
||||
"type": "string"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupTargetStatus defines the observed state of the Longhorn backup target",
|
||||
"properties": {
|
||||
"available": {
|
||||
"description": "Available indicates if the remote backup target is available or not.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Records the reason on why the backup target is unavailable.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"lastProbeTime": {
|
||||
"description": "Last time we probed the condition.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastTransitionTime": {
|
||||
"description": "Last time the condition transitioned from one status to another.",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Human-readable message indicating details about last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Unique, one-word, CamelCase reason for the condition's last transition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status is the status of the condition.\nCan be True, False, Unknown.",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of the condition.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"nullable": true,
|
||||
"type": "array"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the controller synced with the remote backup target.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this backup target CR.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
{
|
||||
"description": "BackupVolume is where Longhorn stores backup volume object.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "BackupVolumeSpec defines the desired state of the Longhorn backup volume",
|
||||
"properties": {
|
||||
"backupTargetName": {
|
||||
"description": "The backup target name that the backup volume was synced.",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"syncRequestedAt": {
|
||||
"description": "The time to request run sync the remote backup volume.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"volumeName": {
|
||||
"description": "The volume name that the backup volume was used to backup.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "BackupVolumeStatus defines the observed state of the Longhorn backup volume",
|
||||
"properties": {
|
||||
"backingImageChecksum": {
|
||||
"description": "the backing image checksum.",
|
||||
"type": "string"
|
||||
},
|
||||
"backingImageName": {
|
||||
"description": "The backing image name.",
|
||||
"type": "string"
|
||||
},
|
||||
"createdAt": {
|
||||
"description": "The backup volume creation time.",
|
||||
"type": "string"
|
||||
},
|
||||
"dataStored": {
|
||||
"description": "The backup volume block count.",
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The backup volume labels.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"lastBackupAt": {
|
||||
"description": "The latest volume backup time.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastBackupName": {
|
||||
"description": "The latest volume backup name.",
|
||||
"type": "string"
|
||||
},
|
||||
"lastModificationTime": {
|
||||
"description": "The backup volume config last modification time.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"lastSyncedAt": {
|
||||
"description": "The last time that the backup volume was synced into the cluster.",
|
||||
"format": "date-time",
|
||||
"nullable": true,
|
||||
"type": "string"
|
||||
},
|
||||
"messages": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "The error messages when call longhorn engine on list or inspect backup volumes.",
|
||||
"nullable": true,
|
||||
"type": "object"
|
||||
},
|
||||
"ownerID": {
|
||||
"description": "The node ID on which the controller is responsible to reconcile this backup volume CR.",
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "The backup volume size.",
|
||||
"type": "string"
|
||||
},
|
||||
"storageClassName": {
|
||||
"description": "the storage class name of pv/pvc binding with the volume.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,603 @@
|
||||
{
|
||||
"description": "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"additionalOutputFormats": {
|
||||
"description": "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.",
|
||||
"items": {
|
||||
"description": "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.",
|
||||
"properties": {
|
||||
"type": {
|
||||
"description": "Type is the name of the format type that should be written to the\nCertificate's target Secret.",
|
||||
"enum": [
|
||||
"DER",
|
||||
"CombinedPEM"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"commonName": {
|
||||
"description": "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.",
|
||||
"type": "string"
|
||||
},
|
||||
"dnsNames": {
|
||||
"description": "Requested DNS subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"duration": {
|
||||
"description": "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.",
|
||||
"type": "string"
|
||||
},
|
||||
"emailAddresses": {
|
||||
"description": "Requested email subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"encodeUsagesInRequest": {
|
||||
"description": "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"ipAddresses": {
|
||||
"description": "Requested IP address subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"isCA": {
|
||||
"description": "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"issuerRef": {
|
||||
"description": "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind of the issuer being referred to.\nDefaults to 'Issuer'.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the issuer being referred to.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"keystores": {
|
||||
"description": "Additional keystore output formats to be stored in the Certificate's Secret.",
|
||||
"properties": {
|
||||
"jks": {
|
||||
"description": "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.",
|
||||
"properties": {
|
||||
"alias": {
|
||||
"description": "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.",
|
||||
"type": "string"
|
||||
},
|
||||
"create": {
|
||||
"description": "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority",
|
||||
"type": "boolean"
|
||||
},
|
||||
"password": {
|
||||
"description": "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"type": "string"
|
||||
},
|
||||
"passwordSecretRef": {
|
||||
"description": "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"create"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"pkcs12": {
|
||||
"description": "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.",
|
||||
"properties": {
|
||||
"create": {
|
||||
"description": "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority",
|
||||
"type": "boolean"
|
||||
},
|
||||
"password": {
|
||||
"description": "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"type": "string"
|
||||
},
|
||||
"passwordSecretRef": {
|
||||
"description": "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"profile": {
|
||||
"description": "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(e.g., because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.",
|
||||
"enum": [
|
||||
"LegacyRC2",
|
||||
"LegacyDES",
|
||||
"Modern2023"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"create"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"literalSubject": {
|
||||
"description": "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.",
|
||||
"type": "string"
|
||||
},
|
||||
"nameConstraints": {
|
||||
"description": "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.",
|
||||
"properties": {
|
||||
"critical": {
|
||||
"description": "if true then the name constraints are marked critical.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"excluded": {
|
||||
"description": "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted",
|
||||
"properties": {
|
||||
"dnsDomains": {
|
||||
"description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"emailAddresses": {
|
||||
"description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"ipRanges": {
|
||||
"description": "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"uriDomains": {
|
||||
"description": "URIDomains is a list of URI domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"permitted": {
|
||||
"description": "Permitted contains the constraints in which the names must be located.",
|
||||
"properties": {
|
||||
"dnsDomains": {
|
||||
"description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"emailAddresses": {
|
||||
"description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"ipRanges": {
|
||||
"description": "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"uriDomains": {
|
||||
"description": "URIDomains is a list of URI domains that are permitted or excluded.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"otherNames": {
|
||||
"description": "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.",
|
||||
"items": {
|
||||
"properties": {
|
||||
"oid": {
|
||||
"description": "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".",
|
||||
"type": "string"
|
||||
},
|
||||
"utf8Value": {
|
||||
"description": "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"privateKey": {
|
||||
"description": "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.",
|
||||
"properties": {
|
||||
"algorithm": {
|
||||
"description": "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.",
|
||||
"enum": [
|
||||
"RSA",
|
||||
"ECDSA",
|
||||
"Ed25519"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"encoding": {
|
||||
"description": "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.",
|
||||
"enum": [
|
||||
"PKCS1",
|
||||
"PKCS8"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"rotationPolicy": {
|
||||
"description": "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Always`.\nThe default was changed from `Never` to `Always` in cert-manager >=v1.18.0.",
|
||||
"enum": [
|
||||
"Never",
|
||||
"Always"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"description": "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"renewBefore": {
|
||||
"description": "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.",
|
||||
"type": "string"
|
||||
},
|
||||
"renewBeforePercentage": {
|
||||
"description": "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"revisionHistoryLimit": {
|
||||
"description": "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nDefault value is `1`.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"secretName": {
|
||||
"description": "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"secretTemplate": {
|
||||
"description": "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations is a key value map to be copied to the target Kubernetes Secret.",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels is a key value map to be copied to the target Kubernetes Secret.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"signatureAlgorithm": {
|
||||
"description": "Signature algorithm to use.\nAllowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.\nAllowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.\nAllowed values for Ed25519 keys: PureEd25519.",
|
||||
"enum": [
|
||||
"SHA256WithRSA",
|
||||
"SHA384WithRSA",
|
||||
"SHA512WithRSA",
|
||||
"ECDSAWithSHA256",
|
||||
"ECDSAWithSHA384",
|
||||
"ECDSAWithSHA512",
|
||||
"PureEd25519"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"subject": {
|
||||
"description": "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.",
|
||||
"properties": {
|
||||
"countries": {
|
||||
"description": "Countries to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"localities": {
|
||||
"description": "Cities to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"organizationalUnits": {
|
||||
"description": "Organizational Units to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"organizations": {
|
||||
"description": "Organizations to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"postalCodes": {
|
||||
"description": "Postal codes to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"provinces": {
|
||||
"description": "State/Provinces to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"serialNumber": {
|
||||
"description": "Serial number to be used on the Certificate.",
|
||||
"type": "string"
|
||||
},
|
||||
"streetAddresses": {
|
||||
"description": "Street addresses to be used on the Certificate.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"uris": {
|
||||
"description": "Requested URI subject alternative names.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"usages": {
|
||||
"description": "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.",
|
||||
"items": {
|
||||
"description": "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"",
|
||||
"enum": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"content commitment",
|
||||
"key encipherment",
|
||||
"key agreement",
|
||||
"data encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"encipher only",
|
||||
"decipher only",
|
||||
"any",
|
||||
"server auth",
|
||||
"client auth",
|
||||
"code signing",
|
||||
"email protection",
|
||||
"s/mime",
|
||||
"ipsec end system",
|
||||
"ipsec tunnel",
|
||||
"ipsec user",
|
||||
"timestamping",
|
||||
"ocsp signing",
|
||||
"microsoft sgc",
|
||||
"netscape sgc"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"issuerRef",
|
||||
"secretName"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.",
|
||||
"items": {
|
||||
"description": "CertificateCondition contains condition information for a Certificate.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is a human readable description of the details of the last\ntransition, complementing reason.",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Reason is a brief machine readable explanation for the condition's last\ntransition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the condition, one of (`True`, `False`, `Unknown`).",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of the condition, known values are (`Ready`, `Issuing`).",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"failedIssuanceAttempts": {
|
||||
"description": "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).",
|
||||
"type": "integer"
|
||||
},
|
||||
"lastFailureTime": {
|
||||
"description": "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"nextPrivateKeySecretName": {
|
||||
"description": "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.",
|
||||
"type": "string"
|
||||
},
|
||||
"notAfter": {
|
||||
"description": "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"notBefore": {
|
||||
"description": "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"renewalTime": {
|
||||
"description": "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"revision": {
|
||||
"description": "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,190 @@
|
||||
{
|
||||
"description": "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"duration": {
|
||||
"description": "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.",
|
||||
"type": "string"
|
||||
},
|
||||
"extra": {
|
||||
"additionalProperties": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"description": "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"type": "object"
|
||||
},
|
||||
"groups": {
|
||||
"description": "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"isCA": {
|
||||
"description": "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"issuerRef": {
|
||||
"description": "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.",
|
||||
"properties": {
|
||||
"group": {
|
||||
"description": "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind of the issuer being referred to.\nDefaults to 'Issuer'.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the issuer being referred to.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"request": {
|
||||
"description": "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"uid": {
|
||||
"description": "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"type": "string"
|
||||
},
|
||||
"usages": {
|
||||
"description": "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.",
|
||||
"items": {
|
||||
"description": "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"",
|
||||
"enum": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"content commitment",
|
||||
"key encipherment",
|
||||
"key agreement",
|
||||
"data encipherment",
|
||||
"cert sign",
|
||||
"crl sign",
|
||||
"encipher only",
|
||||
"decipher only",
|
||||
"any",
|
||||
"server auth",
|
||||
"client auth",
|
||||
"code signing",
|
||||
"email protection",
|
||||
"s/mime",
|
||||
"ipsec end system",
|
||||
"ipsec tunnel",
|
||||
"ipsec user",
|
||||
"timestamping",
|
||||
"ocsp signing",
|
||||
"microsoft sgc",
|
||||
"netscape sgc"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"username": {
|
||||
"description": "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"issuerRef",
|
||||
"request"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"description": "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"certificate": {
|
||||
"description": "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.",
|
||||
"format": "byte",
|
||||
"type": "string"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.",
|
||||
"items": {
|
||||
"description": "CertificateRequestCondition contains condition information for a CertificateRequest.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is a human readable description of the details of the last\ntransition, complementing reason.",
|
||||
"type": "string"
|
||||
},
|
||||
"reason": {
|
||||
"description": "Reason is a brief machine readable explanation for the condition's last\ntransition.",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "Status of the condition, one of (`True`, `False`, `Unknown`).",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"failureTime": {
|
||||
"description": "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,74 @@
|
||||
{
|
||||
"properties": {
|
||||
"data": {
|
||||
"properties": {
|
||||
"changes": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"data": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"data"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"charts": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"namespace",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"deletions": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"apiVersion",
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"data"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user