diff --git a/docs/manuals/spaces/howtos/self-hosted/deployment-reqs.md b/docs/manuals/spaces/howtos/self-hosted/deployment-reqs.md index 3814ceda..0ed6c8e1 100644 --- a/docs/manuals/spaces/howtos/self-hosted/deployment-reqs.md +++ b/docs/manuals/spaces/howtos/self-hosted/deployment-reqs.md @@ -12,7 +12,7 @@ its sole workload. ## Kubernetes version compatibility -Each Spaces release is tested against specific Kubernetes versions: +Upbound tests each Spaces release against specific Kubernetes versions: | Spaces Version | Tested Kubernetes Versions | |----------------|----------------------------| @@ -219,135 +219,14 @@ your `ClusterIssuer` name during install using: --set "certificates.space.clusterIssuer=" ``` -## Ingress - -To route requests from an external client (kubectl, ArgoCD, etc) to a -control plane, a Spaces deployment includes a default [Ingress] manifest. In -order to ease getting started scenarios, the current `Ingress` includes -configurations (properties and annotations) that assume that you installed the -commonly used [ingress-nginx ingress controller] in the cluster. This section -walks you through using a different `Ingress`, if that's something that your -organization needs. - -### Default manifest - -An example of what the current `Ingress` manifest included in a Spaces install -is below: - -```yaml -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: mxe-router-ingress - namespace: upbound-system - annotations: - nginx.ingress.kubernetes.io/use-regex: "true" - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" - nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" - nginx.ingress.kubernetes.io/proxy-request-buffering: "off" - nginx.ingress.kubernetes.io/proxy-body-size: "0" - nginx.ingress.kubernetes.io/proxy-http-version: "1.1" - nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - nginx.ingress.kubernetes.io/proxy-ssl-verify: "on" - nginx.ingress.kubernetes.io/proxy-ssl-secret: "upbound-system/mxp-hostcluster-certs" - nginx.ingress.kubernetes.io/proxy-ssl-name: spaces-router - nginx.ingress.kubernetes.io/configuration-snippet: | - more_set_headers "X-Request-Id: $req_id"; - more_set_headers "Request-Id: $req_id"; - more_set_headers "Audit-Id: $req_id"; -spec: - ingressClassName: nginx - tls: - - hosts: - - {{ .Values.ingress.host }} - secretName: mxe-router-tls - rules: - - host: {{ .Values.ingress.host }} - http: - paths: - - path: "/v1/controlPlanes" - pathType: Prefix - backend: - service: - name: spaces-router - port: - name: http -``` - -The notable pieces are: -1. Namespace - - - -This property represents the namespace that the spaces-router is deployed to. -In most cases this is `upbound-system`. - - - -2. proxy-ssl-* annotations - -The spaces-router pod terminates TLS using certificates located in the -mxp-hostcluster-certs `Secret` located in the `upbound-system` `Namespace`. - -3. proxy-* annotations - -Requests coming into the ingress-controller can be variable depending on what -the client is requesting. For example, `kubectl get crds` has different -requirements for the connection compared to a 'watch', for example -`kubectl get pods -w`. The ingress-controller is configured to be able to -account for either scenario. - - -4. configuration-snippets +## Exposing spaces externally -These commands add headers to the incoming requests that help with telemetry -and diagnosing problems within the system. - -5. Rules - -Requests coming into the control planes use a `/v1/controlPlanes` prefix and -need to be routed to the spaces-router. - - -### Using a different ingress manifest - -Operators can choose to use an `Ingress` manifest and ingress controller that -makes the most sense for their organization. If they want to turn off deploying -the default `Ingress` manifest, they can do so during installation by providing -the following parameter during installation: -```shell ---set ".Values.ingress.provision=false" -``` - -#### Considerations - - - - - -Operators will need to take into account the following considerations when -disabling the default `Ingress` deployment. - -1. Ensure the custom `Ingress` manifest is placed in the same namespace as the -`spaces-router` pod. -2. Ensure that the ingress is configured to use a `spaces-router` as a secure -backend and that the secret used is the mxp-hostcluster-certs secret. -3. Ensure that the ingress is configured to handle long-lived connections. -4. Ensure that the routing rule sends requests prefixed with -`/v1/controlPlanes` to the `spaces-router` using the `http` port. - - - - - +To route requests from external clients (kubectl, ArgoCD, etc.) to control planes, you must expose the spaces-router. Options include a LoadBalancer Service (recommended), Gateway API, or Ingress. See [Exposing Spaces externally][expose] for configuration and setup. [cert-manager]: https://cert-manager.io/ [Certificate Custom Resource]: https://cert-manager.io/docs/usage/certificate/ [ClusterIssuer]: https://cert-manager.io/docs/concepts/issuer/ -[ingress-nginx ingress controller]: https://kubernetes.github.io/ingress-nginx/deploy/ [installation ideas]: https://cert-manager.io/docs/installation/ -[Ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/ [Issuer Configuration]: https://cert-manager.io/docs/configuration/ [official-provider-families]: /manuals/packages/providers/provider-families [aws-eks]: https://aws.amazon.com/eks/ @@ -360,3 +239,4 @@ backend and that the secret used is the mxp-hostcluster-certs secret. [azure-limits]: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/request-limits-and-throttling [aws-ec2-limits]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/throttling.html#throttling-limits-rate-based [upjet]: https://github.com/upbound/upjet +[expose]: /manuals/spaces/howtos/self-hosted/ingress/ diff --git a/docs/manuals/spaces/howtos/self-hosted/ingress-nginx-migration.md b/docs/manuals/spaces/howtos/self-hosted/ingress-nginx-migration.md new file mode 100644 index 00000000..6f9c678b --- /dev/null +++ b/docs/manuals/spaces/howtos/self-hosted/ingress-nginx-migration.md @@ -0,0 +1,763 @@ +--- +title: Migrate away from ingress-nginx +sidebar_position: 7 +description: A guide on how to migrate from ingress-nginx +tier: "business" +--- + +import GlobalLanguageSelector, { CodeBlock } from '@site/src/components/GlobalLanguageSelector'; + + + +`ingress-nginx` is deprecated and will reach end-of-life in March 2026. This +guide covers migration options for existing Spaces deployments. + +For help choosing an exposure method, see [Exposing Spaces Externally][expose]. +Options vary by Spaces version. Select your Spaces version: + +* [Upgrading to Spaces 1.16+](#upgrading-to-spaces-116) +* [Staying on Spaces 1.15 or earlier](#migrate-while-on-spaces-115-or-earlier) + + +## Prerequisites + + +Set environment variables used throughout this guide: + +```bash +export SPACES_VERSION= # Example: 1.16.0 +export SPACES_ROUTER_HOST= # Example: proxy.example.com +``` + +Export your current Helm values to a file (or use an existing version-controlled +file): + +```bash +helm get values spaces -n upbound-system -o yaml > values.yaml +``` + +You'll merge new configuration into this file throughout the migration. + +## Upgrading to Spaces 1.16+ + +Choose your migration option: + +| Option | When to use | +|--------|-------------| +| [LoadBalancer Service](#loadbalancer-service-recommended) | Simplest setup, no additional components needed | +| [Gateway API](#gateway-api) | Already using Gateway API or need shared gateway | +| [Alternative ingress controller](#alternative-ingress-controller) | Already using Ingress, or need shared load balancer | + +All paths follow the same process: upgrade to 1.16+, switch exposure method, +then uninstall ingress-nginx. + + +### Upgrade to 1.16+ with Updated Ingress Values + +Spaces doesn't provision the Ingress resource by default and is now +controller-agnostic. + +Add the following to your `values.yaml` to keep ingress-nginx working: + +```yaml +ingress: + provision: true + host: proxy.example.com # Replace with your existing hostname + ingressClassName: nginx + annotations: + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + podLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/component: controller + namespaceLabels: + kubernetes.io/metadata.name: ingress-nginx +``` + +Upgrade Spaces to 1.16+: + +```bash +helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \ + --version ${SPACES_VERSION} \ + --namespace upbound-system \ + -f values.yaml \ + --wait +``` + +Verify ingress-nginx is still working before you continue. + +### LoadBalancer Service (Recommended) + +This section describes how to expose the `spaces-router` with a LoadBalancer +Service. + +:::important +Use a Network Load Balancer (L4), not an Application Load Balancer (L7). Spaces +uses long-lived connections for watch traffic that L7 load balancers may +timeout. +::: + +**1. Add the LoadBalancer Service configuration to your `values.yaml`** + +Add the configuration for your cloud: + + + +```yaml +externalTLS: + host: proxy.example.com # Must match your current router hostname + +router: + proxy: + service: + type: LoadBalancer + annotations: + service.beta.kubernetes.io/aws-load-balancer-type: external + service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing + service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip +``` + + + + + +```yaml +externalTLS: + host: proxy.example.com # Must match your current router hostname + +router: + proxy: + service: + type: LoadBalancer + annotations: + cloud.google.com/l4-rbs: enabled +``` + + + + + +```yaml +externalTLS: + host: proxy.example.com # Must match your current router hostname + +router: + proxy: + service: + type: LoadBalancer + annotations: {} +``` + + + +**2. Upgrade Spaces (Ingress stays running during transition)** + +```bash +helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \ + --version ${SPACES_VERSION} \ + --namespace upbound-system \ + -f values.yaml \ + --wait +``` + +**3. Get the new LoadBalancer address** + +```bash +kubectl get svc -n upbound-system spaces-router \ + -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' +``` + +**4. Validate before switching DNS** + +```bash +# Get spaces-router load balancer address +ROUTER_LB=$(kubectl get svc -n upbound-system spaces-router -o jsonpath='{.status.loadBalancer.ingress[0].hostname}') + +# Test connectivity using --connect-to to route to the new LB +curl --connect-to "${SPACES_ROUTER_HOST}:443:${ROUTER_LB}:443" "https://${SPACES_ROUTER_HOST}/version" +# Expected: 401 Unauthorized (routing works, auth required) +``` + +**5. Update your DNS record to point to the new LoadBalancer address** + +**6. Update your `values.yaml` to disable Ingress, then upgrade Spaces** + +```yaml +ingress: + provision: false +``` + +```bash +helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \ + --version ${SPACES_VERSION} \ + --namespace upbound-system \ + -f values.yaml \ + --wait +``` + +**7. Uninstall ingress-nginx** + +```bash +helm uninstall ingress-nginx --namespace ingress-nginx +``` + +### Gateway API + +Spaces supports the [Gateway API][gateway-api] as an alternative to Ingress. Gateway API is the +Kubernetes standard for traffic routing going forward. + + +**1. Install Envoy Gateway** + +```bash +helm install eg oci://docker.io/envoyproxy/gateway-helm \ + --namespace envoy-gateway-system \ + --create-namespace \ + --wait +``` + +See [Envoy Gateway installation docs][envoy-install] for more detailed instructions. + +**2. Create EnvoyProxy and GatewayClass** + +Create an `EnvoyProxy` resource that the GatewayClass references. See the [Envoy +Gateway EnvoyProxy docs][envoy-proxy] for the full API and more examples. + + + +```bash +kubectl apply -f - < + + + +```bash +kubectl apply -f - < + + + +```bash +kubectl apply -f - < + +Then create the `GatewayClass` that references this EnvoyProxy: + +```bash +kubectl apply -f - --server-side < + annotations: + # Add your controller's TLS passthrough annotations + podLabels: + # Labels matching your controller's pods + namespaceLabels: + # Labels matching your controller's namespace +``` + +**3. Upgrade Spaces** + +```bash +helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \ + --version ${SPACES_VERSION} \ + --namespace upbound-system \ + -f values.yaml \ + --wait +``` + +**4. Get the new load balancer address** + +```bash +kubectl get svc -n -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' +``` + +**5. Validate before switching DNS** + +Test connectivity using `--connect-to` so traffic reaches the new controller +before you change DNS: + +```bash +CONTROLLER_LB=$(kubectl get svc -n -o jsonpath='{.status.loadBalancer.ingress[0].hostname}') +curl --connect-to "${SPACES_ROUTER_HOST}:443:${CONTROLLER_LB}:443" "https://${SPACES_ROUTER_HOST}/version" +# Expected: 401 Unauthorized (routing works, auth required) +``` + +**6. Update your DNS record** to point to the new load balancer address. + +**7. Uninstall ingress-nginx** + +```bash +helm uninstall ingress-nginx --namespace ingress-nginx +``` + + +## Migrate while on Spaces 1.15 or earlier + + +Choose your migration option: + +| Option | When to use | +|--------|-------------| +| [Gateway API](#gateway-api-spaces-110) | Already using Gateway API or need shared gateway | +| [Traefik](#traefik-or-alternative-ingress-controller) | Migrate from nginx Ingress to alternative controller | + +Export your current Helm values to a file (or use your existing values file if +stored in Git): + +```bash +helm get values spaces -n upbound-system -o yaml > values.yaml +``` + + +### Gateway API (Spaces 1.10+) + + +Gateway API support has been available since Spaces 1.10. See [Gateway API +Configuration][gateway-api-config] for detailed setup instructions. + +:::note +Pre-1.16 Spaces doesn't support running Ingress and Gateway API +simultaneously. This migration requires switching over in a single upgrade, +which causes brief downtime during DNS propagation. +::: + + +**1. Install a gateway API controller** + +Install a Gateway API implementation that supports TLS passthrough and +`TLSRoute`. + +The following example uses Envoy Gateway: + +```bash +export ENVOY_GATEWAY_VERSION= # Example: v1.2.4 + +helm -n envoy-gateway-system upgrade --install --wait --wait-for-jobs \ + --timeout 300s --create-namespace envoy-gateway \ + oci://docker.io/envoyproxy/gateway-helm \ + --version "${ENVOY_GATEWAY_VERSION}" +``` + +**2. Create EnvoyProxy and GatewayClass** + +Create an `EnvoyProxy` resource, then the `GatewayClass` that references it. + + + +```bash +kubectl apply -f - < + + + +```bash +kubectl apply -f - < + + + +```bash +kubectl apply -f - < + +```bash +kubectl apply -f - --server-side < +:::tip +Configure Traefik's Service with NLB annotations. See +[Cloud-specific annotations][expose-annotate]. +::: + + +**2. Validate before switching DNS** + +```bash +# Get Traefik load balancer address +TRAEFIK_LB=$(kubectl get svc -n traefik traefik -o jsonpath='{.status.loadBalancer.ingress[0].hostname}') + +# Test connectivity using --connect-to to route to Traefik +curl --connect-to "${SPACES_ROUTER_HOST}:443:${TRAEFIK_LB}:443" "https://${SPACES_ROUTER_HOST}/version" +# Expected: 401 Unauthorized (routing works, auth required) +``` + +**3. Update DNS to point to Traefik** + +```bash +kubectl get svc -n traefik traefik -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' +``` + +Update your DNS record to this address. For gradual migration, use weighted DNS routing. + +**4. Preserve the nginx IngressClass before uninstalling ingress-nginx** + +```bash +helm upgrade ingress-nginx ingress-nginx \ + --repo https://kubernetes.github.io/ingress-nginx \ + --namespace ingress-nginx \ + --reuse-values \ + --set-json 'controller.ingressClassResource.annotations={"helm.sh/resource-policy": "keep"}' +``` + +**5. Uninstall ingress-nginx** + +```bash +helm uninstall ingress-nginx --namespace ingress-nginx +``` + +Keep `ingress.provision: true` so the Spaces chart continues to manage the +Ingress resource. Traefik picks it up via the nginx provider. + +## Verification + +After migration, verify connectivity: + +```bash +curl -v "https://${SPACES_ROUTER_HOST}/version" +# Expected: 401 Unauthorized +``` + +If you need to roll back, reinstall ingress-nginx, set `ingress.provision: true` +(and your previous ingress values) in Helm values, then upgrade Spaces again. + +[envoy-install]: https://gateway.envoyproxy.io/docs/install/ +[spaces-install]: /manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment/ +[traefik-migrate]: https://doc.traefik.io/traefik/migrate/nginx-to-traefik/ +[spaces-deploy]: /manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment/ +[k8s-announce]: https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-retirement/ +[expose]: /manuals/spaces/howtos/self-hosted/ingress/ +[expose-annotate]: /manuals/spaces/howtos/self-hosted/ingress/#cloud-specific-annotations +[gateway-api]: https://gateway-api.sigs.k8s.io/ +[gateway-api-config]: /manuals/spaces/howtos/self-hosted/ingress/#gateway-api diff --git a/docs/manuals/spaces/howtos/self-hosted/ingress.md b/docs/manuals/spaces/howtos/self-hosted/ingress.md new file mode 100644 index 00000000..a12bf600 --- /dev/null +++ b/docs/manuals/spaces/howtos/self-hosted/ingress.md @@ -0,0 +1,189 @@ +--- +title: Exposing Spaces externally +sidebar_position: 5 +description: Options for exposing Spaces externally +--- + +import { CodeBlock } from '@site/src/components/GlobalLanguageSelector'; + + +You can expose Spaces externally using one of three options: + +| Option | When to use | +|--------|-------------| +| LoadBalancer Service | Simplest setup, recommended for most deployments | +| Gateway API | Organization already using Gateway API, or need shared gateway across services | +| Ingress | Organization already using Ingress, or need shared load balancer across services | + +## LoadBalancer Service + + +Upbound recommends a LoadBalancer Service to expose `spaces-router`. + + +:::important +Use a Network Load Balancer (L4), not an Application Load Balancer (L7). Spaces +uses long-lived connections for watch traffic that L7 load balancers may +timeout. +::: + +### Configuration + +```yaml +externalTLS: + host: proxy.example.com # Externally routable hostname for TLS certificates + +router: + proxy: + service: + type: LoadBalancer + annotations: + # AWS NLB (see Cloud-Specific Annotations for other clouds) + service.beta.kubernetes.io/aws-load-balancer-type: external + service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing + service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip +``` + +See [Cloud-Specific Annotations](#cloud-specific-annotations) for GCP and Azure. + + +### Get the LoadBalancer address + + +After installation: + +```bash +kubectl get svc -n upbound-system spaces-router \ + -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' +``` + +Create or update a DNS record pointing your `externalTLS.host` to this address. + +## Ingress + +Use Ingress if you need to share a load balancer across multiple services or +have specific networking requirements. + +### Requirements + +- TLS passthrough support in your Ingress controller +- Network Load Balancer (L4) strongly recommended for long-lived connections + +Configure your Ingress controller's Service with [NLB annotations](#cloud-specific-annotations). + + +### Configuration + +```yaml +ingress: + provision: true + host: proxy.example.com + ingressClassName: "" + # Annotations to add to the Ingress resource + annotations: {} + # Pod labels of the Ingress controller - used for network policy + podLabels: {} + # Namespace labels of the Ingress controller - used for network policy + namespaceLabels: {} +``` + +### Traefik (with nginx provider) + +Traefik can use the [kubernetesIngressNGINX provider][traefik-provider] to +handle nginx-style Ingress resources with TLS passthrough. + +```yaml +ingress: + provision: true + host: proxy.example.com + ingressClassName: nginx + annotations: + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + podLabels: + app.kubernetes.io/name: traefik + namespaceLabels: + kubernetes.io/metadata.name: traefik +``` + +## Gateway API + +Spaces supports the [Gateway API][gateway-api-docs]. Use this option if your +organization is already using Gateway API or needs a shared gateway across +multiple services. + +### Requirements + +- A Gateway API controller (for example, Envoy Gateway, Cilium, or Traefik) +- Gateway API CRDs installed in your cluster +- TLS passthrough support +- Network Load Balancer (L4) strongly recommended + +For step-by-step setup including installing a controller (such as Envoy Gateway) and creating the GatewayClass, see [Migrate away from ingress-nginx - Gateway API][migration-gateway-api]. + +### Gateway API configuration + +Add the following to your Helm values (or use `--set` when upgrading). Disable Ingress when using Gateway API. + +```yaml +gatewayAPI: + host: proxy.example.com # Externally routable hostname; must match your DNS + gateway: + provision: true + name: spaces + className: spaces # Must match your GatewayClass name + spacesRouterRoute: + provision: true + podLabels: + app.kubernetes.io/name: envoy + app.kubernetes.io/component: proxy + app.kubernetes.io/managed-by: envoy-gateway + namespaceLabels: + kubernetes.io/metadata.name: envoy-gateway-system +``` + +The `podLabels` and `namespaceLabels` must match your Gateway API controller's pods and namespace (for NetworkPolicy). The example above uses Envoy Gateway; adjust for your controller. + +Install or upgrade Spaces with these values: + +```bash +helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \ + --namespace upbound-system \ + -f values.yaml \ + --wait +``` + +### Get the gateway address + +After your controller has configured the Gateway: + +```bash +kubectl get gateway -n upbound-system spaces \ + -o jsonpath='{.status.addresses[0].value}' +``` + +Create or update a DNS record so that `gatewayAPI.host` points to this address. + +### Troubleshooting + +- **Gateway status:** Run `kubectl get gateway -n upbound-system spaces -o yaml`. Look for `Accepted` and `Programmed` in `status.conditions`. +- **TLSRoute status:** Run `kubectl get tlsroute -n upbound-system spaces-router -o yaml`. The route should show `Accepted: True`. +- **Connectivity:** Run `curl -k "https:///version"`. Expected response is `401 Unauthorized` (routing works, auth required). + +## Cloud-specific annotations + +Network Load Balancers (L4) are strongly recommended. Spaces uses long-lived +watch connections (hours or days) for kubectl and ArgoCD. L7 load balancers may +timeout these connections. Use these annotations on the LoadBalancer Service +(spaces-router, Ingress controller, or Gateway). + +| Cloud | Annotations | +|-------|-------------| +| **AWS** | `service.beta.kubernetes.io/aws-load-balancer-type: external`
`service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing`
`service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip` | +| **GCP** | `cloud.google.com/l4-rbs: enabled` | +| **Azure** | None required (L4 by default) | + + +[traefik-provider]: https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx/ +[gateway-api-docs]: https://gateway-api.sigs.k8s.io/ +[migration-gateway-api]: /manuals/spaces/howtos/self-hosted/ingress-nginx-migration/#gateway-api diff --git a/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md b/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md index f36be319..645f80dc 100644 --- a/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md +++ b/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md @@ -81,7 +81,7 @@ kind: ClusterConfig metadata: name: ${SPACES_CLUSTER_NAME} region: ${SPACES_REGION} - version: "1.29" + version: "1.34" managedNodeGroups: - name: ng-1 instanceType: m5.xlarge @@ -110,6 +110,9 @@ addons: - name: aws-ebs-csi-driver wellKnownPolicies: ebsCSIController: true + configurationValues: |- + defaultStorageClass: + enabled: true EOF ``` @@ -210,10 +213,10 @@ export SPACES_TOKEN_PATH="/path/to/token.json" Set the version of Spaces software you want to install. ```ini -export SPACES_VERSION= +export SPACES_VERSION="1.16.0" ``` -Set the router host and cluster type. The `SPACES_ROUTER_HOST` is the domain name that's used to access the control plane instances. It's used by the ingress controller to route requests. +Set the router host and cluster type. The `SPACES_ROUTER_HOST` is the domain name that's used to access the control plane instances. It's used by the load balancer or ingress to route requests. ```ini export SPACES_ROUTER_HOST="proxy.upbound-127.0.0.1.nip.io" @@ -232,13 +235,15 @@ Make sure to replace the placeholder text in `SPACES_ROUTER_HOST` and provide a Install cert-manager. ```bash -kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml +kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.19.3/cert-manager.yaml kubectl wait deployment -n cert-manager cert-manager-webhook --for condition=Available=True --timeout=360s ``` -### Install ALB Load Balancer +### Install AWS Load Balancer Controller + +The AWS Load Balancer Controller provisions a Network Load Balancer when you expose the spaces-router Service with the annotations in the next step. ```bash helm install aws-load-balancer-controller aws-load-balancer-controller --namespace kube-system \ @@ -251,30 +256,32 @@ helm install aws-load-balancer-controller aws-load-balancer-controller --namespa -### Install ingress-nginx +### Expose spaces with LoadBalancer (recommended) + +This guide exposes Spaces using a LoadBalancer Service on the spaces-router. You don't need an ingress or gateway. + +:::important +Use a Network Load Balancer (L4), not an Application Load Balancer (L7). Spaces uses long-lived connections for watch traffic that L7 load balancers may timeout. +::: -Starting with Spaces v1.10.0, you need to configure the ingress-nginx -controller to allow SSL-passthrough mode. You can do so by passing the -`--enable-ssl-passthrough=true` command-line option to the controller. -The following Helm install command enables this with the `controller.extraArgs` -parameter: +Create a values file using `SPACES_ROUTER_HOST` (or use the same `--set` flags in the Helm install below). Run the command for your cloud: ```bash -helm upgrade --install ingress-nginx ingress-nginx \ - --create-namespace --namespace ingress-nginx \ - --repo https://kubernetes.github.io/ingress-nginx \ - --version 4.12.1 \ - --set 'controller.service.type=LoadBalancer' \ - --set 'controller.extraArgs.enable-ssl-passthrough=true' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type=external' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-scheme=internet-facing' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-nlb-target-type=ip' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-healthcheck-protocol=http' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-healthcheck-path=/healthz' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-healthcheck-port=10254' \ - --wait +cat < values.yaml +externalTLS: + host: ${SPACES_ROUTER_HOST} + +router: + proxy: + service: + type: LoadBalancer + annotations: + service.beta.kubernetes.io/aws-load-balancer-type: external + service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing + service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip +EOF ``` @@ -282,14 +289,17 @@ helm upgrade --install ingress-nginx ingress-nginx \ ```bash -helm upgrade --install ingress-nginx ingress-nginx \ - --create-namespace --namespace ingress-nginx \ - --repo https://kubernetes.github.io/ingress-nginx \ - --version 4.12.1 \ - --set 'controller.service.type=LoadBalancer' \ - --set 'controller.extraArgs.enable-ssl-passthrough=true' \ - --set 'controller.service.annotations.service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path=/healthz' \ - --wait +cat < values.yaml +externalTLS: + host: ${SPACES_ROUTER_HOST} + +router: + proxy: + service: + type: LoadBalancer + # Azure uses L4 by default; add annotations if needed for your setup + annotations: {} +EOF ``` @@ -297,17 +307,25 @@ helm upgrade --install ingress-nginx ingress-nginx \ ```bash -helm upgrade --install ingress-nginx ingress-nginx \ - --create-namespace --namespace ingress-nginx \ - --repo https://kubernetes.github.io/ingress-nginx \ - --version 4.12.1 \ - --set 'controller.service.type=LoadBalancer' \ - --set 'controller.extraArgs.enable-ssl-passthrough=true' \ - --wait +cat < values.yaml +externalTLS: + host: ${SPACES_ROUTER_HOST} + +router: + proxy: + service: + type: LoadBalancer + annotations: + cloud.google.com/l4-rbs: enabled +EOF ``` +:::tip +To use Gateway API or Ingress instead of LoadBalancer, see [Exposing Spaces externally][expose]. +::: + ### Install Upbound Spaces software Create an image pull secret so that the cluster can pull Upbound Spaces images. @@ -326,13 +344,13 @@ Log in with Helm to be able to pull chart images for the installation commands. jq -r .token $SPACES_TOKEN_PATH | helm registry login xpkg.upbound.io -u $(jq -r .accessId $SPACES_TOKEN_PATH) --password-stdin ``` -Install the Spaces software. +Install the Spaces software. Use the `values.yaml` file you created in the previous step (with `externalTLS.host` and `router.proxy.service`). ```bash helm -n upbound-system upgrade --install spaces \ oci://xpkg.upbound.io/spaces-artifacts/spaces \ --version "${SPACES_VERSION}" \ - --set "ingress.host=${SPACES_ROUTER_HOST}" \ + -f values.yaml \ --set "account=${UPBOUND_ACCOUNT}" \ --set "authentication.hubIdentities=true" \ --set "authorization.hubRBAC=true" \ @@ -342,18 +360,15 @@ helm -n upbound-system upgrade --install spaces \ ### Create a DNS record :::important - -If you chose to create a public ingress, you also need to create a DNS record for the load balancer of the public facing ingress. Do this before you create your first control plane. - +Create a DNS record for the spaces-router load balancer before you create your first control plane. ::: -Create a DNS record for the load balancer of the public facing ingress. To get the address for the Ingress, run the following: +Get the load balancer address for the spaces-router Service: ```bash -kubectl get ingress \ - -n upbound-system mxe-router-ingress \ +kubectl get svc -n upbound-system spaces-router \ -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' ``` @@ -362,8 +377,7 @@ kubectl get ingress \ ```bash -kubectl get ingress \ - -n upbound-system mxe-router-ingress \ +kubectl get svc -n upbound-system spaces-router \ -o jsonpath='{.status.loadBalancer.ingress[0].ip}' ``` @@ -372,14 +386,16 @@ kubectl get ingress \ ```bash -kubectl get ingress \ - -n upbound-system mxe-router-ingress \ +kubectl get svc -n upbound-system spaces-router \ -o jsonpath='{.status.loadBalancer.ingress[0].ip}' ``` -If the preceding command doesn't return a load balancer address then your provider may not have allocated it yet. Once it's available, add a DNS record for the `ROUTER_HOST` to point to the given load balancer address. If it's an IPv4 address, add an A record. If it's a domain name, add a CNAME record. +If the preceding command doesn't return a load balancer address then your +provider may not have allocated it yet. Once it's available, add a DNS record +for the `ROUTER_HOST` to point to the given load balancer address. If it's an +IPv4 address, add an A record. If it's a domain name, add a CNAME record. ## Configure the up CLI @@ -439,7 +455,12 @@ kubectl wait controlplane ctp1 --for condition=Ready=True --timeout=360s ## Connect to your control plane -Connect to your control plane with the `up ctx` command. With your kubeconfig still pointed at the Kubernetes cluster where you installed the Upbound Space, run the following: + +Connect to your control plane with the up ctx command. With your kubeconfig +still pointed at the Kubernetes cluster where you installed the Upbound Space, +run the following: + + ```bash up ctx ./default/ctp1 @@ -463,3 +484,4 @@ Learn how to use the up CLI to navigate around Upbound by reading the [up ctx co [up-ctx-command-reference]: /reference/cli-reference [contact-upbound]: https://www.upbound.io/contact-us +[expose]: /manuals/spaces/howtos/self-hosted/ingress/ diff --git a/docs/manuals/spaces/howtos/self-hosted/troubleshooting.md b/docs/manuals/spaces/howtos/self-hosted/troubleshooting.md index 4ddcce5a..0a8fcfb7 100644 --- a/docs/manuals/spaces/howtos/self-hosted/troubleshooting.md +++ b/docs/manuals/spaces/howtos/self-hosted/troubleshooting.md @@ -24,7 +24,6 @@ NAMESPACE NAME cert-manager cert-manager-6d6769565c-mc5df 1/1 Running 0 25m cert-manager cert-manager-cainjector-744bb89575-nw4fg 1/1 Running 0 25m cert-manager cert-manager-webhook-759d6dcbf7-ps4mq 1/1 Running 0 25m -ingress-nginx ingress-nginx-controller-7f8ccfccc6-6szlp 1/1 Running 0 25m kube-system coredns-5d78c9869d-4p477 1/1 Running 0 26m kube-system coredns-5d78c9869d-pdxt6 1/1 Running 0 26m kube-system etcd-kind-control-plane 1/1 Running 0 26m @@ -60,7 +59,7 @@ What you are seeing is: - Pods in the `upbound-system` namespace are components required to run the management plane of the Space. This includes the `spaces-controller`, `spaces-router`, and install of UXP. - Pods in the `mxp-{GUID}-system` namespace are components that collectively power a control plane. Notable call outs include pod names that look like `vcluster-api-{GUID}` and `vcluster-controller-{GUID}`, which are integral components of a control plane. -- Pods in other notable namespaces, including `cert-manager` and `ingress-nginx`, are prerequisite components that support a Space's successful operation. +- Pods in other namespaces such as `cert-manager` are prerequisites. If you expose Spaces with an ingress controller or Gateway API, you also see pods in that component's namespace (for example, `ingress-nginx` or `envoy-gateway-system`). See [Exposing Spaces externally][expose] for options. @@ -130,3 +129,4 @@ If you try to install a Space on an existing cluster that previously had Crosspl [observability]: /manuals/spaces/howtos/observability [remove-old-crossplane-crds]: https://docs.crossplane.io/latest/guides/uninstall-crossplane/ +[expose]: /manuals/spaces/howtos/self-hosted/ingress/ diff --git a/docs/reference/release-notes/spaces.md b/docs/reference/release-notes/spaces.md index fe7356a0..4eed4f74 100644 --- a/docs/reference/release-notes/spaces.md +++ b/docs/reference/release-notes/spaces.md @@ -21,6 +21,96 @@ Any important warnings or necessary information - User-facing changes --> +## v1.16.0 + +### Release Date: 2026-03-09 + +#### Breaking Changes + +:::important + +- **Ingress is no longer provisioned by default.** The Ingress resource is now + controller-agnostic. All ingress-nginx specific annotations, labels, and the + hardcoded `ingressClassName: nginx` have been removed. To keep existing + ingress-nginx working, add the following to your Helm values: + + ```yaml + ingress: + provision: true + host: proxy.example.com # Replace with your existing hostname + ingressClassName: nginx + annotations: + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + podLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/component: controller + namespaceLabels: + kubernetes.io/metadata.name: ingress-nginx + ``` + + For other controllers, set `ingress.provision: true`, + `ingress.ingressClassName: ""`, and add controller-specific + `ingress.annotations`, `ingress.podLabels`, and `ingress.namespaceLabels` as + needed. ingress-nginx is deprecated upstream (EOL March 2026). See the + [ingress-nginx migration guide](/manuals/spaces/howtos/self-hosted/ingress-nginx-migration/) + for details. Recommended alternatives: LoadBalancer Service (simplest), + Gateway API, or any Ingress controller with TLS passthrough support. + +- **LogCollector tolerations:** Tolerations for the LogCollector daemonset have been + moved from `observability.collectors.tolerations` to + `observability.collectors.logCollector.tolerations`. Update your Helm values if + you use custom tolerations for the LogCollector. + +::: + +#### Important Changes + +- Spaces Apollo (Query API) was updated to v0.4.7 with stability fixes for ensuring + data is properly synced. +- Control plane images updated (XGQL, VCluster, CoreDNS, etcd, kube-state-metrics). + +#### Features + +- **Spaces Router via LoadBalancer:** You can expose the Spaces Router directly + with a LoadBalancer Service, without an ingress controller or gateway. + Use `externalTLS.host` for the externally routable hostname for TLS. +- **Ingress and Gateway API together:** Run both at once for zero-downtime + migration from ingress-nginx. See the [migration + guide](/manuals/spaces/howtos/self-hosted/ingress-nginx-migration/). +- **Observability:** + - Added support for `prometheus.io/path` annotation in the control plane telemetry + collector (custom metrics paths with fallback to `/metrics`). + - Added support for `observability.spacesCollector.env` for injecting environment variables + into the Spaces OpenTelemetry Collector pods. + - Added support for the OTEL Filter Processor in SharedTelemetryConfigs to drop + metrics, logs, or traces. + - [Tracing can be enabled in Apollo](/manuals/spaces/howtos/self-hosted/observability/tracing/query-api/). + - [Spaces API is now instrumented with tracing](/manuals/spaces/howtos/self-hosted/observability/tracing/spaces-api/). + - Resources for the LogCollector daemonset are configurable via + `observability.collectors.logCollector.resources`. + - Added support for the Splunk HEC exporter in SharedTelemetryConfigs. +- **Certificate automation:** Services reload the Spaces CA automatically; leaf + certificates renew when the Spaces CA is renewed. The `spaces-ca-bundle` + includes both old and new CAs for seamless rotation. For zero downtime with + webhooks during CA renewal, use cert-manager v1.19+ or enable the + CAInjectorMerging feature flag in cert-manager 1.17+. +- **UXP v2 is now enabled by default.** Users can create UXP v2 ControlPlanes + without additional configuration. This can be disabled by explicitly setting + `controlPlanes.uxp.v2.enabled` to `false` if needed. +- Controllers are automatically upgraded when a ControllerRuntimeConfig is updated. + +#### Bug Fixes + +- SharedTelemetry now properly cleans up its `status.provisioned`, + `status.failed`, and `status.selected` after a control plane is deleted. +- ProviderConfig, ProviderConfigUsage, and ClusterProviderConfig are no longer + counted as Managed Resources by the UXP metering controller. + +#### Other Changes + +- Default resource requests added to `external-secrets-operator` Deployments. +- Spaces Apollo image registry updated to `xpkg.upbound.io/spaces-artifacts`. ## v1.15.2 diff --git a/docs/reference/spaces-helm-reference.md b/docs/reference/spaces-helm-reference.md index 33136938..913a22dd 100644 --- a/docs/reference/spaces-helm-reference.md +++ b/docs/reference/spaces-helm-reference.md @@ -14,7 +14,7 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | Repository | Name | Version | |------------|------|---------| -| oci://xpkg.upbound.io/spaces-artifacts | apollo(uxp-apollo) | 0.2.11 | +| oci://xpkg.upbound.io/spaces-artifacts | apollo(uxp-apollo) | 0.4.7 | ## Values @@ -59,11 +59,22 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | apollo.apollo.apiserver.service.admin.port | int | `8444` | | | apollo.apollo.apiserver.service.api.port | int | `8443` | | | apollo.apollo.mode.deploymentMode | string | `"multi-tenant"` | | +| apollo.apollo.observability.enabled | bool | `false` | | +| apollo.apollo.observability.tracing.enabled | bool | `false` | | +| apollo.apollo.observability.tracing.endpoint | string | `"telemetry-spaces-collector.upbound-system.svc.cluster.local"` | | +| apollo.apollo.observability.tracing.insecure | bool | `false` | | +| apollo.apollo.observability.tracing.port | int | `4317` | | +| apollo.apollo.observability.tracing.sampling.rate | float | `0.1` | | +| apollo.apollo.observability.tracing.serviceName | string | `"spaces-apollo"` | | +| apollo.apollo.observability.tracing.tls.caBundleSecretRef | string | `"spaces-ca-bundle"` | | | apollo.apollo.priorityClassName | string | `"spaces-system-high-priority"` | | +| apollo.apollo.secretRefs.spacesCa.key | string | `"ca-bundle.pem"` | | +| apollo.apollo.secretRefs.spacesCa.name | string | `"spaces-ca-bundle"` | | | apollo.apollo.storage.postgres.create | bool | `true` | | | apollo.apollo.storage.postgres.sidecar | bool | `false` | | | apollo.apollo.syncer.enabled | bool | `false` | | -| apollo.apollo.syncer.image.tag | string | `"v0.2.11"` | | +| apollo.apollo.syncer.image.tag | string | `"v0.4.7"` | | +| apollo.registry | string | `"xpkg.upbound.io/spaces-artifacts"` | | | authentication.hubIdentities | bool | `true` | This enables respecting built in Kubernetes identities (clientcertificate, managed kubernetes OIDC, Kubernetes Groups, etc) specified within the Connected Space's hub. | | authentication.structuredConfig | string | `""` | Enables consumption of JWT Authenticators via Authentication Configuration per https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration
The below property takes the name of a configmap that contains a structured authentication configuration. | | authorization.hubRBAC | bool | `true` | This enables respecting built in Kubernetes Roles and RoleBindings for the resources included in the Space's installation. | @@ -176,7 +187,7 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | controlPlanes.uxp.xgql.resources.limits.memory | string | `"1Gi"` | Memory limit for the spaces control plane xgql pod. | | controlPlanes.uxp.xgql.resources.requests.cpu | string | `"50m"` | CPU request for the spaces control plane xgql pod. | | controlPlanes.uxp.xgql.resources.requests.memory | string | `"50Mi"` | Memory request for the spaces control plane xgql pod. | -| controlPlanes.uxp.xgql.version | string | `"v0.2.0-rc.0.178.g070bbbf"` | The tag of the xgql image to deploy. | +| controlPlanes.uxp.xgql.version | string | `"v0.2.0-rc.0.180.g864b87f"` | The tag of the xgql image to deploy. | | controlPlanes.vcluster.affinity | object | `{}` | Configure [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for vcluster Pods. | | controlPlanes.vcluster.extraSyncLabels | string | `""` | Extra pod labels to be synced by the vcluster. This is a string consisting of a comma-separated list of label keys. | | controlPlanes.vcluster.resources.limits.cpu | string | `"3000m"` | CPU limit for the spaces control plane vcluster pod. | @@ -252,10 +263,11 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | controller.webhookInit.image.repository | string | `"hyperspace"` | The repository for the spaces controller webhook init container image. | | controller.webhookInit.image.tag | string | `""` | The tag for the spaces controller webhook init container image. | | development | object | `{}` | Development only configurations, not for production use. @schema additionalProperties: true @schema | -| externalTLS | object | `{"caBundleSecret":{"key":"ca.crt","name":""},"tlsSecret":{"name":""}}` | TLS configuration for the external traffic. | +| externalTLS | object | `{"caBundleSecret":{"key":"ca.crt","name":""},"host":"","tlsSecret":{"name":""}}` | TLS configuration for the external traffic. | | externalTLS.caBundleSecret | object | `{"key":"ca.crt","name":""}` | CA secret configuration for external traffic. spaces-router will use this CA (if not in insecure mode) and ingress-public configmap will contain this CA bundle. | | externalTLS.caBundleSecret.key | string | `"ca.crt"` | Key of the external CA secret that contains the CA bundle. | | externalTLS.caBundleSecret.name | string | `""` | Name of the secret containing the external CA bundle. | +| externalTLS.host | string | `""` | Specifies the externally routable hostname for Spaces. If empty, falls back to gatewayAPI.host or ingress.host. | | externalTLS.tlsSecret | object | `{"name":""}` | TLS secret name that contains the serving certificate and key. | | externalTLS.tlsSecret.name | string | `""` | Name of the secret containing the TLS serving certificate and key. | | features.alpha | object | { ... } | NOTE: Alpha features are subject to removal or breaking changes without notice, and generally not considered ready for use in production. They have to be optional even if they are enabled. | @@ -285,18 +297,19 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | gatewayAPI.gateway.provision | bool | `false` | Specifies whether the helm chart should provision the Gateway resource for routing external traffic into the cluster. | | gatewayAPI.host | string | `"proxy.upbound-127.0.0.1.nip.io"` | Specifies the externally routable hostname used for routing requests to individual control planes. | | gatewayAPI.insecure | bool | `false` | Disable TLS at the endpoints | -| gatewayAPI.namespaceLabels | object | `{}` | Labels that are defined on the namespace of the Envoy proxy pod. Default value is:
kubernetes.io/metadata.name: envoy-gateway-system | -| gatewayAPI.podLabels | object | `{}` | Labels that are defined on the Envoy proxy pod. Default value is:
app.kubernetes.io/name: envoy
app.kubernetes.io/component: proxy
app.kubernetes.io/managed-by: envoy-gateway | +| gatewayAPI.namespaceLabels | object | `{}` | Labels that identify the namespace containing the Gateway API pods. Used in NetworkPolicy rules along with podLabels to allow traffic from the gateway to spaces-router. Example for Envoy Gateway: kubernetes.io/metadata.name: envoy-gateway-system | +| gatewayAPI.podLabels | object | `{}` | Labels that identify the Gateway API pods. Used in NetworkPolicy rules to allow traffic from the gateway to spaces-router. Must match your Gateway implementation's pod labels. Example for Envoy Gateway: app.kubernetes.io/name: envoy app.kubernetes.io/component: proxy app.kubernetes.io/managed-by: envoy-gateway | | gatewayAPI.spacesRouterRoute | object | { ... } | Configurations for the TLS or HTTP route that forwards external traffic into spaces-router. | | gatewayAPI.spacesRouterRoute.provision | bool | `false` | Specifies whether the Helm chart should provision the TLSRoute or HTTPRoute resource (depending on how spaces-router is configured) for routing traffic to spaces-router. | | imagePullSecrets | list | `[{"name":"upbound-pull-secret"}]` | NOTE: only an imagePullSecret of "upbound-pull-secret" is currently supported. | -| ingress | object | `{"annotations":{},"host":"proxy.upbound-127.0.0.1.nip.io","insecure":false,"namespaceLabels":{},"podLabels":{},"provision":true}` | Configurations for external requests coming into the space. | -| ingress.annotations | object | `{}` | Allows setting ingress annotations for the external facing Ingress that terminates at the spaces-router deployment. | +| ingress | object | `{"annotations":{},"host":"proxy.upbound-127.0.0.1.nip.io","ingressClassName":"","insecure":false,"namespaceLabels":{},"podLabels":{},"provision":false}` | Configurations for the Ingress resource. | +| ingress.annotations | object | `{}` | Allows setting ingress annotations for the external facing Ingress that terminates at the spaces-router deployment. Use this for controller-specific configuration. | | ingress.host | string | `"proxy.upbound-127.0.0.1.nip.io"` | Specifies the externally routable hostname used for routing requests to individual control planes. | -| ingress.insecure | bool | `false` | Disable TLS at the endpoints | -| ingress.namespaceLabels | object | `{}` | .Labels that are defined on the namespace of ingress-nginx pod. Default value is:
kubernetes.io/metadata.name: ingress-nginx | -| ingress.podLabels | object | `{}` | Labels that are defined on the ingress-nginx pod. Default value is:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/component: controller
app.kubernetes.io/name: ingress-nginx | -| ingress.provision | bool | `true` | Specifies whether the helm chart should create an Ingress resource for routing requests to the spaces-router. | +| ingress.ingressClassName | string | `""` | The IngressClass name to use. Must match the name of an IngressClass in your cluster. Leave empty to use the cluster's default IngressClass. | +| ingress.insecure | bool | `false` | Disable TLS at the endpoints. | +| ingress.namespaceLabels | object | `{}` | Labels that identify the namespace containing the ingress controller pods. Used in NetworkPolicy rules along with podLabels to allow traffic from the ingress controller to spaces-router. Example for Traefik: kubernetes.io/metadata.name: traefik | +| ingress.podLabels | object | `{}` | Labels that identify the ingress controller pods. Used in NetworkPolicy rules to allow traffic from the ingress controller to spaces-router. Must match your ingress controller's pod labels. Example for Traefik: app.kubernetes.io/name: traefik | +| ingress.provision | bool | `false` | Specifies whether the helm chart should create an Ingress resource for routing requests to the spaces-router. | | metering.aggregationInterval | string | `"1h"` | How often to aggregate measurements into hourly usage data. | | metering.enabled | bool | `false` | This enables metering collection for control planes. | | metering.interval | string | `"1m"` | How often to collect measurements from control planes. | @@ -311,15 +324,20 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | metering.storage.postgres.connection.url | string | `""` | The connection URL (host:port format, e.g., "postgres.example.com:5432"). | | metering.workerCount | int | `10` | Number of workers for parallel measurement collection. | | nameOverride | string | `""` | The name of the chart. | -| observability.collectors | object | `{"apiServer":{"auditPolicy":""},"includeSystemTelemetry":false,"repository":"opentelemetry-collector-spaces","resources":{"limits":{"cpu":"100m","memory":"1Gi"},"requests":{"cpu":"10m","memory":"100Mi"}},"tag":"","tolerations":[]}` | Observability configuration to collect metrics and traces ( and logs in the future) from the Control Plane.
Use SharedTelemetryConfig API to configure the exporters for Control Planes and Control Plane Groups.
Control Plane telemetry collection is disabled by default and gated by the "features.alpha.observability.enabled" parameter. | +| observability.collectors | object | `{"apiServer":{"auditPolicy":""},"includeSystemTelemetry":false,"logCollector":{"resources":{"limits":{"cpu":null,"memory":null},"requests":{"cpu":"10m","memory":"100Mi"}},"tolerations":[]},"repository":"opentelemetry-collector-spaces","resources":{"limits":{"cpu":"100m","memory":"1Gi"},"requests":{"cpu":"10m","memory":"100Mi"}},"tag":""}` | Observability configuration to collect metrics and traces ( and logs in the future) from the Control Plane.
Use SharedTelemetryConfig API to configure the exporters for Control Planes and Control Plane Groups.
Control Plane telemetry collection is disabled by default and gated by the "features.alpha.observability.enabled" parameter. | | observability.collectors.includeSystemTelemetry | bool | `false` | If true, control plane telemetry will emit telemetry data from control plane system components, such as the api server, etcd. | +| observability.collectors.logCollector | object | `{"resources":{"limits":{"cpu":null,"memory":null},"requests":{"cpu":"10m","memory":"100Mi"}},"tolerations":[]}` | Resource configuration for the control-plane-log-collector DaemonSet that runs on host nodes to aggregate logs from control planes with logging enabled. | +| observability.collectors.logCollector.resources.limits.cpu | string | `nil` | CPU limit for the log collector DaemonSet pods. | +| observability.collectors.logCollector.resources.limits.memory | string | `nil` | Memory limit for the log collector DaemonSet pods. | +| observability.collectors.logCollector.resources.requests.cpu | string | `"10m"` | CPU request for the log collector DaemonSet pods. | +| observability.collectors.logCollector.resources.requests.memory | string | `"100Mi"` | Memory request for the log collector DaemonSet pods. | +| observability.collectors.logCollector.tolerations | list | `[]` | Tolerations for the log collector DaemonSet pods. | | observability.collectors.repository | string | `"opentelemetry-collector-spaces"` | Repository for the OpenTelemetry collector image. | | observability.collectors.resources.limits.cpu | string | `"100m"` | CPU limit for the OpenTelemetry collector pod. | | observability.collectors.resources.limits.memory | string | `"1Gi"` | Memory limit for the OpenTelemetry collector pod. | | observability.collectors.resources.requests.cpu | string | `"10m"` | CPU request for the OpenTelemetry collector pod. | | observability.collectors.resources.requests.memory | string | `"100Mi"` | Memory request for the OpenTelemetry collector pod. | | observability.collectors.tag | string | `""` | Tag for the OpenTelemetry collector image. | -| observability.collectors.tolerations | list | `[]` | Tolerations for the telemetry log collectors daemonset pods. | | observability.enabled | bool | `false` | This enables the observability feature within this space.
Enabling observability requires OpenTelemetry Operator for Kubernetes to be installed in the cluster. See https://opentelemetry.io/docs/kubernetes/operator/ | | observability.spacesCollector | object | `{"config":{"exportPipeline":{"logs":[],"metrics":[],"traces":[]},"exporters":{"debug":null}},"env":[],"repository":"opentelemetry-collector-spaces","resources":{"limits":{"cpu":"100m","memory":"1Gi"},"requests":{"cpu":"10m","memory":"100Mi"}},"tag":""}` | Observability configuration to collect metric and logs from the Spaces machinery and send them to the specified exporters. When enabled, collects metrics from Spaces infrastructure components including router control plane and Envoy proxy metrics (timeouts, status codes, latency, circuit breakers). | | observability.spacesCollector.config.exportPipeline | object | `{"logs":[],"metrics":[],"traces":[]}` | The space-level OpenTelemetry collector exporter configuration.
otlphttp:
endpoint: https://otlp.eu01.nr-data.net
headers:
api-key: "${env:API_KEY}"
| @@ -344,7 +362,7 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | observability.tracing.tls | object | `{"caBundleSecretRef":""}` | TLS configuration for the telemetry collector connection. | | observability.tracing.tls.caBundleSecretRef | string | `""` | Name of the secret containing a CA bundle for validating the telemetry collector's certificate. The secret must contain a key named 'ca.crt' with the PEM-encoded CA bundle. Use this when connecting to external collectors. If empty, uses the Spaces CA for in-cluster collectors. | | registry | string | `"xpkg.upbound.io/spaces-artifacts"` | Specifies the registry where the containers used in the spaces deployment are served from. | -| router | object | `{"controlPlane":{"command":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"pullPolicy":"IfNotPresent","repository":"hyperspace","tag":""},"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"100m","memory":"100Mi"}},"service":{"auth":{"port":9000},"grpc":{"port":8081},"http":{"port":9091},"metrics":{"port":8085},"privateHttp":{"port":9092}}},"extraVolumes":[],"hpa":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80,"targetMemoryUtilizationPercentage":0},"insecure":false,"podAnnotations":{},"podLabels":{},"prometheus":{"podMonitor":{"enabled":false,"interval":"30s"}},"proxy":{"affinity":{},"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"pullPolicy":"IfNotPresent","repository":"envoy","tag":"v1.26-latest"},"nodeSelector":{},"resources":{"limits":{"cpu":"1000m","memory":"200Mi"},"requests":{"cpu":"100m","memory":"50Mi"}},"service":{"annotations":{},"http":{"appProtocol":"https","name":"https","port":8443},"type":"ClusterIP"},"tolerations":[]},"replicaCount":1,"secretRefs":{"adminValidating":"cert-admin-signing","gatewaySigning":"cert-token-signing-gateway","tlsSecretName":"spaces-router-tls","upboundIAMCABundle":""},"serviceAccount":{"annotations":{},"create":true,"name":""}}` | Configurations for the space router deployment. | +| router | object | `{"controlPlane":{"command":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"pullPolicy":"IfNotPresent","repository":"hyperspace","tag":""},"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"100m","memory":"100Mi"}},"service":{"auth":{"port":9000},"grpc":{"port":8081},"http":{"port":9091},"metrics":{"port":8085},"privateHttp":{"port":9092}}},"extraVolumes":[],"hpa":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80,"targetMemoryUtilizationPercentage":0},"insecure":false,"podAnnotations":{},"podLabels":{},"prometheus":{"podMonitor":{"enabled":false,"interval":"30s"}},"proxy":{"affinity":{},"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"hostPort":null,"image":{"pullPolicy":"IfNotPresent","repository":"envoy","tag":"v1.26-latest"},"nodeSelector":{},"resources":{"limits":{"cpu":"1000m","memory":"200Mi"},"requests":{"cpu":"100m","memory":"50Mi"}},"service":{"annotations":{},"http":{"appProtocol":"https","name":"https","port":8443},"type":"ClusterIP"},"tolerations":[]},"replicaCount":1,"secretRefs":{"adminValidating":"cert-admin-signing","gatewaySigning":"cert-token-signing-gateway","tlsSecretName":"spaces-router-tls","upboundIAMCABundle":""},"serviceAccount":{"annotations":{},"create":true,"name":""}}` | Configurations for the space router deployment. | | router.controlPlane.command | list | `[]` | The command to run for the router's envoy control plane. | | router.controlPlane.extraArgs | list | `[]` | Additional arguments to pass to the router's envoy control plane. | | router.controlPlane.extraEnv | list | `[]` | Additional environment variables to pass to the router's envoy control plane. | @@ -376,6 +394,7 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | router.proxy.extraArgs | list | `[]` | Additional arguments to pass to the router's envoy proxy. | | router.proxy.extraEnv | list | `[]` | Additional environment variables to pass to the router's envoy proxy. | | router.proxy.extraVolumeMounts | list | `[]` | Additional volume mounts to pass to the router's envoy proxy. | +| router.proxy.hostPort | string | `nil` | Host port for the router's envoy proxy container. When set, the envoy container will bind to this port on the host. This is useful for environments like kind where LoadBalancer services are not available. | | router.proxy.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy for the router's envoy proxy image. | | router.proxy.image.repository | string | `"envoy"` | Repository for the router's envoy proxy image. | | router.proxy.image.tag | string | `"v1.26-latest"` | Tag for the router's envoy proxy image. | @@ -387,7 +406,7 @@ This reference provides detailed documentation on the Upbound Space Helm chart. | router.proxy.service.annotations | object | `{}` | Annotations for the router's envoy proxy service. | | router.proxy.service.http.appProtocol | string | `"https"` | The name for the port, this should conform the values defined by [k8s protocol](https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol) | | router.proxy.service.http.name | string | `"https"` | The name for the port, this should conform the values defined by [k8s protocol](https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol) | -| router.proxy.service.http.port | int | `8443` | The port for the router's envoy proxy HTTP service. | +| router.proxy.service.http.port | int | `8443` | The container/target port for the router's envoy proxy. | | router.proxy.service.type | string | `"ClusterIP"` | Type for the router's envoy proxy service. | | router.proxy.tolerations | list | `[]` | Toleration for the router's envoy proxy. | | router.replicaCount | int | `1` | The number of replicas for the router deployment. | diff --git a/src/components/Version.js b/src/components/Version.js index d9fe0bd3..28842966 100644 --- a/src/components/Version.js +++ b/src/components/Version.js @@ -1,6 +1,6 @@ export const versions = { cli: '0.44.3', - spaces: '1.15.2', + spaces: '1.16.0', aws: '1.23.0', azure: '1.13.0', gcp: '1.14.0', diff --git a/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackupconfigs.yaml b/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackupconfigs.yaml new file mode 100644 index 00000000..7af88e3c --- /dev/null +++ b/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackupconfigs.yaml @@ -0,0 +1,177 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: spacebackupconfigs.admin.spaces.upbound.io +spec: + group: admin.spaces.upbound.io + names: + categories: + - spaces + kind: SpaceBackupConfig + listKind: SpaceBackupConfigList + plural: spacebackupconfigs + singular: spacebackupconfig + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.objectStorage.provider + name: Provider + type: string + - jsonPath: .spec.objectStorage.bucket + name: Bucket + type: string + - jsonPath: .spec.objectStorage.credentials.source + name: Auth + type: string + - jsonPath: .metadata.annotations.spacebackupconfig\.admin\.internal\.spaces\.upbound\.io/secret + name: Secret + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SpaceBackupConfig defines the configuration to backup a Space. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + A SpaceBackupConfigSpec represents the configuration to backup or restore + a Space. + properties: + objectStorage: + description: ObjectStorage specifies the object storage configuration + for the given provider. + properties: + bucket: + description: Bucket is the name of the bucket to store backups + in. + minLength: 1 + type: string + config: + description: |- + Config is a free-form map of configuration options for the object storage provider. + See https://github.com/thanos-io/objstore?tab=readme-ov-file for more + information on the formats for each supported cloud provider. Bucket and + Provider will override the required values in the config. + type: object + x-kubernetes-preserve-unknown-fields: true + credentials: + description: Credentials specifies the credentials to access the + object storage. + properties: + env: + description: |- + Env is a reference to an environment variable that contains credentials + that must be used to connect to the provider. + properties: + name: + description: Name is the name of an environment variable. + type: string + required: + - name + type: object + fs: + description: |- + Fs is a reference to a filesystem location that contains credentials that + must be used to connect to the provider. + properties: + path: + description: Path is a filesystem path. + type: string + required: + - path + type: object + secretRef: + description: |- + A SecretRef is a reference to a secret key that contains the credentials + that must be used to connect to the provider. + properties: + key: + default: credentials + description: The key to select. + type: string + name: + description: Name of the secret. + type: string + namespace: + description: Namespace of the secret. + type: string + required: + - key + - name + - namespace + type: object + source: + allOf: + - enum: + - Secret + - InjectedIdentity + - enum: + - Secret + - InjectedIdentity + description: |- + Source of the credentials. + Source "Secret" requires "get" permissions on the referenced Secret. + type: string + required: + - source + type: object + x-kubernetes-validations: + - message: secretRef.name and namespace must be set when source + is Secret + rule: self.source != 'Secret' || (has(self.secretRef) && has(self.secretRef.name) + && has(self.secretRef.__namespace__)) + prefix: + description: |- + Prefix is the prefix to use for all backups using this + SharedBackupConfig, e.g. "prod/cluster1", resulting in backups for + controlplane "ctp1" in namespace "ns1" being stored in + "prod/cluster1/ns1/ctp1". + type: string + provider: + description: Provider is the name of the object storage provider. + enum: + - AWS + - Azure + - GCP + type: string + required: + - bucket + - credentials + - provider + type: object + x-kubernetes-validations: + - message: credentials.secretRef.name must be set when source is Secret + rule: self.credentials.source != 'Secret' || (has(self.credentials.secretRef) + && has(self.credentials.secretRef.name)) + required: + - objectStorage + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackups.yaml b/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackups.yaml new file mode 100644 index 00000000..131fa68c --- /dev/null +++ b/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackups.yaml @@ -0,0 +1,818 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: spacebackups.admin.spaces.upbound.io +spec: + group: admin.spaces.upbound.io + names: + categories: + - spaces + kind: SpaceBackup + listKind: SpaceBackupList + plural: spacebackups + singular: spacebackup + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .status.retries + name: Retries + type: integer + - jsonPath: .metadata.annotations.spacebackup\.internal\.spaces\.upbound\.io/failed + name: Failed + type: string + - jsonPath: .spec.ttl + name: TTL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SpaceBackup represents a backup of a Space. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SpaceBackupSpec defines a backup over a set of Match + properties: + configRef: + description: |- + ConfigRef is a reference to the space backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SpaceBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SpaceBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'admin.spaces.upbound.io') + && self.kind == 'SpaceBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlaneBackups: + description: ControlPlaneBackups is the definition of the control + plane backups, + properties: + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + exclude: + description: |- + Exclude is the selector for resources that should be excluded from the backup. + If both Match and Exclude are specified, the Exclude selector will be applied + after the Match selector. + By default, only SpaceBackups are excluded. + properties: + controlPlanes: + description: |- + ControlPlanes specifies the control planes selected. + A control plane is matched if any of the control plane selectors matches, if not specified + any control plane in the selected groups is matched. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + extras: + description: Extras specifies the extra resources selected. + items: + description: GenericSpaceBackupResourceSelector represents a + generic resource selector. + properties: + apiGroup: + description: APIGroup is the group of the resource. + type: string + kind: + description: Kind is the kind of the resource. + type: string + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + required: + - apiGroup + - kind + type: object + type: array + groups: + description: |- + Groups specifies the groups selected. + A group is matched if any of the group selectors matches, if not specified + any group is matched. Group selector is ANDed with all other selectors, so no resource in + a group not matching the group selector will be included in the backup. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + secrets: + description: Spaces specifies the spaces selected. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + type: object + failures: + description: Failures defines the failure tolerance for the backup. + properties: + controlPlanes: + anyOf: + - type: integer + - type: string + description: |- + ControlPlanes is the percentage of control planes that are allowed to fail and still consider the backup successful. + Can be specified as an integer (e.g., 50) or a percentage string (e.g., "50%"). + x-kubernetes-int-or-string: true + type: object + match: + description: |- + Match is the selector for resources that should be included in the backup. + By default, we'll back up all Groups and for each Group: + - All ControlPlanes. + - All Secrets. + - All other Space API resources, e.g. SharedBackupConfigs, SharedUpboundPolicies, Backups, etc... + properties: + controlPlanes: + description: |- + ControlPlanes specifies the control planes selected. + A control plane is matched if any of the control plane selectors matches, if not specified + any control plane in the selected groups is matched. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + extras: + description: Extras specifies the extra resources selected. + items: + description: GenericSpaceBackupResourceSelector represents a + generic resource selector. + properties: + apiGroup: + description: APIGroup is the group of the resource. + type: string + kind: + description: Kind is the kind of the resource. + type: string + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + required: + - apiGroup + - kind + type: object + type: array + groups: + description: |- + Groups specifies the groups selected. + A group is matched if any of the group selectors matches, if not specified + any group is matched. Group selector is ANDed with all other selectors, so no resource in + a group not matching the group selector will be included in the backup. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + secrets: + description: Spaces specifies the spaces selected. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + type: object + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + required: + - configRef + type: object + x-kubernetes-validations: + - message: spec.configRef can't be changed or set after creation + rule: '!has(self.configRef) && !has(oldSelf.configRef) || (self.configRef + == oldSelf.configRef) ' + - message: spec.match can't be changed or set after creation + rule: '!has(self.match) && !has(oldSelf.match) || (self.match == oldSelf.match) ' + - message: spec.exclude can't be changed or set after creation + rule: '!has(self.exclude) && !has(oldSelf.exclude) || (self.exclude + == oldSelf.exclude) ' + - message: spec.controlPlaneBackups can't be changed or set after creation + rule: '!has(self.controlPlaneBackups) && !has(oldSelf.controlPlaneBackups) + || (self.controlPlaneBackups == oldSelf.controlPlaneBackups) ' + status: + description: SpaceBackupStatus represents the observed state of a SpaceBackup. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controlPlanes: + description: |- + ControlPlanes contains details about the control planes that were backed up, + total number of control planes and failures. + properties: + failed: + description: Failed is the number of control planes that failed + to backup. + format: int32 + type: integer + total: + description: Total is the total number of control planes that + were attempted to be backed up. + format: int32 + type: integer + type: object + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + phase: + default: Pending + description: Phase is the current phase of the backup. + enum: + - Pending + - InProgress + - Failed + - Completed + - Deleted + type: string + retries: + description: Retries is the number of times the backup has been retried. + format: int32 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackupschedules.yaml b/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackupschedules.yaml new file mode 100644 index 00000000..994a4fba --- /dev/null +++ b/static/crds/space/v1.16/admin.spaces.upbound.io_spacebackupschedules.yaml @@ -0,0 +1,801 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: spacebackupschedules.admin.spaces.upbound.io +spec: + group: admin.spaces.upbound.io + names: + categories: + - spaces + kind: SpaceBackupSchedule + listKind: SpaceBackupScheduleList + plural: spacebackupschedules + singular: spacebackupschedule + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.schedule + name: Schedule + type: string + - jsonPath: .status.lastBackup + name: LastBackup + type: date + - jsonPath: .spec.ttl + name: TTL + type: string + - jsonPath: .spec.suspend + name: Suspended + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SpaceBackupSchedule represents a schedule to backup a Space. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SpaceBackupScheduleSpec defines a space backup schedule. + properties: + configRef: + description: |- + ConfigRef is a reference to the space backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SpaceBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SpaceBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'admin.spaces.upbound.io') + && self.kind == 'SpaceBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlaneBackups: + description: ControlPlaneBackups is the definition of the control + plane backups, + properties: + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + exclude: + description: |- + Exclude is the selector for resources that should be excluded from the backup. + If both Match and Exclude are specified, the Exclude selector will be applied + after the Match selector. + By default, only SpaceBackups are excluded. + properties: + controlPlanes: + description: |- + ControlPlanes specifies the control planes selected. + A control plane is matched if any of the control plane selectors matches, if not specified + any control plane in the selected groups is matched. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + extras: + description: Extras specifies the extra resources selected. + items: + description: GenericSpaceBackupResourceSelector represents a + generic resource selector. + properties: + apiGroup: + description: APIGroup is the group of the resource. + type: string + kind: + description: Kind is the kind of the resource. + type: string + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + required: + - apiGroup + - kind + type: object + type: array + groups: + description: |- + Groups specifies the groups selected. + A group is matched if any of the group selectors matches, if not specified + any group is matched. Group selector is ANDed with all other selectors, so no resource in + a group not matching the group selector will be included in the backup. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + secrets: + description: Spaces specifies the spaces selected. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + type: object + failures: + description: Failures defines the failure tolerance for the backup. + properties: + controlPlanes: + anyOf: + - type: integer + - type: string + description: |- + ControlPlanes is the percentage of control planes that are allowed to fail and still consider the backup successful. + Can be specified as an integer (e.g., 50) or a percentage string (e.g., "50%"). + x-kubernetes-int-or-string: true + type: object + match: + description: |- + Match is the selector for resources that should be included in the backup. + By default, we'll back up all Groups and for each Group: + - All ControlPlanes. + - All Secrets. + - All other Space API resources, e.g. SharedBackupConfigs, SharedUpboundPolicies, Backups, etc... + properties: + controlPlanes: + description: |- + ControlPlanes specifies the control planes selected. + A control plane is matched if any of the control plane selectors matches, if not specified + any control plane in the selected groups is matched. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + extras: + description: Extras specifies the extra resources selected. + items: + description: GenericSpaceBackupResourceSelector represents a + generic resource selector. + properties: + apiGroup: + description: APIGroup is the group of the resource. + type: string + kind: + description: Kind is the kind of the resource. + type: string + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + required: + - apiGroup + - kind + type: object + type: array + groups: + description: |- + Groups specifies the groups selected. + A group is matched if any of the group selectors matches, if not specified + any group is matched. Group selector is ANDed with all other selectors, so no resource in + a group not matching the group selector will be included in the backup. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + secrets: + description: Spaces specifies the spaces selected. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + type: object + schedule: + description: Schedule in Cron format, see https://en.wikipedia.org/wiki/Cron. + minLength: 1 + type: string + suspend: + description: |- + Suspend specifies whether the schedule is suspended. If true, no + SpaceBackups will be created, but running backups will be allowed to + complete. + type: boolean + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - schedule + type: object + status: + description: SpaceBackupScheduleStatus represents the observed state of + a SpaceBackupSchedule. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + lastBackup: + description: |- + LastBackup is the last time a Backup was run for this + Schedule schedule + format: date-time + type: string + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/admin.spaces.upbound.io_spacelicenses.yaml b/static/crds/space/v1.16/admin.spaces.upbound.io_spacelicenses.yaml new file mode 100644 index 00000000..255770c1 --- /dev/null +++ b/static/crds/space/v1.16/admin.spaces.upbound.io_spacelicenses.yaml @@ -0,0 +1,228 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: spacelicenses.admin.spaces.upbound.io +spec: + group: admin.spaces.upbound.io + names: + categories: + - spaces + kind: SpaceLicense + listKind: SpaceLicenseList + plural: spacelicenses + singular: spacelicense + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.plan + name: PLAN + type: string + - jsonPath: .status.conditions[?(@.type=='LicenseValid')].status + name: VALID + type: string + - jsonPath: .status.conditions[?(@.type=='LicenseValid')].reason + name: REASON + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SpaceLicense is the resource for Space license configuration. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SpaceLicenseSpec defines the desired state of SpaceLicense. + properties: + secretRef: + description: |- + SecretRef references the secret that contains the license file. + If not provided, the license will be considered as community edition. + properties: + key: + default: license.json + description: |- + Key within the secret that contains the license file. + Defaults to "license.json". + type: string + name: + description: Name of the secret containing the license. + type: string + namespace: + description: Namespace of the secret containing the license. + type: string + required: + - name + - namespace + type: object + type: object + status: + description: SpaceLicenseStatus defines the observed state of SpaceLicense. + properties: + capacity: + description: |- + Capacity contains the capacity granted by the license. + This entire block is owned by the license-check-controller. + properties: + operations: + description: Operations is the total number of operations granted + by the license. + format: int64 + type: integer + resourceHours: + description: ResourceHours is the total number of resource hours + granted by the license. + format: int64 + type: integer + type: object + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + createdAt: + description: |- + CreatedAt is when the license was created. + This field is owned by the license-check-controller. + format: date-time + type: string + enabledFeatures: + description: |- + EnabledFeatures lists the commercial features enabled by this license. + This field is owned by the license-check-controller. + items: + type: string + type: array + expiresAt: + description: |- + ExpiresAt is when the license expires. + This field is owned by the license-check-controller. + format: date-time + type: string + gracePeriodEndsAt: + description: |- + GracePeriodEndsAt is when the license grace period ends and the license becomes completely invalid. + This field is owned by the license-check-controller. + format: date-time + type: string + id: + description: |- + ID is the ID associated with the license. + This field is owned by the license-check-controller. + type: string + plan: + description: |- + Plan is the commercial plan associated with the license (e.g., "community", "standard"). + This field is owned by the license-check-controller. + type: string + restrictions: + description: |- + Restrictions contains any usage restrictions associated with the license. + This field is owned by the license-check-controller. + properties: + clusterUUID: + description: |- + ClusterUUID specifies the cluster UUID that this license is restricted to. + If present, the license is only valid for the cluster with this UUID. + type: string + type: object + usage: + description: |- + Usage contains the cumulative usage data tracked by the system. + This entire block is owned by the metering-controller. + properties: + firstMeasurement: + description: FirstMeasurement is the timestamp of the first usage + measurement. + format: date-time + type: string + lastMeasurement: + description: LastMeasurement is the timestamp of the last usage + measurement. + format: date-time + type: string + operations: + description: Operations is the total number of operations consumed. + format: int64 + type: integer + operationsUtilization: + description: OperationsUtilization is the percentage of operations + capacity used. + type: string + resourceHours: + description: ResourceHours is the total number of resource hours + consumed. + format: int64 + type: integer + resourceHoursUtilization: + description: ResourceHoursUtilization is the percentage of resource + hours capacity used. + type: string + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/authorization.spaces.upbound.io_objectrolebindings.yaml b/static/crds/space/v1.16/authorization.spaces.upbound.io_objectrolebindings.yaml new file mode 100644 index 00000000..af18b2b9 --- /dev/null +++ b/static/crds/space/v1.16/authorization.spaces.upbound.io_objectrolebindings.yaml @@ -0,0 +1,153 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: objectrolebindings.authorization.spaces.upbound.io +spec: + group: authorization.spaces.upbound.io + names: + categories: + - iam + kind: ObjectRoleBinding + listKind: ObjectRoleBindingList + plural: objectrolebindings + singular: objectrolebinding + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + A ObjectRoleBinding binds a namespaced API object to a set of subjects, at varying access levels. + For now, there can be at most one ObjectRoleBinding pointing to each API object. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ObjectRoleBindingSpec is ObjectRoleBinding's spec. + properties: + object: + description: |- + Object references the object to which the listed subjects should have access at varying levels. + The object value is immutable after creation. + properties: + apiGroup: + description: |- + APIGroup defines the apiGroup of the object being pointed to. + With some minor differences, this is essentially matched as a DNS subdomain, like how Kubernetes validates it. + The Kubernetes legacy core group is denoted as "core". + maxLength: 64 + pattern: ^[a-z][a-z0-9-]{0,61}[a-z0-9](\.[a-z][a-z0-9-]{0,61}[a-z0-9])*$ + type: string + x-kubernetes-validations: + - message: apiGroup is immutable + rule: self == oldSelf + - message: apiGroup must be 'core' for now. This will change in + the future. + rule: self == 'core' + name: + description: |- + Name points to the .metadata.name of the object targeted. + Kubernetes validates this as a DNS 1123 subdomain. + maxLength: 253 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + x-kubernetes-validations: + - message: name is immutable + rule: self == oldSelf + resource: + description: |- + Resource defines the resource type (often kind in plural, e.g. + controlplanes) being pointed to. + With some minor differences, this is essentially matched as a DNS label, like how Kubernetes validates it. + maxLength: 63 + pattern: ^[a-z][a-z0-9-]{1,61}[a-z0-9]$ + type: string + x-kubernetes-validations: + - message: resource is immutable + rule: self == oldSelf + - message: resource must be 'namespaces' for now. This will change + in the future. + rule: self == 'namespaces' + required: + - apiGroup + - name + - resource + type: object + subjects: + description: Subjects should be a map type with both kind+name as + a key + items: + description: |- + SubjectBinding contains a reference to the object or user identities a role + binding applies to. + properties: + kind: + description: |- + Kind of subject being referenced. Values defined by this API group are + for now only "UpboundTeam". + enum: + - UpboundTeam + type: string + x-kubernetes-validations: + - message: kind must be 'UpboundTeam' for now. This will change + in the future. + rule: self == 'UpboundTeam' + name: + description: |- + Name (identifier) of the subject (of the specified kind) being referenced. + The identifier must be 2-100 chars, [a-zA-Z0-9-], no repeating dashes, can't start/end with a dash. + Notably, a UUID fits that format. + maxLength: 100 + pattern: ^([a-zA-Z0-9]+-?)+[a-zA-Z0-9]$ + type: string + role: + description: |- + Role this subject has on the associated Object. + The list of valid roles is defined for each target API resource separately. + For namespaces, valid values are "viewer", "editor", and "admin". + The format of this is essentially a RFC 1035 label with underscores instead of dashes, minimum three characters long. + maxLength: 63 + pattern: ^[a-z][a-z0-9_]{1,62}[a-z0-9]$ + type: string + required: + - kind + - name + - role + type: object + type: array + x-kubernetes-list-map-keys: + - kind + - name + x-kubernetes-list-type: map + required: + - object + - subjects + type: object + status: + description: ObjectRoleBindingStatus is RoleBindings' status. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/observability.spaces.upbound.io_sharedtelemetryconfigs.yaml b/static/crds/space/v1.16/observability.spaces.upbound.io_sharedtelemetryconfigs.yaml new file mode 100644 index 00000000..82fd3b4d --- /dev/null +++ b/static/crds/space/v1.16/observability.spaces.upbound.io_sharedtelemetryconfigs.yaml @@ -0,0 +1,416 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: sharedtelemetryconfigs.observability.spaces.upbound.io +spec: + group: observability.spaces.upbound.io + names: + categories: + - observability + kind: SharedTelemetryConfig + listKind: SharedTelemetryConfigList + plural: sharedtelemetryconfigs + shortNames: + - stc + singular: sharedtelemetryconfig + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.annotations.sharedtelemetryconfig\.internal\.spaces\.upbound\.io/selected + name: Selected + type: string + - jsonPath: .metadata.annotations.sharedtelemetryconfig\.internal\.spaces\.upbound\.io/failed + name: Failed + type: string + - jsonPath: .metadata.annotations.sharedtelemetryconfig\.internal\.spaces\.upbound\.io/provisioned + name: Provisioned + type: string + - jsonPath: .status.conditions[?(@.type=='Validated')].status + name: Validated + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SharedTelemetryConfig defines a telemetry configuration over + a set of ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedTelemetryConfigSpec defines a telemetry configuration + over a set of ControlPlanes. + properties: + apiServer: + description: |- + APIServer configures the API server observability aspects + for the target ControlPlanes. + properties: + audit: + description: Audit configures the auditing aspects of the API + server. + properties: + enabled: + description: Enabled enables or disables API server auditing + for a ControlPlane. + type: boolean + type: object + type: object + configPatchSecretRefs: + description: |- + ConfigPatchSecretRefs allows defining patches sourced from secrets to be + applied to the telemetry configuration. + items: + description: |- + ConfigPatchSecretRef defines a config patch sourced from a secret to be + applied to the telemetry configuration. + properties: + key: + description: Key in the secret from which to source the patch. + type: string + name: + description: Name of the secret. + type: string + path: + description: |- + Path to the field in the telemetry configuration to patch. + Currently, we only support patching exporters, so the path + needs to start with "exporters". + type: string + x-kubernetes-validations: + - message: Only 'exporters' patching is supported, path must + start with 'exporters.' + rule: self.startsWith('exporters.') + required: + - key + - name + - path + type: object + type: array + controlPlaneSelector: + description: |- + ControlPlaneSelector defines the selector for ControlPlanes on which to + configure telemetry. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + exportPipeline: + description: |- + ExportPipeline defines the telemetry exporter pipeline to configure on + the selected ControlPlanes. + properties: + logs: + description: |- + Logs defines the logs exporter pipeline to configure on the + selected ControlPlanes. The value has to be present in the + spec.exporters field. + items: + type: string + maxItems: 10 + type: array + metrics: + description: |- + Metrics defines the metrics exporter pipeline to configure on the + selected ControlPlanes. The value has to be present in the + spec.exporters field. + items: + type: string + maxItems: 10 + type: array + traces: + description: |- + Traces defines the traces exporter pipeline to configure on the + selected ControlPlanes. The value has to be present in the + spec.exporters field. + items: + type: string + maxItems: 10 + type: array + type: object + exporters: + description: |- + Exporters defines the exporters to configure on the selected ControlPlanes. + Untyped as we use the underlying OpenTelemetryOperator to configure the + OpenTelemetry collector's exporters. Use the OpenTelemetry Collector + documentation to configure the exporters. + Currently only supported exporters are push based exporters. + type: object + x-kubernetes-preserve-unknown-fields: true + processorPipeline: + description: |- + ProcessorPipeline defines the telemetry processor pipeline to configure on + the selected ControlPlanes. + properties: + logs: + description: |- + Logs defines the logs exporter pipeline to configure on the + selected ControlPlanes. The value has to be present in the + spec.exporters field. + items: + type: string + maxItems: 10 + type: array + metrics: + description: |- + Metrics defines the metrics exporter pipeline to configure on the + selected ControlPlanes. The value has to be present in the + spec.exporters field. + items: + type: string + maxItems: 10 + type: array + traces: + description: |- + Traces defines the traces exporter pipeline to configure on the + selected ControlPlanes. The value has to be present in the + spec.exporters field. + items: + type: string + maxItems: 10 + type: array + type: object + processors: + description: |- + Processors defines the processors to configure on the selected ControlPlanes. + Untyped as we use the underlying OpenTelemetryOperator to configure the + OpenTelemetry collector's processors. Use the OpenTelemetry Collector + documentation to configure the processors. + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - controlPlaneSelector + - exportPipeline + - exporters + type: object + status: + description: SharedTelemetryConfigStatus represents the observed state + of a SharedTelemetryConfig. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failed: + description: list of provisioning failures. + items: + description: SharedTelemetryConfigProvisioningFailure defines configuration + provisioning failure. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition + from one status to another. + type: string + status: + description: Status of this condition; is it currently + True, False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controlPlane: + description: ControlPlane name where the failure occurred. + type: string + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + required: + - controlPlane + type: object + type: array + x-kubernetes-list-map-keys: + - controlPlane + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + provisioned: + description: List of successfully provisioned targets. + items: + type: string + type: array + x-kubernetes-list-type: set + selectedControlPlanes: + description: SelectedControlPlanes represents the names of the selected + ControlPlanes. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/pkg.upbound.io_controllerrevisions.yaml b/static/crds/space/v1.16/pkg.upbound.io_controllerrevisions.yaml new file mode 100644 index 00000000..40a35d73 --- /dev/null +++ b/static/crds/space/v1.16/pkg.upbound.io_controllerrevisions.yaml @@ -0,0 +1,312 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: controllerrevisions.pkg.upbound.io +spec: + group: pkg.upbound.io + names: + categories: + - upbound + - pkgrev + kind: ControllerRevision + listKind: ControllerRevisionList + plural: controllerrevisions + singular: controllerrevision + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=='Healthy')].status + name: HEALTHY + type: string + - jsonPath: .spec.revision + name: REVISION + type: string + - jsonPath: .spec.image + name: IMAGE + type: string + - jsonPath: .spec.desiredState + name: STATE + type: string + - jsonPath: .status.foundDependencies + name: DEP-FOUND + type: string + - jsonPath: .status.installedDependencies + name: DEP-INSTALLED + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: An ControllerRevision represents a revision of an Controller. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ControllerRevisionSpec specifies the configuration of an + ControllerRevision. + properties: + commonLabels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + desiredState: + description: DesiredState of the PackageRevision. Can be either Active + or Inactive. + type: string + helm: + description: |- + Helm specific configuration for a controller revision. This field is + managed by the controller and should not be modified directly. + properties: + crdRefs: + description: CRDRefs is a list of CRDs that deployed by this controller. + items: + type: string + type: array + releaseName: + description: ReleaseName is the name of the Helm release. + type: string + releaseNamespace: + description: ReleaseNamespace is the namespace of the Helm release. + type: string + required: + - releaseName + - releaseNamespace + type: object + ignoreCrossplaneConstraints: + default: false + description: |- + IgnoreCrossplaneConstraints indicates to the package manager whether to + honor Crossplane version constrains specified by the package. + Default is false. + type: boolean + image: + description: Package image used by install Pod to extract package + contents. + type: string + packagePullPolicy: + default: IfNotPresent + description: |- + PackagePullPolicy defines the pull policy for the package. It is also + applied to any images pulled for the package, such as a provider's + controller image. + Default is IfNotPresent. + type: string + packagePullSecrets: + description: |- + PackagePullSecrets are named secrets in the same namespace that can be + used to fetch packages from private registries. They are also applied to + any images pulled for the package, such as a provider's controller image. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + revision: + description: |- + Revision number. Indicates when the revision will be garbage collected + based on the parent's RevisionHistoryLimit. + format: int64 + type: integer + runtimeConfigRef: + default: + name: default + description: |- + RuntimeConfigRef references a RuntimeConfig resource that will be used + to configure the package runtime. + properties: + apiVersion: + default: pkg.upbound.io/v1alpha1 + description: API version of the referent. + type: string + kind: + default: ControllerRuntimeConfig + description: Kind of the referent. + type: string + name: + description: Name of the RuntimeConfig. + type: string + required: + - name + type: object + skipDependencyResolution: + default: false + description: |- + SkipDependencyResolution indicates to the package manager whether to skip + resolving dependencies for a package. Setting this value to true may have + unintended consequences. + Default is false. + type: boolean + required: + - desiredState + - image + - revision + type: object + x-kubernetes-validations: + - message: helm specification is immutable + rule: '!has(oldSelf.helm) || self.helm == oldSelf.helm' + status: + description: ControllerRevisionStatus represents the observed state of + an ControllerRevision. + properties: + appliedImageConfigRefs: + description: |- + AppliedImageConfigRefs records any image configs that were applied in + reconciling this revision, and what they were used for. + items: + description: |- + ImageConfigRef is a reference to an image config that indicates how the + referenced image config was used by the package manager. + properties: + name: + description: Name is the name of the image config. + type: string + reason: + description: Reason indicates what the image config was used + for. + type: string + required: + - name + - reason + type: object + type: array + capabilities: + description: |- + Capabilities of this package. Capabilities are opaque strings that + may be meaningful to package consumers. + items: + type: string + type: array + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + foundDependencies: + description: Dependency information. + format: int64 + type: integer + installedDependencies: + format: int64 + type: integer + invalidDependencies: + format: int64 + type: integer + objectRefs: + description: References to objects owned by PackageRevision. + items: + description: |- + A TypedReference refers to an object by Name, Kind, and APIVersion. It is + commonly used to reference cluster-scoped objects or objects where the + namespace is already known. + properties: + apiVersion: + description: APIVersion of the referenced object. + type: string + kind: + description: Kind of the referenced object. + type: string + name: + description: Name of the referenced object. + type: string + uid: + description: UID of the referenced object. + type: string + required: + - apiVersion + - kind + - name + type: object + type: array + resolvedImage: + description: |- + ResolvedPackage is the name of the package that was installed. It may be + different from spec.image if the package path was rewritten using an + image config. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/pkg.upbound.io_controllerruntimeconfigs.yaml b/static/crds/space/v1.16/pkg.upbound.io_controllerruntimeconfigs.yaml new file mode 100644 index 00000000..94375752 --- /dev/null +++ b/static/crds/space/v1.16/pkg.upbound.io_controllerruntimeconfigs.yaml @@ -0,0 +1,65 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: controllerruntimeconfigs.pkg.upbound.io +spec: + group: pkg.upbound.io + names: + categories: + - upbound + kind: ControllerRuntimeConfig + listKind: ControllerRuntimeConfigList + plural: controllerruntimeconfigs + singular: controllerruntimeconfig + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + An ControllerRuntimeConfig provides settings for configuring runtime of a + controller package. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ControllerRuntimeConfigSpec specifies the configuration of + an ControllerRuntimeConfig. + properties: + helm: + description: HelmConfigSpec defines the Helm-specific configuration + for a controller runtime. + properties: + values: + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: {} diff --git a/static/crds/space/v1.16/pkg.upbound.io_controllers.yaml b/static/crds/space/v1.16/pkg.upbound.io_controllers.yaml new file mode 100644 index 00000000..0a5f7fb5 --- /dev/null +++ b/static/crds/space/v1.16/pkg.upbound.io_controllers.yaml @@ -0,0 +1,259 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: controllers.pkg.upbound.io +spec: + group: pkg.upbound.io + names: + categories: + - upbound + - pkg + kind: Controller + listKind: ControllerList + plural: controllers + singular: controller + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=='Installed')].status + name: INSTALLED + type: string + - jsonPath: .status.conditions[?(@.type=='Healthy')].status + name: HEALTHY + type: string + - jsonPath: .spec.package + name: PACKAGE + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + A Controller installs an OCI compatible Upbound package, extending a Control + Plane with new capabilities. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ControllerSpec specifies the configuration of a Controller. + properties: + commonLabels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + ignoreCrossplaneConstraints: + default: false + description: |- + IgnoreCrossplaneConstraints indicates to the package manager whether to + honor Crossplane version constrains specified by the package. + Default is false. + type: boolean + package: + description: |- + Package is the name of the package that is being requested. + must be a fully qualified image name, including the registry, + repository, and tag. for example, "registry.example.com/repo/package:tag". + type: string + x-kubernetes-validations: + - message: must be a fully qualified image name, including the registry, + repository, and tag or digest. For example, 'registry.example.com/repo/package:tag' + or 'registry.example.com/repo/package[:tag]@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'. + rule: self.matches('^[^\\.\\/]+(\\.[^\\.\\/]+)+(\\/[^\\/:@]+)+(:[^:@]+(@sha256.+)?|@sha256.+)$') + packagePullPolicy: + default: IfNotPresent + description: |- + PackagePullPolicy defines the pull policy for the package. + Default is IfNotPresent. + type: string + packagePullSecrets: + description: |- + PackagePullSecrets are named secrets in the same namespace that can be used + to fetch packages from private registries. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + revisionActivationPolicy: + default: Automatic + description: |- + RevisionActivationPolicy specifies how the package controller should + update from one revision to the next. Options are Automatic or Manual. + Default is Automatic. + type: string + revisionHistoryLimit: + default: 1 + description: |- + RevisionHistoryLimit dictates how the package controller cleans up old + inactive package revisions. + Defaults to 1. Can be disabled by explicitly setting to 0. + format: int64 + type: integer + runtimeConfigRef: + default: + name: default + description: |- + RuntimeConfigRef references a RuntimeConfig resource that will be used + to configure the package runtime. + properties: + apiVersion: + default: pkg.upbound.io/v1alpha1 + description: API version of the referent. + type: string + kind: + default: ControllerRuntimeConfig + description: Kind of the referent. + type: string + name: + description: Name of the RuntimeConfig. + type: string + required: + - name + type: object + skipDependencyResolution: + default: false + description: |- + SkipDependencyResolution indicates to the package manager whether to skip + resolving dependencies for a package. Setting this value to true may have + unintended consequences. + Default is false. + type: boolean + required: + - package + type: object + status: + description: ControllerStatus represents the observed state of an Controller. + properties: + appliedImageConfigRefs: + description: |- + AppliedImageConfigRefs records any image configs that were applied in + reconciling this package, and what they were used for. + items: + description: |- + ImageConfigRef is a reference to an image config that indicates how the + referenced image config was used by the package manager. + properties: + name: + description: Name is the name of the image config. + type: string + reason: + description: Reason indicates what the image config was used + for. + type: string + required: + - name + - reason + type: object + type: array + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentIdentifier: + description: |- + CurrentIdentifier is the most recent package source that was used to + produce a revision. The package manager uses this field to determine + whether to check for package updates for a given source when + packagePullPolicy is set to IfNotPresent. Manually removing this field + will cause the package manager to check that the current revision is + correct for the given package source. + type: string + currentRevision: + description: |- + CurrentRevision is the name of the current package revision. It will + reflect the most up to date revision, whether it has been activated or + not. + type: string + resolvedPackage: + description: |- + ResolvedPackage is the name of the package that was used for version + resolution. It may be different from spec.package if the package path was + rewritten using an image config. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/pkg.upbound.io_remoteconfigurationrevisions.yaml b/static/crds/space/v1.16/pkg.upbound.io_remoteconfigurationrevisions.yaml new file mode 100644 index 00000000..7707252c --- /dev/null +++ b/static/crds/space/v1.16/pkg.upbound.io_remoteconfigurationrevisions.yaml @@ -0,0 +1,262 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: remoteconfigurationrevisions.pkg.upbound.io +spec: + group: pkg.upbound.io + names: + categories: + - upbound + - pkgrev + kind: RemoteConfigurationRevision + listKind: RemoteConfigurationRevisionList + plural: remoteconfigurationrevisions + singular: remoteconfigurationrevision + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=='Healthy')].status + name: HEALTHY + type: string + - jsonPath: .spec.revision + name: REVISION + type: string + - jsonPath: .spec.image + name: IMAGE + type: string + - jsonPath: .spec.desiredState + name: STATE + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: An RemoteConfigurationRevision represents a revision of an RemoteConfiguration. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RemoteConfigurationRevisionSpec specifies the configuration + of an RemoteConfigurationRevision. + properties: + commonLabels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + desiredState: + description: DesiredState of the PackageRevision. Can be either Active + or Inactive. + type: string + ignoreCrossplaneConstraints: + default: false + description: |- + IgnoreCrossplaneConstraints indicates to the package manager whether to + honor Crossplane version constrains specified by the package. + Default is false. + type: boolean + image: + description: Package image used by install Pod to extract package + contents. + type: string + packagePullPolicy: + default: IfNotPresent + description: |- + PackagePullPolicy defines the pull policy for the package. It is also + applied to any images pulled for the package, such as a provider's + controller image. + Default is IfNotPresent. + type: string + packagePullSecrets: + description: |- + PackagePullSecrets are named secrets in the same namespace that can be + used to fetch packages from private registries. They are also applied to + any images pulled for the package, such as a provider's controller image. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + revision: + description: |- + Revision number. Indicates when the revision will be garbage collected + based on the parent's RevisionHistoryLimit. + format: int64 + type: integer + skipDependencyResolution: + default: true + description: SkipDependencyResolution indicates to the package manager + whether to skip resolving dependencies for a package. This is always + true for RemoteConfigurationRevision. + type: boolean + required: + - desiredState + - image + - revision + type: object + x-kubernetes-validations: + - message: skipDependencyResolution must be true + rule: self.skipDependencyResolution + status: + description: RemoteConfigurationRevisionStatus represents the observed + state of an RemoteConfigurationRevision. + properties: + appliedImageConfigRefs: + description: |- + AppliedImageConfigRefs records any image configs that were applied in + reconciling this revision, and what they were used for. + items: + description: |- + ImageConfigRef is a reference to an image config that indicates how the + referenced image config was used by the package manager. + properties: + name: + description: Name is the name of the image config. + type: string + reason: + description: Reason indicates what the image config was used + for. + type: string + required: + - name + - reason + type: object + type: array + capabilities: + description: |- + Capabilities of this package. Capabilities are opaque strings that + may be meaningful to package consumers. + items: + type: string + type: array + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + foundDependencies: + description: Dependency information. + format: int64 + type: integer + installedDependencies: + format: int64 + type: integer + invalidDependencies: + format: int64 + type: integer + objectRefs: + description: References to objects owned by PackageRevision. + items: + description: |- + A TypedReference refers to an object by Name, Kind, and APIVersion. It is + commonly used to reference cluster-scoped objects or objects where the + namespace is already known. + properties: + apiVersion: + description: APIVersion of the referenced object. + type: string + kind: + description: Kind of the referenced object. + type: string + name: + description: Name of the referenced object. + type: string + uid: + description: UID of the referenced object. + type: string + required: + - apiVersion + - kind + - name + type: object + type: array + resolvedImage: + description: |- + ResolvedPackage is the name of the package that was installed. It may be + different from spec.image if the package path was rewritten using an + image config. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/pkg.upbound.io_remoteconfigurations.yaml b/static/crds/space/v1.16/pkg.upbound.io_remoteconfigurations.yaml new file mode 100644 index 00000000..51484af6 --- /dev/null +++ b/static/crds/space/v1.16/pkg.upbound.io_remoteconfigurations.yaml @@ -0,0 +1,240 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: remoteconfigurations.pkg.upbound.io +spec: + group: pkg.upbound.io + names: + categories: + - upbound + - pkg + kind: RemoteConfiguration + listKind: RemoteConfigurationList + plural: remoteconfigurations + singular: remoteconfiguration + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=='Installed')].status + name: INSTALLED + type: string + - jsonPath: .status.conditions[?(@.type=='Healthy')].status + name: HEALTHY + type: string + - jsonPath: .spec.package + name: PACKAGE + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + A RemoteConfiguration installs an OCI compatible configuration package in + remote mode by creating the claim CustomResourceDefinitions only. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RemoteConfigurationSpec specifies the configuration of a + RemoteConfiguration.. + properties: + commonLabels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + ignoreCrossplaneConstraints: + default: false + description: |- + IgnoreCrossplaneConstraints indicates to the package manager whether to + honor Crossplane version constrains specified by the package. + Default is false. + type: boolean + package: + description: |- + Package is the name of the package that is being requested. + must be a fully qualified image name, including the registry, + repository, and tag. for example, "registry.example.com/repo/package:tag". + type: string + x-kubernetes-validations: + - message: must be a fully qualified image name, including the registry, + repository, and tag or digest. For example, 'registry.example.com/repo/package:tag' + or 'registry.example.com/repo/package[:tag]@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'. + rule: self.matches('^[^\\.\\/]+(\\.[^\\.\\/]+)+(\\/[^\\/:@]+)+(:[^:@]+(@sha256.+)?|@sha256.+)$') + packagePullPolicy: + default: IfNotPresent + description: |- + PackagePullPolicy defines the pull policy for the package. + Default is IfNotPresent. + type: string + packagePullSecrets: + description: |- + PackagePullSecrets are named secrets in the same namespace that can be used + to fetch packages from private registries. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + revisionActivationPolicy: + default: Automatic + description: |- + RevisionActivationPolicy specifies how the package controller should + update from one revision to the next. Options are Automatic or Manual. + Default is Automatic. + type: string + revisionHistoryLimit: + default: 1 + description: |- + RevisionHistoryLimit dictates how the package controller cleans up old + inactive package revisions. + Defaults to 1. Can be disabled by explicitly setting to 0. + format: int64 + type: integer + skipDependencyResolution: + default: true + description: SkipDependencyResolution indicates to the package manager + whether to skip resolving dependencies for a package. This is always + true for RemoteConfiguration. + type: boolean + required: + - package + type: object + x-kubernetes-validations: + - message: skipDependencyResolution must be true + rule: self.skipDependencyResolution + status: + description: RemoteConfigurationStatus represents the observed state of + a RemoteConfiguration. + properties: + appliedImageConfigRefs: + description: |- + AppliedImageConfigRefs records any image configs that were applied in + reconciling this package, and what they were used for. + items: + description: |- + ImageConfigRef is a reference to an image config that indicates how the + referenced image config was used by the package manager. + properties: + name: + description: Name is the name of the image config. + type: string + reason: + description: Reason indicates what the image config was used + for. + type: string + required: + - name + - reason + type: object + type: array + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentIdentifier: + description: |- + CurrentIdentifier is the most recent package source that was used to + produce a revision. The package manager uses this field to determine + whether to check for package updates for a given source when + packagePullPolicy is set to IfNotPresent. Manually removing this field + will cause the package manager to check that the current revision is + correct for the given package source. + type: string + currentRevision: + description: |- + CurrentRevision is the name of the current package revision. It will + reflect the most up to date revision, whether it has been activated or + not. + type: string + resolvedPackage: + description: |- + ResolvedPackage is the name of the package that was used for version + resolution. It may be different from spec.package if the package path was + rewritten using an image config. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/references.upbound.io_referencedobjects.yaml b/static/crds/space/v1.16/references.upbound.io_referencedobjects.yaml new file mode 100644 index 00000000..ee6087d8 --- /dev/null +++ b/static/crds/space/v1.16/references.upbound.io_referencedobjects.yaml @@ -0,0 +1,303 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: referencedobjects.references.upbound.io +spec: + group: references.upbound.io + names: + categories: + - managed + - kubernetes + kind: ReferencedObject + listKind: ReferencedObjectList + plural: referencedobjects + singular: referencedobject + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.forProvider.manifest.kind + name: KIND + type: string + - jsonPath: .spec.composite.kind + name: KIND + priority: 1 + type: string + - jsonPath: .spec.composite.apiVersion + name: APIVERSION + priority: 2 + type: string + - jsonPath: .spec.composite.name + name: COMPOSITE + priority: 1 + type: string + - jsonPath: .spec.composite.JSONPath + name: JSONPATH + priority: 1 + type: string + - jsonPath: .status.atProvider.manifest.kind + name: REFERENCEKIND + priority: 1 + type: string + - jsonPath: .status.atProvider.manifest.apiVersion + name: REFERENCEAPIVERSION + priority: 2 + type: string + - jsonPath: .status.atProvider.manifest.metadata.name + name: REFERENCEDNAME + priority: 1 + type: string + - jsonPath: .status.atProvider.manifest.metadata.namespace + name: REFERENCEDNAMESPACE + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=='Synced')].status + name: SYNCED + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: READY + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + A ReferencedObject represents a Kubernetes object that is referenced by a + claim. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: A ObjectSpec defines the desired state of a Object. + properties: + composite: + description: |- + Composite is the composite object that holds the reference. + The composite must be bound to a claim, that can be local or remote. + properties: + apiVersion: + description: APIVersion of the referencing composite resource. + type: string + jsonPath: + description: |- + JSONPath is where the reference is stored in the composite. + The reference is resolved in the context of the claim. + The JSONPath is expected to end with a object field called `*Ref`, or + an array field called `*Refs`. In the former case, the object field must + have the following schema. In latter case, each item in the array must: + + apiVersion: string + kind: string + name: string + namespace: string # optional, defaults to be a local reference. + UID: string # optional + grants: []string # optional, defaults to ["Observe"], but can hold any of + ["Observe", "Create", "Update", "Delete"]. + claims: []string # optional, additional verbs the user must be authorized to. + + Grants are a closed-set, corresponding to the management policy of + Crossplane. Grants are authorized through RBAC and Upbound ReBAC for the + referenced object when creating or updating a reference. + + Claims are optional verbs the user creating or referencing an object + must be authorized to. These can include custom verbs. + + With grants the user specifies the permissions that the claim gives to the + composite: "Observe" allows the composite to read the object, "Create" to + create it, "Update" to update it, and "Delete" to delete it. + + Claims tell the composition author about additional permissions the user + might have. + + OpenAPI v3 validation and defaulting can be used to restrict and/or + auto-populate the fields. + + A JSONPath must have a counterpart schema in the CompositeResourceDefinition's + references.upbound.io/schema annotation. + minLength: 1 + type: string + kind: + description: Kind of the referencing composite resource. + minLength: 1 + type: string + name: + description: Name of the referencing composite resource. + minLength: 1 + type: string + required: + - apiVersion + - jsonPath + - kind + - name + type: object + deletionPolicy: + default: Delete + description: |- + DeletionPolicy specifies what will happen to the underlying external + when this managed resource is deleted - either "Delete" or "Orphan" the + external resource. + This field is planned to be deprecated in favor of the ManagementPolicies + field in a future release. Currently, both could be set independently and + non-default values would be honored if the feature flag is enabled. + See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 + enum: + - Orphan + - Delete + type: string + forProvider: + description: ForProvider is the object's desired state. + properties: + manifest: + description: Raw JSON representation of the kubernetes object + to be created. + type: object + x-kubernetes-embedded-resource: true + x-kubernetes-preserve-unknown-fields: true + required: + - manifest + type: object + managementPolicies: + default: + - '*' + description: |- + THIS IS A BETA FIELD. It is on by default but can be opted out + through a Crossplane feature flag. + ManagementPolicies specify the array of actions Crossplane is allowed to + take on the managed and external resources. + This field is planned to replace the DeletionPolicy field in a future + release. Currently, both could be set independently and non-default + values would be honored if the feature flag is enabled. If both are + custom, the DeletionPolicy field will be ignored. + See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 + and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md + items: + description: |- + A ManagementAction represents an action that the Crossplane controllers + can take on an external resource. + enum: + - Observe + - Create + - Update + - Delete + - LateInitialize + - '*' + type: string + type: array + ownerPolicy: + description: |- + OwnerPolicy defines how created objects should be owned. + 'OnCreate' requires management policy 'Create' or '*'. + enum: + - OnCreate + type: string + readiness: + default: {} + description: Readiness defines how the object's readiness condition + should be computed. + properties: + policy: + default: ObjectExists + description: Policy defines how the Object's readiness condition + should be computed. + enum: + - WhenSynced + - ObjectExists + - ObjectReady + - ObjectConditionsAllTrue + type: string + type: object + required: + - composite + type: object + status: + description: A ObjectStatus represents the observed state of a Object. + properties: + atProvider: + description: AtProvider is the object's observed state. + properties: + manifest: + description: Raw JSON representation of the remote object. + type: object + x-kubernetes-embedded-resource: true + x-kubernetes-preserve-unknown-fields: true + type: object + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/scheduling.upbound.io_environments.yaml b/static/crds/space/v1.16/scheduling.upbound.io_environments.yaml new file mode 100644 index 00000000..7d21d092 --- /dev/null +++ b/static/crds/space/v1.16/scheduling.upbound.io_environments.yaml @@ -0,0 +1,244 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: environments.scheduling.upbound.io +spec: + group: scheduling.upbound.io + names: + categories: + - scheduling + - envs + kind: Environment + listKind: EnvironmentList + plural: environments + shortNames: + - env + singular: environment + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: Environment specifies where remote claims are scheduled to. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EnvironmentSpec defines the desired state of Environment. + properties: + dimensions: + additionalProperties: + type: string + description: |- + Dimensions are the label keys and values to select control planes + implementing the desired API resource group. These dimensions apply to + all resource groups uniformly. Per resource group dimensions can + be specified in the resource group configuration. + type: object + resourceGroups: + description: |- + ResourceGroups define label keys and values and potentially other + properties to select a control plane along dimensions for individual + API resource groups. + + A resource group not specified in this list will not be scheduled. + items: + description: ResourceGroup defines the desired scheduling of a resource + group. + properties: + dimensions: + additionalProperties: + type: string + description: |- + Dimensions are the label keys and values to select control planes + implementing the desired API resource group. These are in addition to + the dimensions specified at the .spec level and override them. + type: object + name: + description: Name is the name of the resource group. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + schedule: + description: |- + Schedule defines the scheduling result of the resource group. It is + set by the scheduler and cannot be mutated by the user. But the user + can unset it to allow the scheduler to reschedule the resource group. + + If unset, the resource group will be rescheduled by first setting the + proposed schedule in the status and then setting this field here. + + If no scheduling is possible, the Ready condition will be set to False + with the NoControlPlaneAvailable reason. + + A schedule will never change unless the user unsets it. + items: + description: |- + ResourceSchedule indicates where instances of a resource group are scheduled to, + i.e. by which control plane and in which group and space claims will be + implemented. + properties: + controlPlane: + description: |- + ControlPlane is the name of the control plane in which the resource group is scheduled. + This is empty if the resource group cannot be scheduled. + type: string + group: + description: |- + Group is the name of the group in which the resource group is scheduled. + This is empty if the resource group cannot be scheduled. + type: string + name: + description: Name is the name of the resource group. + minLength: 1 + type: string + space: + description: |- + Space is the name of the space in which the resource group is scheduled. + This is empty if the resource group cannot be scheduled. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + status: + description: EnvironmentStatus defines the observed state of the Environment. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + resourceGroups: + description: |- + ProposedSchedule indicates where instances of a resource group according + to the current dimensions are proposed to be scheduled to. + items: + description: ResourceStatus represents the status of one individual + resource group. + properties: + message: + description: Message is a human-readable message for the scheduling + decision. + type: string + name: + description: Name is the name of the resource group. + minLength: 1 + type: string + proposed: + description: |- + Proposed is the proposed schedule for the resource group. This either + matches the schedule in the spec or is a new proposal by the scheduler. + + In the later case, the user can accept the proposal by removing the + existing schedule in the spec for the given resource group. + properties: + controlPlane: + description: |- + ControlPlane is the name of the control plane in which the resource group is scheduled. + This is empty if the resource group cannot be scheduled. + type: string + group: + description: |- + Group is the name of the group in which the resource group is scheduled. + This is empty if the resource group cannot be scheduled. + type: string + space: + description: |- + Space is the name of the space in which the resource group is scheduled. + This is empty if the resource group cannot be scheduled. + type: string + type: object + reason: + description: Reason is a machine-readable reason for the scheduling + decision. + type: string + required: + - name + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_backups.yaml b/static/crds/space/v1.16/spaces.upbound.io_backups.yaml new file mode 100644 index 00000000..c8997822 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_backups.yaml @@ -0,0 +1,382 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: backups.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: Backup + listKind: BackupList + plural: backups + singular: backup + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .status.retries + name: Retries + type: integer + - jsonPath: .spec.ttl + name: TTL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: Backup represents a single backup of a ControlPlane. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BackupSpec defines a backup over a set of ControlPlanes. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlane: + description: |- + ControlPlane is the name of the ControlPlane to backup. + Requires "backup" permission on the referenced ControlPlane. + minLength: 1 + type: string + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + required: + - configRef + - controlPlane + type: object + x-kubernetes-validations: + - message: backup target controlplane can not be changed after creation + rule: self.controlPlane == oldSelf.controlPlane + - message: backup excluded resources can not be changed after creation + rule: (!has(self.excludedResources) && !has(oldSelf.excludedResources)) + || self.excludedResources == oldSelf.excludedResources + - message: backup config ref can not be changed after creation + rule: self.configRef == oldSelf.configRef + status: + description: BackupStatus represents the observed state of a Backup. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + phase: + default: Pending + description: Phase is the current phase of the backup. + enum: + - Pending + - InProgress + - Failed + - Completed + - Deleted + type: string + retries: + description: Retries is the number of times the backup has been retried. + format: int32 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .status.retries + name: Retries + type: integer + - jsonPath: .spec.ttl + name: TTL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Backup represents a single backup of a ControlPlane. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BackupSpec defines a backup over a set of ControlPlanes. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlane: + description: |- + ControlPlane is the name of the ControlPlane to backup. + Requires "backup" permission on the referenced ControlPlane. + minLength: 1 + type: string + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + required: + - configRef + - controlPlane + type: object + x-kubernetes-validations: + - message: backup target controlplane can not be changed after creation + rule: self.controlPlane == oldSelf.controlPlane + - message: backup excluded resources can not be changed after creation + rule: (!has(self.excludedResources) && !has(oldSelf.excludedResources)) + || self.excludedResources == oldSelf.excludedResources + - message: backup config ref can not be changed after creation + rule: self.configRef == oldSelf.configRef + status: + description: BackupStatus represents the observed state of a Backup. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + phase: + default: Pending + description: Phase is the current phase of the backup. + enum: + - Pending + - InProgress + - Failed + - Completed + - Deleted + type: string + retries: + description: Retries is the number of times the backup has been retried. + format: int32 + type: integer + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_backupschedules.yaml b/static/crds/space/v1.16/spaces.upbound.io_backupschedules.yaml new file mode 100644 index 00000000..d06bd59f --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_backupschedules.yaml @@ -0,0 +1,408 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: backupschedules.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: BackupSchedule + listKind: BackupScheduleList + plural: backupschedules + singular: backupschedule + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.schedule + name: Schedule + type: string + - jsonPath: .status.lastBackup + name: LastBackup + type: date + - jsonPath: .spec.ttl + name: TTL + type: string + - jsonPath: .spec.controlPlane + name: ControlPlane + type: string + - jsonPath: .spec.suspend + name: Suspended + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: BackupSchedule represents a single ControlPlane schedule for + Backups. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BackupScheduleSpec defines a backup schedule over a set of + ControlPlanes. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlane: + description: |- + ControlPlane is the name of the ControlPlane to which the schedule + applies. + Requires "get" permission on the referenced ControlPlane. + type: string + x-kubernetes-validations: + - message: target can not be changed after creation + rule: self == oldSelf + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + schedule: + description: Schedule in Cron format, see https://en.wikipedia.org/wiki/Cron. + minLength: 1 + type: string + suspend: + description: |- + Suspend specifies whether the schedule is suspended. If true, no + Backups will be created, but running backups will be allowed to + complete. + type: boolean + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - controlPlane + - schedule + type: object + status: + description: BackupScheduleStatus represents the observed state of a BackupSchedule. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + lastBackup: + description: |- + LastBackup is the last time a Backup was run for this + Schedule schedule + format: date-time + type: string + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.schedule + name: Schedule + type: string + - jsonPath: .status.lastBackup + name: LastBackup + type: date + - jsonPath: .spec.ttl + name: TTL + type: string + - jsonPath: .spec.controlPlane + name: ControlPlane + type: string + - jsonPath: .spec.suspend + name: Suspended + type: boolean + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: BackupSchedule represents a single ControlPlane schedule for + Backups. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BackupScheduleSpec defines a backup schedule over a set of + ControlPlanes. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlane: + description: |- + ControlPlane is the name of the ControlPlane to which the schedule + applies. + Requires "get" permission on the referenced ControlPlane. + type: string + x-kubernetes-validations: + - message: target can not be changed after creation + rule: self == oldSelf + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + schedule: + description: Schedule in Cron format, see https://en.wikipedia.org/wiki/Cron. + minLength: 1 + type: string + suspend: + description: |- + Suspend specifies whether the schedule is suspended. If true, no + Backups will be created, but running backups will be allowed to + complete. + type: boolean + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - controlPlane + - schedule + type: object + status: + description: BackupScheduleStatus represents the observed state of a BackupSchedule. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + lastBackup: + description: |- + LastBackup is the last time a Backup was run for this + Schedule schedule + format: date-time + type: string + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_controlplanes.yaml b/static/crds/space/v1.16/spaces.upbound.io_controlplanes.yaml new file mode 100644 index 00000000..0546e008 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_controlplanes.yaml @@ -0,0 +1,337 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: controlplanes.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: ControlPlane + listKind: ControlPlaneList + plural: controlplanes + shortNames: + - ctp + - ctps + singular: controlplane + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.crossplane.version + name: Crossplane + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + - jsonPath: .status.message + name: Message + type: string + - jsonPath: .spec.class + name: Class + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: ControlPlane defines a managed Crossplane instance. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: A ControlPlaneSpec represents the desired state of the ControlPlane. + properties: + class: + description: |- + [[GATE:EnableControlPlaneClasses]] + Class specifies the class of the control plane. This affects the + control plane sizing, including component replicas and resource + requirements. There are multiple predefined classes, with "default" + being the standard Spaces control plane without any additional class + configuration. Check the Upbound Cloud documentation for a list of all + available classes. Defaults to the configured default class, if not set. + Can only be updated to a compatible class, having the same declared type. + type: string + crossplane: + description: Crossplane defines the configuration for Crossplane. + properties: + autoUpgrade: + default: + channel: Stable + description: AutoUpgrades defines the auto upgrade configuration + for Crossplane. + properties: + channel: + default: Stable + description: |- + Channel defines the upgrade channels for Crossplane. We support the following channels where 'Stable' is the + default: + - None: disables auto-upgrades and keeps the control plane at its current version of Crossplane. + - Patch: automatically upgrades the control plane to the latest supported patch version when it + becomes available while keeping the minor version the same. + - Stable: automatically upgrades the control plane to the latest supported patch release on minor + version N-1, where N is the latest supported minor version. + - Rapid: automatically upgrades the cluster to the latest supported patch release on the latest + supported minor version. + enum: + - None + - Patch + - Stable + - Rapid + type: string + type: object + state: + default: Running + description: |- + State defines the state for crossplane and provider workloads. We support + the following states where 'Running' is the default: + - Running: Starts/Scales up all crossplane and provider workloads in the ControlPlane + - Paused: Pauses/Scales down all crossplane and provider workloads in the ControlPlane + enum: + - Running + - Paused + type: string + version: + description: Version is the version of Universal Crossplane to + install. + type: string + x-kubernetes-validations: + - message: The version must not start with a leading 'v' + rule: (self.matches('^[^v].*')) + type: object + restore: + description: Restore specifies details about the control planes restore + configuration. + properties: + finishedAt: + description: |- + FinishedAt is the time at which the control plane was restored, it's not + meant to be set by the user, but rather by the system when the control + plane is restored. + format: date-time + type: string + source: + description: |- + Source of the Backup or BackupSchedule to restore from. + Require "restore" permission on the referenced Backup or BackupSchedule. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported kinds are Backup and + BackupSchedule at the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being + referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: source must be a reference to a Backup or BackupSchedule + (v1alpha1) + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && (self.kind == 'Backup' || self.kind == 'BackupSchedule') + - message: source is immutable + rule: oldSelf == self + required: + - source + type: object + x-kubernetes-validations: + - message: finishedAt is immutable once set + rule: '!has(oldSelf.finishedAt) || oldSelf.finishedAt == self.finishedAt' + writeConnectionSecretToRef: + description: |- + WriteConnectionSecretToReference specifies the namespace and name of a + Secret to which any connection details for this managed resource should + be written. Connection details frequently include the endpoint, username, + and password required to connect to the managed resource. + This field is planned to be replaced in a future release in favor of + PublishConnectionDetailsTo. Currently, both could be set independently + and connection details would be published to both without affecting + each other. + + If omitted, it is defaulted to the namespace of the ControlPlane. + Deprecated: Use Hub or Upbound identities instead. + properties: + name: + description: Name of the secret. + type: string + namespace: + description: |- + Namespace of the secret. If omitted, it is equal to + the namespace of the resource containing this reference as a field. + type: string + required: + - name + type: object + type: object + x-kubernetes-validations: + - message: restore source can not be unset + rule: '!has(oldSelf.restore) || has(self.restore)' + - message: restore source can not be set after creation + rule: has(oldSelf.restore) || !has(self.restore) + - message: '"version" cannot be empty when upgrade channel is "None"' + rule: '!has(self.crossplane.autoUpgrade) || self.crossplane.autoUpgrade.channel + != "None" || self.crossplane.version != ""' + status: + description: A ControlPlaneStatus represents the observed state of a ControlPlane. + properties: + class: + description: |- + [[GATE:EnableControlPlaneClasses]] + Class holds the status about the control plane class. + properties: + current: + description: Current holds the actual class of the control plane + after a successful transition. + type: string + history: + description: |- + History contains a list of the control plane's class transitions and the + time they were observed. + items: + description: ClassTransition represents a record of the control + plane's transition to a different class. + properties: + class: + description: |- + Class is the class to which the control plane was observed to have + transitioned. + minLength: 1 + type: string + observedAt: + description: |- + ObservedAt is the time at which the control plane was observed to have + transitioned to the associated class. + format: date-time + type: string + required: + - class + - observedAt + type: object + maxItems: 5 + type: array + size: + description: |- + Size holds the status information about the control plane size, + including resource usage. + properties: + resourceUsage: + description: ResourceUsage represents the resource limits + and consumption of the control plane. + properties: + cpu: + description: CPU represents the CPU resource usage. + type: string + memory: + description: Memory represents the memory resource usage. + type: string + storage: + description: Storage represents the storage resource usage. + type: string + type: object + type: object + type: object + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controlPlaneID: + type: string + firstAvailableAt: + description: FirstAvailableAt is the time at which the control plane + was available for the first time. + format: date-time + type: string + message: + description: |- + Message is a human-readable message indicating details about why the + ControlPlane is in this condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: control plane name cannot exceed 63 characters + rule: self.metadata.name.size() <= 63 + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_proxies.yaml b/static/crds/space/v1.16/spaces.upbound.io_proxies.yaml new file mode 100644 index 00000000..ee4939f9 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_proxies.yaml @@ -0,0 +1,266 @@ +# Copyright 2026 Upbound Inc. +# All rights reserved + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: proxies.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: Proxy + listKind: ProxyList + plural: proxies + shortNames: + - px + singular: proxy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .status.agentID + name: Agent ID + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + Proxy represents a private-network agent connection point that enables + secure communication between Upbound and resources in private networks. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProxySpec defines the desired state of a Proxy. + properties: + agentID: + description: |- + AgentID is an optional identifier that allows sharing a single + private-network agent across multiple proxies. If omitted, + a UUID is auto-generated and set in status.agentID. + type: string + description: + description: Description is an optional human-readable description + of this Proxy + type: string + podSelector: + description: |- + PodSelector specifies which pods should have HTTP_PROXY environment + variables injected. Uses standard Kubernetes label selector semantics. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + secretRef: + description: |- + SecretRef is a reference to a secret containing the robot token used + to authenticate the proxy. + properties: + key: + description: Key is the key within the secret that contains the + token. + type: string + name: + description: Name of the secret. + type: string + required: + - key + - name + type: object + required: + - podSelector + - secretRef + type: object + x-kubernetes-validations: + - message: podSelector must specify at least one of matchLabels or matchExpressions; + an empty selector would match all pods unintentionally. + rule: (has(self.podSelector.matchLabels) && size(self.podSelector.matchLabels) + > 0) || (has(self.podSelector.matchExpressions) && size(self.podSelector.matchExpressions) + > 0) + status: + description: ProxyStatus represents the observed state of a Proxy. + properties: + agentID: + description: |- + AgentID is the ID for this Proxy. If spec.agentID was + provided, this will match that value. Otherwise, it contains the + auto-generated UUID. + type: string + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + lastAppliedPodSelector: + description: |- + LastAppliedPodSelector is the podSelector that was last applied. + Used to detect selector changes and evict only affected pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + phase: + description: Phase represents the current state of the Proxy. + enum: + - WaitingForProxy + - Connected + - Disconnected + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_sharedbackupconfigs.yaml b/static/crds/space/v1.16/spaces.upbound.io_sharedbackupconfigs.yaml new file mode 100644 index 00000000..2e449127 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_sharedbackupconfigs.yaml @@ -0,0 +1,268 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: sharedbackupconfigs.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: SharedBackupConfig + listKind: SharedBackupConfigList + plural: sharedbackupconfigs + singular: sharedbackupconfig + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.objectStorage.provider + name: Provider + type: string + - jsonPath: .spec.objectStorage.bucket + name: Bucket + type: string + - jsonPath: .spec.objectStorage.credentials.source + name: Auth + type: string + - jsonPath: .spec.objectStorage.credentials.secretRef.name + name: Secret + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SharedBackupConfig defines the configuration to backup and restore + ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + A SharedBackupConfigSpec represents the configuration to backup or restore + ControlPlanes. + properties: + objectStorage: + description: ObjectStorage specifies the object storage configuration + for the given provider. + properties: + bucket: + description: Bucket is the name of the bucket to store backups + in. + minLength: 1 + type: string + config: + description: |- + Config is a free-form map of configuration options for the object storage provider. + See https://github.com/thanos-io/objstore?tab=readme-ov-file for more + information on the formats for each supported cloud provider. Bucket and + Provider will override the required values in the config. + type: object + x-kubernetes-preserve-unknown-fields: true + credentials: + description: Credentials specifies the credentials to access the + object storage. + properties: + secretRef: + description: |- + A SecretRef is a reference to a secret key that contains the credentials + that must be used to connect to the provider. + properties: + key: + default: credentials + description: The key to select. + type: string + name: + description: Name of the secret. + type: string + required: + - key + - name + type: object + source: + description: |- + Source of the credentials. + Source "Secret" requires "get" permissions on the referenced Secret. + enum: + - Secret + - InjectedIdentity + type: string + required: + - source + type: object + prefix: + description: |- + Prefix is the prefix to use for all backups using this + SharedBackupConfig, e.g. "prod/cluster1", resulting in backups for + controlplane "ctp1" in namespace "ns1" being stored in + "prod/cluster1/ns1/ctp1". + type: string + provider: + description: Provider is the name of the object storage provider. + enum: + - AWS + - Azure + - GCP + type: string + required: + - bucket + - credentials + - provider + type: object + x-kubernetes-validations: + - message: credentials.secretRef.name must be set when source is Secret + rule: self.credentials.source != 'Secret' || (has(self.credentials.secretRef) + && has(self.credentials.secretRef.name)) + required: + - objectStorage + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.objectStorage.provider + name: Provider + type: string + - jsonPath: .spec.objectStorage.bucket + name: Bucket + type: string + - jsonPath: .spec.objectStorage.credentials.source + name: Auth + type: string + - jsonPath: .spec.objectStorage.credentials.secretRef.name + name: Secret + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: SharedBackupConfig defines the configuration to backup and restore + ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + A SharedBackupConfigSpec represents the configuration to backup or restore + ControlPlanes. + properties: + objectStorage: + description: ObjectStorage specifies the object storage configuration + for the given provider. + properties: + bucket: + description: Bucket is the name of the bucket to store backups + in. + minLength: 1 + type: string + config: + description: |- + Config is a free-form map of configuration options for the object storage provider. + See https://github.com/thanos-io/objstore?tab=readme-ov-file for more + information on the formats for each supported cloud provider. Bucket and + Provider will override the required values in the config. + type: object + x-kubernetes-preserve-unknown-fields: true + credentials: + description: Credentials specifies the credentials to access the + object storage. + properties: + secretRef: + description: |- + A SecretRef is a reference to a secret key that contains the credentials + that must be used to connect to the provider. + properties: + key: + default: credentials + description: The key to select. + type: string + name: + description: Name of the secret. + type: string + required: + - key + - name + type: object + source: + description: |- + Source of the credentials. + Source "Secret" requires "get" permissions on the referenced Secret. + enum: + - Secret + - InjectedIdentity + type: string + required: + - source + type: object + prefix: + description: |- + Prefix is the prefix to use for all backups using this + SharedBackupConfig, e.g. "prod/cluster1", resulting in backups for + controlplane "ctp1" in namespace "ns1" being stored in + "prod/cluster1/ns1/ctp1". + type: string + provider: + description: Provider is the name of the object storage provider. + enum: + - AWS + - Azure + - GCP + type: string + required: + - bucket + - credentials + - provider + type: object + x-kubernetes-validations: + - message: credentials.secretRef.name must be set when source is Secret + rule: self.credentials.source != 'Secret' || (has(self.credentials.secretRef) + && has(self.credentials.secretRef.name)) + required: + - objectStorage + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_sharedbackups.yaml b/static/crds/space/v1.16/spaces.upbound.io_sharedbackups.yaml new file mode 100644 index 00000000..1ea07499 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_sharedbackups.yaml @@ -0,0 +1,588 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: sharedbackups.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: SharedBackup + listKind: SharedBackupList + plural: sharedbackups + singular: sharedbackup + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.annotations.sharedbackup\.internal\.spaces\.upbound\.io/completed + name: Completed + type: string + - jsonPath: .metadata.annotations.sharedbackup\.internal\.spaces\.upbound\.io/failed + name: Failed + type: string + - jsonPath: .metadata.annotations.sharedbackup\.internal\.spaces\.upbound\.io/provisioned + name: Provisioned + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: SharedBackup defines a backup over a set of ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedBackupSpec defines a backup over a set of ControlPlanes. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlaneSelector: + description: |- + ControlPlaneSelector defines the selector for ControlPlanes to backup. + Requires "backup" permission on all ControlPlanes in the same namespace. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + failures: + description: Failures defines the failure tolerance for the backup. + properties: + controlPlanes: + anyOf: + - type: integer + - type: string + description: |- + ControlPlanes is the percentage of control planes that are allowed to fail and still consider the backup successful. + Can be specified as an integer (e.g., 50) or a percentage string (e.g., "50%"). + x-kubernetes-int-or-string: true + type: object + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - controlPlaneSelector + type: object + x-kubernetes-validations: + - message: shared backup ControlPlane selectors can not be changed after + creation + rule: self.controlPlaneSelector == oldSelf.controlPlaneSelector + - message: shared backup excluded resources can not be changed after creation + rule: (!has(self.excludedResources) && !has(oldSelf.excludedResources)) + || self.excludedResources == oldSelf.excludedResources + status: + description: SharedBackupStatus represents the observed state of a SharedBackup. + properties: + completed: + description: Completed is the list of ControlPlanes for which the + backup completed successfully. + items: + type: string + type: array + x-kubernetes-list-type: set + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failed: + description: Failed is the list of ControlPlanes for which the backup + failed. + items: + type: string + type: array + x-kubernetes-list-type: set + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + phase: + default: Pending + description: Phase represents the current phase of the SharedBackup. + enum: + - Pending + - InProgress + - Failed + - Completed + type: string + selectedControlPlanes: + description: SelectedControlPlanes represents the names of the selected + ControlPlanes. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.annotations.sharedbackup\.internal\.spaces\.upbound\.io/completed + name: Completed + type: string + - jsonPath: .metadata.annotations.sharedbackup\.internal\.spaces\.upbound\.io/failed + name: Failed + type: string + - jsonPath: .metadata.annotations.sharedbackup\.internal\.spaces\.upbound\.io/provisioned + name: Provisioned + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: SharedBackup defines a backup over a set of ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedBackupSpec defines a backup over a set of ControlPlanes. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlaneSelector: + description: |- + ControlPlaneSelector defines the selector for ControlPlanes to backup. + Requires "backup" permission on all ControlPlanes in the same namespace. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + failures: + description: Failures defines the failure tolerance for the backup. + properties: + controlPlanes: + anyOf: + - type: integer + - type: string + description: |- + ControlPlanes is the percentage of control planes that are allowed to fail and still consider the backup successful. + Can be specified as an integer (e.g., 50) or a percentage string (e.g., "50%"). + x-kubernetes-int-or-string: true + type: object + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - controlPlaneSelector + type: object + x-kubernetes-validations: + - message: shared backup ControlPlane selectors can not be changed after + creation + rule: self.controlPlaneSelector == oldSelf.controlPlaneSelector + - message: shared backup excluded resources can not be changed after creation + rule: (!has(self.excludedResources) && !has(oldSelf.excludedResources)) + || self.excludedResources == oldSelf.excludedResources + status: + description: SharedBackupStatus represents the observed state of a SharedBackup. + properties: + completed: + description: Completed is the list of ControlPlanes for which the + backup completed successfully. + items: + type: string + type: array + x-kubernetes-list-type: set + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failed: + description: Failed is the list of ControlPlanes for which the backup + failed. + items: + type: string + type: array + x-kubernetes-list-type: set + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + phase: + default: Pending + description: Phase represents the current phase of the SharedBackup. + enum: + - Pending + - InProgress + - Failed + - Completed + type: string + selectedControlPlanes: + description: SelectedControlPlanes represents the names of the selected + ControlPlanes. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_sharedbackupschedules.yaml b/static/crds/space/v1.16/spaces.upbound.io_sharedbackupschedules.yaml new file mode 100644 index 00000000..59524e1b --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_sharedbackupschedules.yaml @@ -0,0 +1,528 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: sharedbackupschedules.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: SharedBackupSchedule + listKind: SharedBackupScheduleList + plural: sharedbackupschedules + singular: sharedbackupschedule + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.schedule + name: Schedule + type: string + - jsonPath: .spec.suspend + name: Suspended + type: boolean + - jsonPath: .metadata.annotations.sharedbackupschedule\.internal\.spaces\.upbound\.io/provisioned-total + name: Provisioned + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + SharedBackupSchedule defines a schedule for SharedBackup on a set of + ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedBackupScheduleSpec defines the desired state of a SharedBackupSchedule. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlaneSelector: + description: |- + ControlPlaneSelector defines the selector for ControlPlanes to backup. + Requires "backup" permission on all ControlPlanes in the same namespace. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + schedule: + description: Schedule in Cron format, see https://en.wikipedia.org/wiki/Cron. + minLength: 1 + type: string + suspend: + description: |- + Suspend specifies whether the schedule is suspended. If true, no + Backups will be created, but running backups will be allowed to + complete. + type: boolean + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - controlPlaneSelector + - schedule + type: object + status: + description: SharedBackupScheduleStatus represents the observed state + of a SharedBackupSchedule. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + selectedControlPlanes: + description: |- + SelectedControlPlanes is the list of ControlPlanes that are selected + for backup. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.schedule + name: Schedule + type: string + - jsonPath: .spec.suspend + name: Suspended + type: boolean + - jsonPath: .metadata.annotations.sharedbackupschedule\.internal\.spaces\.upbound\.io/provisioned-total + name: Provisioned + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + SharedBackupSchedule defines a schedule for SharedBackup on a set of + ControlPlanes. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedBackupScheduleSpec defines the desired state of a SharedBackupSchedule. + properties: + configRef: + description: |- + ConfigRef is a reference to the backup configuration. + ApiGroup is optional and defaults to "spaces.upbound.io". + Kind is required, and the only supported value is "SharedBackupConfig" at + the moment. + Name is required. + properties: + apiGroup: + description: APIGroup is the group for the resource being referenced. + type: string + kind: + description: Kind is the type of resource being referenced. + minLength: 1 + type: string + name: + description: Name is the name of resource being referenced. + minLength: 1 + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: backup config ref must be a reference to a SharedBackupConfig + rule: (!has(self.apiGroup) || self.apiGroup == 'spaces.upbound.io') + && self.kind == 'SharedBackupConfig' + - message: backup config ref must have a name + rule: size(self.name) > 0 + controlPlaneSelector: + description: |- + ControlPlaneSelector defines the selector for ControlPlanes to backup. + Requires "backup" permission on all ControlPlanes in the same namespace. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + deletionPolicy: + default: Orphan + description: DeletionPolicy is the policy for the backup. + enum: + - Orphan + - Delete + type: string + excludedResources: + description: |- + ExcludedResources is a slice of resource names that are not + included in the backup. Used to filter the included extra resources. + items: + type: string + type: array + x-kubernetes-list-type: set + schedule: + description: Schedule in Cron format, see https://en.wikipedia.org/wiki/Cron. + minLength: 1 + type: string + suspend: + description: |- + Suspend specifies whether the schedule is suspended. If true, no + Backups will be created, but running backups will be allowed to + complete. + type: boolean + ttl: + description: |- + TTL is the time to live for the backup. After this time, the backup + will be eligible for garbage collection. If not set, the backup will + not be garbage collected. + type: string + useOwnerReferencesInBackup: + description: |- + UseOwnerReferencesBackup specifies whether an ownership chain should be + established between this resource and the Backup it creates. + If set to true, the Backup will be garbage collected when this resource + is deleted. + type: boolean + required: + - configRef + - controlPlaneSelector + - schedule + type: object + status: + description: SharedBackupScheduleStatus represents the observed state + of a SharedBackupSchedule. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + selectedControlPlanes: + description: |- + SelectedControlPlanes is the list of ControlPlanes that are selected + for backup. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_sharedexternalsecrets.yaml b/static/crds/space/v1.16/spaces.upbound.io_sharedexternalsecrets.yaml new file mode 100644 index 00000000..6bf31a8e --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_sharedexternalsecrets.yaml @@ -0,0 +1,830 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: sharedexternalsecrets.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - externalsecrets + kind: SharedExternalSecret + listKind: SharedExternalSecretList + plural: sharedexternalsecrets + shortNames: + - ses + singular: sharedexternalsecret + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.annotations.sharedexternalsecrets\.internal\.spaces\.upbound\.io/provisioned-total + name: Provisioned + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + SharedExternalSecret specifies a shared ExternalSecret projected into the specified + ControlPlanes of the same namespace as ClusterExternalSecret and with that + propagated into the specified namespaces. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedExternalSecretSpec defines the desired state of SharedExternalSecret. + properties: + controlPlaneSelector: + description: |- + The secret is projected only to control planes + matching the provided selector. Either names or a labelSelector must be specified. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + externalSecretMetadata: + description: The metadata of the secret store to be created. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that are set on projected resource. + type: object + labels: + additionalProperties: + type: string + description: Labels that are set on projected resource. + type: object + type: object + externalSecretName: + description: |- + ExternalSecretName is the name to use when creating external secret within a control plane. + optional, if not set, SharedExternalSecret name will be used. + When set, it is immutable. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: externalSecretName is immutable + rule: self == oldSelf + externalSecretSpec: + description: The spec for the ExternalSecrets to be created. + properties: + data: + description: Data defines the connection between the Kubernetes + Secret keys and the Provider data + items: + description: ExternalSecretData defines the connection between + the Kubernetes Secret key (spec.data.) and the Provider + data. + properties: + remoteRef: + description: |- + RemoteRef points to the remote secret and defines + which secret (version/property/..) to fetch. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + enum: + - Default + - Unicode + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + enum: + - Auto + - Base64 + - Base64URL + - None + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + metadataPolicy: + default: None + description: Policy for fetching tags/labels from provider + secrets, possible options are Fetch, None. Defaults + to None + enum: + - None + - Fetch + type: string + property: + description: Used to select a specific property of the + Provider value (if a map), if supported + type: string + version: + description: Used to select a specific version of the + Provider value, if supported + type: string + required: + - key + type: object + secretKey: + description: The key in the Kubernetes Secret to store the + value. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + sourceRef: + description: |- + SourceRef allows you to override the source + from which the value will be pulled. + maxProperties: 1 + minProperties: 1 + properties: + generatorRef: + description: |- + GeneratorRef points to a generator custom resource. + + Deprecated: The generatorRef is not implemented in .data[]. + this will be removed with v1. + properties: + apiVersion: + default: generators.external-secrets.io/v1alpha1 + description: Specify the apiVersion of the generator + resource + type: string + kind: + description: Specify the Kind of the generator resource + enum: + - ACRAccessToken + - ClusterGenerator + - ECRAuthorizationToken + - Fake + - GCRAccessToken + - GithubAccessToken + - QuayAccessToken + - Password + - STSSessionToken + - UUID + - VaultDynamicSecret + - Webhook + - Grafana + type: string + name: + description: Specify the name of the generator resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - kind + - name + type: object + storeRef: + description: SecretStoreRef defines which SecretStore + to fetch the ExternalSecret data. + properties: + kind: + description: |- + Kind of the SecretStore resource (SecretStore or ClusterSecretStore) + Defaults to `SecretStore` + enum: + - SecretStore + - ClusterSecretStore + type: string + name: + description: Name of the SecretStore resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + type: object + type: object + required: + - remoteRef + - secretKey + type: object + type: array + dataFrom: + description: |- + DataFrom is used to fetch all properties from a specific Provider data + If multiple entries are specified, the Secret keys are merged in the specified order + items: + properties: + extract: + description: |- + Used to extract multiple key/value pairs from one secret + Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + enum: + - Default + - Unicode + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + enum: + - Auto + - Base64 + - Base64URL + - None + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + metadataPolicy: + default: None + description: Policy for fetching tags/labels from provider + secrets, possible options are Fetch, None. Defaults + to None + enum: + - None + - Fetch + type: string + property: + description: Used to select a specific property of the + Provider value (if a map), if supported + type: string + version: + description: Used to select a specific version of the + Provider value, if supported + type: string + required: + - key + type: object + find: + description: |- + Used to find secrets based on tags or regular expressions + Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + enum: + - Default + - Unicode + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + enum: + - Auto + - Base64 + - Base64URL + - None + type: string + name: + description: Finds secrets based on the name. + properties: + regexp: + description: Finds secrets base + type: string + type: object + path: + description: A root path to start the find operations. + type: string + tags: + additionalProperties: + type: string + description: Find secrets based on tags. + type: object + type: object + rewrite: + description: |- + Used to rewrite secret Keys after getting them from the secret Provider + Multiple Rewrite operations can be provided. They are applied in a layered order (first to last) + items: + properties: + regexp: + description: |- + Used to rewrite with regular expressions. + The resulting key will be the output of a regexp.ReplaceAll operation. + properties: + source: + description: Used to define the regular expression + of a re.Compiler. + type: string + target: + description: Used to define the target pattern + of a ReplaceAll operation. + type: string + required: + - source + - target + type: object + transform: + description: |- + Used to apply string transformation on the secrets. + The resulting key will be the output of the template applied by the operation. + properties: + template: + description: |- + Used to define the template to apply on the secret name. + `.value ` will specify the secret name in the template. + type: string + required: + - template + type: object + type: object + type: array + sourceRef: + description: |- + SourceRef points to a store or generator + which contains secret values ready to use. + Use this in combination with Extract or Find pull values out of + a specific SecretStore. + When sourceRef points to a generator Extract or Find is not supported. + The generator returns a static map of values + maxProperties: 1 + minProperties: 1 + properties: + generatorRef: + description: GeneratorRef points to a generator custom + resource. + properties: + apiVersion: + default: generators.external-secrets.io/v1alpha1 + description: Specify the apiVersion of the generator + resource + type: string + kind: + description: Specify the Kind of the generator resource + enum: + - ACRAccessToken + - ClusterGenerator + - ECRAuthorizationToken + - Fake + - GCRAccessToken + - GithubAccessToken + - QuayAccessToken + - Password + - STSSessionToken + - UUID + - VaultDynamicSecret + - Webhook + - Grafana + type: string + name: + description: Specify the name of the generator resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - kind + - name + type: object + storeRef: + description: SecretStoreRef defines which SecretStore + to fetch the ExternalSecret data. + properties: + kind: + description: |- + Kind of the SecretStore resource (SecretStore or ClusterSecretStore) + Defaults to `SecretStore` + enum: + - SecretStore + - ClusterSecretStore + type: string + name: + description: Name of the SecretStore resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + type: object + type: object + type: object + type: array + refreshInterval: + default: 1h + description: |- + RefreshInterval is the amount of time before the values are read again from the SecretStore provider, + specified as Golang Duration strings. + Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h" + Example values: "1h", "2h30m", "10s" + May be set to zero to fetch and create it once. Defaults to 1h. + type: string + refreshPolicy: + description: |- + RefreshPolicy determines how the ExternalSecret should be refreshed: + - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter + - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval. + No periodic updates occur if refreshInterval is 0. + - OnChange: Only synchronizes the Secret when the ExternalSecret's metadata or specification changes + enum: + - CreatedOnce + - Periodic + - OnChange + type: string + secretStoreRef: + description: SecretStoreRef defines which SecretStore to fetch + the ExternalSecret data. + properties: + kind: + description: |- + Kind of the SecretStore resource (SecretStore or ClusterSecretStore) + Defaults to `SecretStore` + enum: + - SecretStore + - ClusterSecretStore + type: string + name: + description: Name of the SecretStore resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + type: object + target: + default: + creationPolicy: Owner + deletionPolicy: Retain + description: |- + ExternalSecretTarget defines the Kubernetes Secret to be created + There can be only one target per ExternalSecret. + properties: + creationPolicy: + default: Owner + description: |- + CreationPolicy defines rules on how to create the resulting Secret. + Defaults to "Owner" + enum: + - Owner + - Orphan + - Merge + - None + type: string + deletionPolicy: + default: Retain + description: |- + DeletionPolicy defines rules on how to delete the resulting Secret. + Defaults to "Retain" + enum: + - Delete + - Merge + - Retain + type: string + immutable: + description: Immutable defines if the final secret will be + immutable + type: boolean + name: + description: |- + The name of the Secret resource to be managed. + Defaults to the .metadata.name of the ExternalSecret resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + template: + description: Template defines a blueprint for the created + Secret resource. + properties: + data: + additionalProperties: + type: string + type: object + engineVersion: + default: v2 + description: |- + EngineVersion specifies the template engine version + that should be used to compile/execute the + template specified in .data and .templateFrom[]. + enum: + - v2 + type: string + mergePolicy: + default: Replace + enum: + - Replace + - Merge + type: string + metadata: + description: ExternalSecretTemplateMetadata defines metadata + fields for the Secret blueprint. + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + templateFrom: + items: + properties: + configMap: + properties: + items: + description: A list of keys in the ConfigMap/Secret + to use as templates for Secret data + items: + properties: + key: + description: A key in the ConfigMap/Secret + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + templateAs: + default: Values + enum: + - Values + - KeysAndValues + type: string + required: + - key + type: object + type: array + name: + description: The name of the ConfigMap/Secret + resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - items + - name + type: object + literal: + type: string + secret: + properties: + items: + description: A list of keys in the ConfigMap/Secret + to use as templates for Secret data + items: + properties: + key: + description: A key in the ConfigMap/Secret + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + templateAs: + default: Values + enum: + - Values + - KeysAndValues + type: string + required: + - key + type: object + type: array + name: + description: The name of the ConfigMap/Secret + resource + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - items + - name + type: object + target: + default: Data + enum: + - Data + - Annotations + - Labels + type: string + type: object + type: array + type: + type: string + type: object + type: object + type: object + namespaceSelector: + description: |- + The projected secret can be consumed + only within namespaces matching the provided selector. + Either names or a labelSelector must be specified. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + refreshTime: + description: Used to configure secret refresh interval in seconds. + type: string + required: + - controlPlaneSelector + - externalSecretSpec + - namespaceSelector + type: object + x-kubernetes-validations: + - message: externalSecretName is immutable + rule: has(self.externalSecretName) == has(oldSelf.externalSecretName) + status: + description: SharedExternalSecretStatus defines the observed state of + the ExternalSecret. + properties: + failed: + description: list of provisioning failures. + items: + description: |- + SharedExternalSecretProvisioningFailure describes a external secret provisioning + failure in a specific control plane. + properties: + conditions: + description: List of conditions. + items: + properties: + message: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + controlPlane: + description: ControlPlane name where the failure occurred. + type: string + required: + - controlPlane + type: object + type: array + x-kubernetes-list-map-keys: + - controlPlane + x-kubernetes-list-type: map + observedGeneration: + description: observed resource generation. + format: int64 + type: integer + provisioned: + description: List of successfully provisioned targets. + items: + description: SharedExternalSecretProvisioningSuccess defines external + secret provisioning success. + properties: + controlPlane: + description: ControlPlane name where the external secret got + successfully projected. + type: string + required: + - controlPlane + type: object + type: array + x-kubernetes-list-map-keys: + - controlPlane + x-kubernetes-list-type: map + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_sharedsecretstores.yaml b/static/crds/space/v1.16/spaces.upbound.io_sharedsecretstores.yaml new file mode 100644 index 00000000..36ed8086 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_sharedsecretstores.yaml @@ -0,0 +1,4654 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: sharedsecretstores.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - externalsecrets + kind: SharedSecretStore + listKind: SharedSecretStoreList + plural: sharedsecretstores + shortNames: + - sss + singular: sharedsecretstore + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.annotations.sharedsecretstores\.internal\.spaces\.upbound\.io/provisioned-total + name: Provisioned + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + SharedSecretStore represents a shared SecretStore projected as ClusterSecretStore + into matching ControlPlanes in the same namespace. Once projected into a ControlPlane, + it can be referenced from ExternalSecret instances, as part of `storeRef` fields. + The secret store configuration including referenced credential are not leaked into the + ControlPlanes and in that sense can be called secure as they are invisible to the + ControlPlane workloads. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SharedSecretStoreSpec defines the desired state of SecretStore. + properties: + controlPlaneSelector: + description: |- + The store is projected only to control planes + matching the provided selector. Either names or a labelSelector must be specified. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + namespaceSelector: + description: |- + The projected secret store can be consumed + only within namespaces matching the provided selector. + Either names or a labelSelector must be specified. + properties: + labelSelectors: + description: |- + A resource is matched if any of the label selector matches. + In case when the list is empty, resource is matched too. + items: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: array + names: + description: |- + A resource is selected if its metadata.name matches any of the provided names. + In case when the list is empty, resource is matched too. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object + x-kubernetes-validations: + - message: either names or a labelSelector must be specified + rule: (has(self.labelSelectors) || has(self.names)) && (size(self.labelSelectors) + > 0 || size(self.names) > 0) + provider: + description: Used to configure the provider. Only one provider may + be set. + maxProperties: 1 + minProperties: 1 + properties: + akeyless: + description: Akeyless configures this store to sync secrets using + Akeyless Vault provider + properties: + akeylessGWApiURL: + description: Akeyless GW API Url from which the secrets to + be fetched from. + type: string + authSecretRef: + description: Auth configures how the operator authenticates + with Akeyless. + properties: + kubernetesAuth: + description: |- + Kubernetes authenticates with Akeyless by passing the ServiceAccount + token stored in the named Secret resource. + properties: + accessID: + description: the Akeyless Kubernetes auth-method access-id + type: string + k8sConfName: + description: Kubernetes-auth configuration name in + Akeyless-Gateway + type: string + secretRef: + description: |- + Optional secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Akeyless. If a name is specified without a key, + `token` is the default. If one is not specified, the one bound to + the controller will be used. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional service account field containing the name of a kubernetes ServiceAccount. + If the service account is specified, the service account secret token JWT will be used + for authenticating with Akeyless. If the service account selector is not supplied, + the secretRef will be used instead. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - accessID + - k8sConfName + type: object + secretRef: + description: |- + Reference to a Secret that contains the details + to authenticate with Akeyless. + properties: + accessID: + description: The SecretAccessID is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + accessType: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + accessTypeParam: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + caBundle: + description: |- + PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used + if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Akeyless Gateway certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider + type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + required: + - akeylessGWApiURL + - authSecretRef + type: object + alibaba: + description: Alibaba configures this store to sync secrets using + Alibaba Cloud provider + properties: + auth: + description: AlibabaAuth contains a secretRef for credentials. + properties: + rrsa: + description: Authenticate against Alibaba using RRSA. + properties: + oidcProviderArn: + type: string + oidcTokenFilePath: + type: string + roleArn: + type: string + sessionName: + type: string + required: + - oidcProviderArn + - oidcTokenFilePath + - roleArn + - sessionName + type: object + secretRef: + description: AlibabaAuthSecretRef holds secret references + for Alibaba credentials. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + accessKeySecretSecretRef: + description: The AccessKeySecret is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessKeyIDSecretRef + - accessKeySecretSecretRef + type: object + type: object + regionID: + description: Alibaba Region to be used for the provider + type: string + required: + - auth + - regionID + type: object + aws: + description: AWS configures this store to sync secrets using AWS + Secret Manager provider + properties: + additionalRoles: + description: AdditionalRoles is a chained list of Role ARNs + which the provider will sequentially assume before assuming + the Role + items: + type: string + type: array + auth: + description: |- + Auth defines the information necessary to authenticate against AWS + if not set aws sdk will infer credentials from your environment + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + jwt: + description: Authenticate against AWS using service account + tokens. + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + type: object + secretRef: + description: |- + AWSAuthSecretRef holds secret references for AWS credentials + both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + sessionTokenSecretRef: + description: |- + The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey are temporary credentials + see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + externalID: + description: AWS External ID set on assumed IAM roles + type: string + prefix: + description: Prefix adds a prefix to all retrieved values. + type: string + region: + description: AWS Region to be used for the provider + type: string + role: + description: Role is a Role ARN which the provider will assume + type: string + secretsManager: + description: SecretsManager defines how the provider behaves + when interacting with AWS SecretsManager + properties: + forceDeleteWithoutRecovery: + description: |- + Specifies whether to delete the secret without any recovery window. You + can't use both this parameter and RecoveryWindowInDays in the same call. + If you don't use either, then by default Secrets Manager uses a 30 day + recovery window. + see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery + type: boolean + recoveryWindowInDays: + description: |- + The number of days from 7 to 30 that Secrets Manager waits before + permanently deleting the secret. You can't use both this parameter and + ForceDeleteWithoutRecovery in the same call. If you don't use either, + then by default Secrets Manager uses a 30 day recovery window. + see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays + format: int64 + type: integer + type: object + service: + description: Service defines which service should be used + to fetch the secrets + enum: + - SecretsManager + - ParameterStore + type: string + sessionTags: + description: AWS STS assume role session tags + items: + properties: + key: + type: string + value: + type: string + required: + - key + - value + type: object + type: array + transitiveTagKeys: + description: AWS STS assume role transitive session tags. + Required when multiple rules are used with the provider + items: + type: string + type: array + required: + - region + - service + type: object + azurekv: + description: AzureKV configures this store to sync secrets using + Azure Key Vault provider + properties: + authSecretRef: + description: Auth configures how the operator authenticates + with Azure. Required for ServicePrincipal auth type. Optional + for WorkloadIdentity. + properties: + clientCertificate: + description: The Azure ClientCertificate of the service + principle used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientId: + description: The Azure clientId of the service principle + or managed identity used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientSecret: + description: The Azure ClientSecret of the service principle + used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + tenantId: + description: The Azure tenantId of the managed identity + used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + authType: + default: ServicePrincipal + description: |- + Auth type defines how to authenticate to the keyvault service. + Valid values are: + - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret) + - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity) + enum: + - ServicePrincipal + - ManagedIdentity + - WorkloadIdentity + type: string + environmentType: + default: PublicCloud + description: |- + EnvironmentType specifies the Azure cloud environment endpoints to use for + connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. + The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 + PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud + enum: + - PublicCloud + - USGovernmentCloud + - ChinaCloud + - GermanCloud + type: string + identityId: + description: If multiple Managed Identity is assigned to the + pod, you can select the one to be used + type: string + serviceAccountRef: + description: |- + ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tenantId: + description: TenantID configures the Azure Tenant to send + requests to. Required for ServicePrincipal auth type. Optional + for WorkloadIdentity. + type: string + vaultUrl: + description: Vault Url from which the secrets to be fetched + from. + type: string + required: + - vaultUrl + type: object + beyondtrust: + description: Beyondtrust configures this store to sync secrets + using Password Safe provider. + properties: + auth: + description: Auth configures how the operator authenticates + with Beyondtrust. + properties: + apiKey: + description: APIKey If not provided then ClientID/ClientSecret + become required. + properties: + secretRef: + description: SecretRef references a key in a secret + that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set + a value without using a secret. + type: string + type: object + certificate: + description: Certificate (cert.pem) for use when authenticating + with an OAuth client Id using a Client Certificate. + properties: + secretRef: + description: SecretRef references a key in a secret + that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set + a value without using a secret. + type: string + type: object + certificateKey: + description: Certificate private key (key.pem). For use + when authenticating with an OAuth client Id + properties: + secretRef: + description: SecretRef references a key in a secret + that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set + a value without using a secret. + type: string + type: object + clientId: + description: ClientID is the API OAuth Client ID. + properties: + secretRef: + description: SecretRef references a key in a secret + that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set + a value without using a secret. + type: string + type: object + clientSecret: + description: ClientSecret is the API OAuth Client Secret. + properties: + secretRef: + description: SecretRef references a key in a secret + that will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set + a value without using a secret. + type: string + type: object + type: object + server: + description: Auth configures how API server works. + properties: + apiUrl: + type: string + apiVersion: + type: string + clientTimeOutSeconds: + description: Timeout specifies a time limit for requests + made by this Client. The timeout includes connection + time, any redirects, and reading the response body. + Defaults to 45 seconds. + type: integer + retrievalType: + description: The secret retrieval type. SECRET = Secrets + Safe (credential, text, file). MANAGED_ACCOUNT = Password + Safe account associated with a system. + type: string + separator: + description: A character that separates the folder names. + type: string + verifyCA: + type: boolean + required: + - apiUrl + - verifyCA + type: object + required: + - auth + - server + type: object + bitwardensecretsmanager: + description: BitwardenSecretsManager configures this store to + sync secrets using BitwardenSecretsManager provider + properties: + apiURL: + type: string + auth: + description: |- + Auth configures how secret-manager authenticates with a bitwarden machine account instance. + Make sure that the token being used has permissions on the given secret. + properties: + secretRef: + description: BitwardenSecretsManagerSecretRef contains + the credential ref to the bitwarden instance. + properties: + credentials: + description: AccessToken used for the bitwarden instance. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - credentials + type: object + required: + - secretRef + type: object + bitwardenServerSDKURL: + type: string + caBundle: + description: |- + Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack + can be performed. + type: string + caProvider: + description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider + type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + identityURL: + type: string + organizationID: + description: OrganizationID determines which organization + this secret store manages. + type: string + projectID: + description: ProjectID determines which project this secret + store manages. + type: string + required: + - auth + - organizationID + - projectID + type: object + chef: + description: Chef configures this store to sync secrets with chef + server + properties: + auth: + description: Auth defines the information necessary to authenticate + against chef Server + properties: + secretRef: + description: ChefAuthSecretRef holds secret references + for chef server login credentials. + properties: + privateKeySecretRef: + description: SecretKey is the Signing Key in PEM format, + used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - privateKeySecretRef + type: object + required: + - secretRef + type: object + serverUrl: + description: ServerURL is the chef server URL used to connect + to. If using orgs you should include your org in the url + and terminate the url with a "/" + type: string + username: + description: UserName should be the user ID on the chef server + type: string + required: + - auth + - serverUrl + - username + type: object + cloudrusm: + description: CloudruSM configures this store to sync secrets using + the Cloud.ru Secret Manager provider + properties: + auth: + description: CSMAuth contains a secretRef for credentials. + properties: + secretRef: + description: CSMAuthSecretRef holds secret references + for Cloud.ru credentials. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + accessKeySecretSecretRef: + description: The AccessKeySecret is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessKeyIDSecretRef + - accessKeySecretSecretRef + type: object + type: object + projectID: + description: ProjectID is the project, which the secrets are + stored in. + type: string + required: + - auth + type: object + conjur: + description: Conjur configures this store to sync secrets using + conjur provider + properties: + auth: + description: Defines authentication settings for connecting + to Conjur. + properties: + apikey: + description: Authenticates with Conjur using an API key. + properties: + account: + description: Account is the Conjur organization account + name. + type: string + apiKeyRef: + description: |- + A reference to a specific 'key' containing the Conjur API key + within a Secret resource. In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + userRef: + description: |- + A reference to a specific 'key' containing the Conjur username + within a Secret resource. In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - account + - apiKeyRef + - userRef + type: object + jwt: + description: Jwt enables JWT authentication using Kubernetes + service account tokens. + properties: + account: + description: Account is the Conjur organization account + name. + type: string + hostId: + description: |- + Optional HostID for JWT authentication. This may be used depending + on how the Conjur JWT authenticator policy is configured. + type: string + secretRef: + description: |- + Optional SecretRef that refers to a key in a Secret resource containing JWT token to + authenticate with Conjur using the JWT authentication method. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional ServiceAccountRef specifies the Kubernetes service account for which to request + a token for with the `TokenRequest` API. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + serviceID: + description: The conjur authn jwt webservice id + type: string + required: + - account + - serviceID + type: object + type: object + caBundle: + description: CABundle is a PEM encoded CA bundle that will + be used to validate the Conjur server certificate. + type: string + caProvider: + description: |- + Used to provide custom certificate authority (CA) certificates + for a secret store. The CAProvider points to a Secret or ConfigMap resource + that contains a PEM-encoded certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider + type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + description: URL is the endpoint of the Conjur instance. + type: string + required: + - auth + - url + type: object + delinea: + description: |- + Delinea DevOps Secrets Vault + https://docs.delinea.com/online-help/products/devops-secrets-vault/current + properties: + clientId: + description: ClientID is the non-secret part of the credential. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + clientSecret: + description: ClientSecret is the secret part of the credential. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + tenant: + description: Tenant is the chosen hostname / site name. + type: string + tld: + description: |- + TLD is based on the server location that was chosen during provisioning. + If unset, defaults to "com". + type: string + urlTemplate: + description: |- + URLTemplate + If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s". + type: string + required: + - clientId + - clientSecret + - tenant + type: object + device42: + description: Device42 configures this store to sync secrets using + the Device42 provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Device42 instance. + properties: + secretRef: + properties: + credentials: + description: Username / Password is used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + required: + - secretRef + type: object + host: + description: URL configures the Device42 instance URL. + type: string + required: + - auth + - host + type: object + doppler: + description: Doppler configures this store to sync secrets using + the Doppler provider + properties: + auth: + description: Auth configures how the Operator authenticates + with the Doppler API + properties: + secretRef: + properties: + dopplerToken: + description: |- + The DopplerToken is used for authentication. + See https://docs.doppler.com/reference/api#authentication for auth token types. + The Key attribute defaults to dopplerToken if not specified. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - dopplerToken + type: object + required: + - secretRef + type: object + config: + description: Doppler config (required if not using a Service + Token) + type: string + format: + description: Format enables the downloading of secrets as + a file (string) + enum: + - json + - dotnet-json + - env + - yaml + - docker + type: string + nameTransformer: + description: Environment variable compatible name transforms + that change secret names to a different format + enum: + - upper-camel + - camel + - lower-snake + - tf-var + - dotnet-env + - lower-kebab + type: string + project: + description: Doppler project (required if not using a Service + Token) + type: string + required: + - auth + type: object + fake: + description: Fake configures a store with static key/value pairs + properties: + data: + items: + properties: + key: + type: string + value: + type: string + version: + type: string + required: + - key + - value + type: object + type: array + required: + - data + type: object + fortanix: + description: Fortanix configures this store to sync secrets using + the Fortanix provider + properties: + apiKey: + description: APIKey is the API token to access SDKMS Applications. + properties: + secretRef: + description: SecretRef is a reference to a secret containing + the SDKMS API Key. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + apiUrl: + description: APIURL is the URL of SDKMS API. Defaults to `sdkms.fortanix.com`. + type: string + type: object + gcpsm: + description: GCPSM configures this store to sync secrets using + Google Cloud Platform Secret Manager provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against GCP + properties: + secretRef: + properties: + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + workloadIdentity: + properties: + clusterLocation: + description: |- + ClusterLocation is the location of the cluster + If not specified, it fetches information from the metadata server + type: string + clusterName: + description: |- + ClusterName is the name of the cluster + If not specified, it fetches information from the metadata server + type: string + clusterProjectID: + description: |- + ClusterProjectID is the project ID of the cluster + If not specified, it fetches information from the metadata server + type: string + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + type: object + location: + description: Location optionally defines a location for a + secret + type: string + projectID: + description: ProjectID project where secret is located + type: string + type: object + github: + description: Github configures this store to push Github Action + secrets using Github API provider + properties: + appID: + description: appID specifies the Github APP that will be used + to authenticate the client + format: int64 + type: integer + auth: + description: auth configures how secret-manager authenticates + with a Github instance. + properties: + privateKey: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - privateKey + type: object + environment: + description: environment will be used to fetch secrets from + a particular environment within a github repository + type: string + installationID: + description: installationID specifies the Github APP installation + that will be used to authenticate the client + format: int64 + type: integer + organization: + description: organization will be used to fetch secrets from + the Github organization + type: string + repository: + description: repository will be used to fetch secrets from + the Github repository within an organization + type: string + uploadURL: + description: Upload URL for enterprise instances. Default + to URL. + type: string + url: + default: https://github.com/ + description: URL configures the Github instance URL. Defaults + to https://github.com/. + type: string + required: + - appID + - auth + - installationID + - organization + type: object + gitlab: + description: GitLab configures this store to sync secrets using + GitLab Variables provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a GitLab instance. + properties: + SecretRef: + properties: + accessToken: + description: AccessToken is used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + required: + - SecretRef + type: object + environment: + description: Environment environment_scope of gitlab CI/CD + variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment + on how to create environments) + type: string + groupIDs: + description: GroupIDs specify, which gitlab groups to pull + secrets from. Group secrets are read from left to right + followed by the project variables. + items: + type: string + type: array + inheritFromGroups: + description: InheritFromGroups specifies whether parent groups + should be discovered and checked for secrets. + type: boolean + projectID: + description: ProjectID specifies a project where secrets are + located. + type: string + url: + description: URL configures the GitLab instance URL. Defaults + to https://gitlab.com/. + type: string + required: + - auth + type: object + ibm: + description: IBM configures this store to sync secrets using IBM + Cloud provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the IBM secrets manager. + maxProperties: 1 + minProperties: 1 + properties: + containerAuth: + description: IBM Container-based auth with IAM Trusted + Profile. + properties: + iamEndpoint: + type: string + profile: + description: the IBM Trusted Profile + type: string + tokenLocation: + description: Location the token is mounted on the + pod + type: string + required: + - profile + type: object + secretRef: + properties: + secretApiKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + serviceUrl: + description: ServiceURL is the Endpoint URL that is specific + to the Secrets Manager service instance + type: string + required: + - auth + type: object + infisical: + description: Infisical configures this store to sync secrets using + the Infisical provider + properties: + auth: + description: Auth configures how the Operator authenticates + with the Infisical API + properties: + universalAuthCredentials: + properties: + clientId: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientSecret: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - clientId + - clientSecret + type: object + type: object + hostAPI: + default: https://app.infisical.com/api + description: HostAPI specifies the base URL of the Infisical + API. If not provided, it defaults to "https://app.infisical.com/api". + type: string + secretsScope: + description: SecretsScope defines the scope of the secrets + within the workspace + properties: + environmentSlug: + description: EnvironmentSlug is the required slug identifier + for the environment. + type: string + expandSecretReferences: + default: true + description: ExpandSecretReferences indicates whether + secret references should be expanded. Defaults to true + if not provided. + type: boolean + projectSlug: + description: ProjectSlug is the required slug identifier + for the project. + type: string + recursive: + default: false + description: Recursive indicates whether the secrets should + be fetched recursively. Defaults to false if not provided. + type: boolean + secretsPath: + default: / + description: SecretsPath specifies the path to the secrets + within the workspace. Defaults to "/" if not provided. + type: string + required: + - environmentSlug + - projectSlug + type: object + required: + - auth + - secretsScope + type: object + keepersecurity: + description: KeeperSecurity configures this store to sync secrets + using the KeeperSecurity provider + properties: + authRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + folderID: + type: string + required: + - authRef + - folderID + type: object + kubernetes: + description: Kubernetes configures this store to sync secrets + using a Kubernetes cluster provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Kubernetes instance. + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + clientKey: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + serviceAccount: + description: points to a service account that should be + used for authentication + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + authRef: + description: A reference to a secret that contains the auth + information. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being referred + to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + remoteNamespace: + default: default + description: Remote namespace to fetch the secrets from + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + server: + description: configures the Kubernetes server Address. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can + be found in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the + provider type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + type: object + onboardbase: + description: Onboardbase configures this store to sync secrets + using the Onboardbase provider + properties: + apiHost: + default: https://public.onboardbase.com/api/v1/ + description: APIHost use this to configure the host url for + the API for selfhosted installation, default is https://public.onboardbase.com/api/v1/ + type: string + auth: + description: Auth configures how the Operator authenticates + with the Onboardbase API + properties: + apiKeyRef: + description: |- + OnboardbaseAPIKey is the APIKey generated by an admin account. + It is used to recognize and authorize access to a project and environment within onboardbase + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + passcodeRef: + description: OnboardbasePasscode is the passcode attached + to the API Key + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - apiKeyRef + - passcodeRef + type: object + environment: + default: development + description: Environment is the name of an environmnent within + a project to pull the secrets from + type: string + project: + default: development + description: Project is an onboardbase project that the secrets + should be pulled from + type: string + required: + - apiHost + - auth + - environment + - project + type: object + onepassword: + description: OnePassword configures this store to sync secrets + using the 1Password Cloud provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against OnePassword Connect Server + properties: + secretRef: + description: OnePasswordAuthSecretRef holds secret references + for 1Password credentials. + properties: + connectTokenSecretRef: + description: The ConnectToken is used for authentication + to a 1Password Connect Server. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - connectTokenSecretRef + type: object + required: + - secretRef + type: object + connectHost: + description: ConnectHost defines the OnePassword Connect Server + to connect to + type: string + vaults: + additionalProperties: + type: integer + description: Vaults defines which OnePassword vaults to search + in which order + type: object + required: + - auth + - connectHost + - vaults + type: object + oracle: + description: Oracle configures this store to sync secrets using + Oracle Vault provider + properties: + auth: + description: |- + Auth configures how secret-manager authenticates with the Oracle Vault. + If empty, use the instance principal, otherwise the user credentials specified in Auth. + properties: + secretRef: + description: SecretRef to pass through sensitive information. + properties: + fingerprint: + description: Fingerprint is the fingerprint of the + API private key. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + privatekey: + description: PrivateKey is the user's API Signing + Key in PEM format, used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - fingerprint + - privatekey + type: object + tenancy: + description: Tenancy is the tenancy OCID where user is + located. + type: string + user: + description: User is an access OCID specific to the account. + type: string + required: + - secretRef + - tenancy + - user + type: object + compartment: + description: |- + Compartment is the vault compartment OCID. + Required for PushSecret + type: string + encryptionKey: + description: |- + EncryptionKey is the OCID of the encryption key within the vault. + Required for PushSecret + type: string + principalType: + description: |- + The type of principal to use for authentication. If left blank, the Auth struct will + determine the principal type. This optional field must be specified if using + workload identity. + enum: + - "" + - UserPrincipal + - InstancePrincipal + - Workload + type: string + region: + description: Region is the region where vault is located. + type: string + serviceAccountRef: + description: |- + ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + vault: + description: Vault is the vault's OCID of the specific vault + where secret is located. + type: string + required: + - region + - vault + type: object + passbolt: + properties: + auth: + description: Auth defines the information necessary to authenticate + against Passbolt Server + properties: + passwordSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + privateKeySecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - passwordSecretRef + - privateKeySecretRef + type: object + host: + description: Host defines the Passbolt Server to connect to + type: string + required: + - auth + - host + type: object + passworddepot: + description: Configures a store to sync secrets with a Password + Depot instance. + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Password Depot instance. + properties: + secretRef: + properties: + credentials: + description: Username / Password is used for authentication. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + required: + - secretRef + type: object + database: + description: Database to use as source + type: string + host: + description: URL configures the Password Depot instance URL. + type: string + required: + - auth + - database + - host + type: object + previder: + description: Previder configures this store to sync secrets using + the Previder provider + properties: + auth: + description: PreviderAuth contains a secretRef for credentials. + properties: + secretRef: + description: PreviderAuthSecretRef holds secret references + for Previder Vault credentials. + properties: + accessToken: + description: The AccessToken is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - accessToken + type: object + type: object + baseUri: + type: string + required: + - auth + type: object + pulumi: + description: Pulumi configures this store to sync secrets using + the Pulumi provider + properties: + accessToken: + description: AccessToken is the access tokens to sign in to + the Pulumi Cloud Console. + properties: + secretRef: + description: SecretRef is a reference to a secret containing + the Pulumi API token. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + apiUrl: + default: https://api.pulumi.com/api/esc + description: APIURL is the URL of the Pulumi API. + type: string + environment: + description: |- + Environment are YAML documents composed of static key-value pairs, programmatic expressions, + dynamically retrieved values from supported providers including all major clouds, + and other Pulumi ESC environments. + To create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information. + type: string + organization: + description: |- + Organization are a space to collaborate on shared projects and stacks. + To create a new organization, visit https://app.pulumi.com/ and click "New Organization". + type: string + project: + description: Project is the name of the Pulumi ESC project + the environment belongs to. + type: string + required: + - accessToken + - environment + - organization + - project + type: object + scaleway: + description: Scaleway + properties: + accessKey: + description: AccessKey is the non-secret part of the api key. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + apiUrl: + description: APIURL is the url of the api to use. Defaults + to https://api.scaleway.com + type: string + projectId: + description: 'ProjectID is the id of your project, which you + can find in the console: https://console.scaleway.com/project/settings' + type: string + region: + description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone' + type: string + secretKey: + description: SecretKey is the non-secret part of the api key. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + required: + - accessKey + - projectId + - region + - secretKey + type: object + secretserver: + description: |- + SecretServer configures this store to sync secrets using SecretServer provider + https://docs.delinea.com/online-help/secret-server/start.htm + properties: + password: + description: Password is the secret server account password. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + serverURL: + description: |- + ServerURL + URL to your secret server installation + type: string + username: + description: Username is the secret server account username. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + required: + - password + - serverURL + - username + type: object + senhasegura: + description: Senhasegura configures this store to sync secrets + using senhasegura provider + properties: + auth: + description: Auth defines parameters to authenticate in senhasegura + properties: + clientId: + type: string + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - clientId + - clientSecretSecretRef + type: object + ignoreSslCertificate: + default: false + description: IgnoreSslCertificate defines if SSL certificate + must be ignored + type: boolean + module: + description: Module defines which senhasegura module should + be used to get secrets + type: string + url: + description: URL of senhasegura + type: string + required: + - auth + - module + - url + type: object + upboundspaces: + description: UpboundProvider configures a store to sync secrets + with Upbound Spaces. + properties: + storeRef: + description: StoreRef holds ref to Upbound Spaces secret store + properties: + name: + description: Name of the secret store on Upbound Spaces + type: string + required: + - name + type: object + required: + - storeRef + type: object + vault: + description: Vault configures this store to sync secrets using + Hashi provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Vault server. + properties: + appRole: + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. + properties: + path: + default: approle + description: |- + Path where the App Role authentication backend is mounted + in Vault, e.g: "approle" + type: string + roleId: + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. + type: string + roleRef: + description: |- + Reference to a key in a Secret that contains the App Role ID used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role id. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretRef: + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - path + - secretRef + type: object + cert: + description: |- + Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate + Cert authentication method + properties: + clientCert: + description: |- + ClientCert is a certificate to authenticate using the Cert Vault + authentication method + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretRef: + description: |- + SecretRef to a key in a Secret resource containing client private key to + authenticate with Vault using the Cert authentication method + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + iam: + description: |- + Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials + AWS IAM authentication method + properties: + externalID: + description: AWS External ID set on assumed IAM roles + type: string + jwt: + description: Specify a service account with IRSA enabled + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + type: object + path: + description: 'Path where the AWS auth method is enabled + in Vault, e.g: "aws"' + type: string + region: + description: AWS region + type: string + role: + description: This is the AWS role to be assumed before + talking to vault + type: string + secretRef: + description: Specify credentials in a Secret object + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + sessionTokenSecretRef: + description: |- + The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey are temporary credentials + see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + vaultAwsIamServerID: + description: 'X-Vault-AWS-IAM-Server-ID is an additional + header used by Vault IAM auth method to mitigate + against different types of replay attacks. More + details here: https://developer.hashicorp.com/vault/docs/auth/aws' + type: string + vaultRole: + description: Vault Role. In vault, a role describes + an identity with a set of permissions, groups, or + policies you want to attach a user of the secrets + engine + type: string + required: + - vaultRole + type: object + jwt: + description: |- + Jwt authenticates with Vault by passing role and JWT token using the + JWT/OIDC authentication method + properties: + kubernetesServiceAccountToken: + description: |- + Optional ServiceAccountToken specifies the Kubernetes service account for which to request + a token for with the `TokenRequest` API. + properties: + audiences: + description: |- + Optional audiences field that will be used to request a temporary Kubernetes service + account token for the service account referenced by `serviceAccountRef`. + Defaults to a single audience `vault` it not specified. + Deprecated: use serviceAccountRef.Audiences instead + items: + type: string + type: array + expirationSeconds: + description: |- + Optional expiration time in seconds that will be used to request a temporary + Kubernetes service account token for the service account referenced by + `serviceAccountRef`. + Deprecated: this will be removed in the future. + Defaults to 10 minutes. + format: int64 + type: integer + serviceAccountRef: + description: Service account field containing + the name of a kubernetes ServiceAccount. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + path: + default: jwt + description: |- + Path where the JWT authentication backend is mounted + in Vault, e.g: "jwt" + type: string + role: + description: |- + Role is a JWT role to authenticate using the JWT/OIDC Vault + authentication method + type: string + secretRef: + description: |- + Optional SecretRef that refers to a key in a Secret resource containing JWT token to + authenticate with Vault using the JWT/OIDC authentication method. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - path + type: object + kubernetes: + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. + properties: + mountPath: + default: kubernetes + description: |- + Path where the Kubernetes authentication backend is mounted in Vault, e.g: + "kubernetes" + type: string + role: + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: |- + Optional secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. If a name is specified without a key, + `token` is the default. If one is not specified, the one bound to + the controller will be used. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + serviceAccountRef: + description: |- + Optional service account field containing the name of a kubernetes ServiceAccount. + If the service account is specified, the service account secret token JWT will be used + for authenticating with Vault. If the service account selector is not supplied, + the secretRef will be used instead. + properties: + audiences: + description: |- + Audience specifies the `aud` claim for the service account token + If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity + then this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + Namespace of the resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + required: + - mountPath + - role + type: object + ldap: + description: |- + Ldap authenticates with Vault by passing username/password pair using + the LDAP authentication method + properties: + path: + default: ldap + description: |- + Path where the LDAP authentication backend is mounted + in Vault, e.g: "ldap" + type: string + secretRef: + description: |- + SecretRef to a key in a Secret resource containing password for the LDAP + user used to authenticate with Vault using the LDAP authentication + method + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + username: + description: |- + Username is an LDAP username used to authenticate using the LDAP Vault + authentication method + type: string + required: + - path + - username + type: object + namespace: + description: |- + Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in. + Namespaces is a set of features within Vault Enterprise that allows + Vault environments to support Secure Multi-tenancy. e.g: "ns1". + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces + This will default to Vault.Namespace field if set, or empty otherwise + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by + presenting a token. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + userPass: + description: UserPass authenticates with Vault by passing + username/password pair + properties: + path: + default: userpass + description: |- + Path where the UserPassword authentication backend is mounted + in Vault, e.g: "userpass" + type: string + secretRef: + description: |- + SecretRef to a key in a Secret resource containing password for the + user used to authenticate with Vault using the UserPass authentication + method + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + username: + description: |- + Username is a username used to authenticate using the UserPass Vault + authentication method + type: string + required: + - path + - username + type: object + type: object + caBundle: + description: |- + PEM encoded CA bundle used to validate Vault server certificate. Only used + if the Server URL is using HTTPS protocol. This parameter is ignored for + plain HTTP protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Vault server certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider + type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + forwardInconsistent: + description: |- + ForwardInconsistent tells Vault to forward read-after-write requests to the Vault + leader instead of simply retrying within a loop. This can increase performance if + the option is enabled serverside. + https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header + type: boolean + headers: + additionalProperties: + type: string + description: Headers to be added in Vault request + type: object + namespace: + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows + Vault environments to support Secure Multi-tenancy. e.g: "ns1". + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces + type: string + path: + description: |- + Path is the mount path of the Vault KV backend endpoint, e.g: + "secret". The v2 KV secret engine version specific "/data" path suffix + for fetching secrets from Vault is optional and will be appended + if not present in specified path. + type: string + readYourWrites: + description: |- + ReadYourWrites ensures isolated read-after-write semantics by + providing discovered cluster replication states in each request. + More information about eventual consistency in Vault can be found here + https://www.vaultproject.io/docs/enterprise/consistency + type: boolean + server: + description: 'Server is the connection address for the Vault + server, e.g: "https://vault.example.com:8200".' + type: string + tls: + description: |- + The configuration used for client side related TLS communication, when the Vault server + requires mutual authentication. Only used if the Server URL is using HTTPS protocol. + This parameter is ignored for plain HTTP protocol connection. + It's worth noting this configuration is different from the "TLS certificates auth method", + which is available under the `auth.cert` section. + properties: + certSecretRef: + description: |- + CertSecretRef is a certificate added to the transport layer + when communicating with the Vault server. + If no key for the Secret is specified, external-secret will default to 'tls.crt'. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + keySecretRef: + description: |- + KeySecretRef to a key in a Secret resource containing client private key + added to the transport layer when communicating with the Vault server. + If no key for the Secret is specified, external-secret will default to 'tls.key'. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + version: + default: v2 + description: |- + Version is the Vault KV secret engine version. This can be either "v1" or + "v2". Version defaults to "v2". + enum: + - v1 + - v2 + type: string + required: + - server + type: object + webhook: + description: Webhook configures this store to sync secrets using + a generic templated webhook + properties: + auth: + description: Auth specifies a authorization protocol. Only + one protocol may be set. + maxProperties: 1 + minProperties: 1 + properties: + ntlm: + description: NTLMProtocol configures the store to use + NTLM for auth + properties: + passwordSecret: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + usernameSecret: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - passwordSecret + - usernameSecret + type: object + type: object + body: + description: Body + type: string + caBundle: + description: |- + PEM encoded CA bundle used to validate webhook server certificate. Only used + if the Server URL is using HTTPS protocol. This parameter is ignored for + plain HTTP protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + webhook server certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the object located at the provider + type. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: The namespace the Provider type is in. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + headers: + additionalProperties: + type: string + description: Headers + type: object + method: + description: Webhook Method + type: string + result: + description: Result formatting + properties: + jsonPath: + description: Json path of return value + type: string + type: object + secrets: + description: |- + Secrets to fill in templates + These secrets will be passed to the templating function as key value pairs under the given name + items: + properties: + name: + description: Name of this secret in templates + type: string + secretRef: + description: Secret ref to fill in credentials + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - name + - secretRef + type: object + type: array + timeout: + description: Timeout + type: string + url: + description: Webhook url to call + type: string + required: + - result + - url + type: object + yandexcertificatemanager: + description: YandexCertificateManager configures this store to + sync secrets using Yandex Certificate Manager provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Certificate Manager + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + required: + - auth + type: object + yandexlockbox: + description: YandexLockbox configures this store to sync secrets + using Yandex Lockbox provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Lockbox + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + A key in the referenced Secret. + Some instances of this field may be defaulted, in others it may be required. + maxLength: 253 + minLength: 1 + pattern: ^[-._a-zA-Z0-9]+$ + type: string + name: + description: The name of the Secret resource being + referred to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + namespace: + description: |- + The namespace of the Secret resource being referred to. + Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + required: + - auth + type: object + type: object + refreshInterval: + description: Used to configure store refresh interval in seconds. + type: integer + retrySettings: + description: Used to configure http retries if failed. + properties: + maxRetries: + format: int32 + type: integer + retryInterval: + type: string + type: object + secretStoreMetadata: + description: The metadata of the secret store to be created. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that are set on projected resource. + type: object + labels: + additionalProperties: + type: string + description: Labels that are set on projected resource. + type: object + type: object + secretStoreName: + description: |- + SecretStoreName is the name to use when creating secret stores within a control plane. + optional, if not set, SharedSecretStore name will be used. + When set, it is immutable. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value is immutable + rule: self == oldSelf + required: + - controlPlaneSelector + - namespaceSelector + - provider + type: object + x-kubernetes-validations: + - message: secretStoreName is immutable + rule: has(self.secretStoreName) == has(oldSelf.secretStoreName) + status: + description: SharedSecretStoreStatus defines the observed state of the + SecretStore. + properties: + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failed: + description: List of provisioning failures. + items: + description: SecretStoreProvisioningFailure defines secret store + provisioning failure. + properties: + conditions: + description: List of occurred conditions. + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + controlPlane: + description: ControlPlane name where the failure occurred. + type: string + required: + - controlPlane + type: object + type: array + x-kubernetes-list-map-keys: + - controlPlane + x-kubernetes-list-type: map + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + provisioned: + description: List of successfully provisioned targets. + items: + description: SecretStoreProvisioningSuccess defines secret store + provision success. + properties: + controlPlane: + description: ControlPlane name where the secret store got projected + type: string + required: + - controlPlane + type: object + type: array + x-kubernetes-list-map-keys: + - controlPlane + x-kubernetes-list-type: map + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/static/crds/space/v1.16/spaces.upbound.io_simulations.yaml b/static/crds/space/v1.16/spaces.upbound.io_simulations.yaml new file mode 100644 index 00000000..3c912578 --- /dev/null +++ b/static/crds/space/v1.16/spaces.upbound.io_simulations.yaml @@ -0,0 +1,243 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + name: simulations.spaces.upbound.io +spec: + group: spaces.upbound.io + names: + categories: + - spaces + kind: Simulation + listKind: SimulationList + plural: simulations + singular: simulation + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.controlPlaneName + name: SOURCE + type: string + - jsonPath: .status.simulatedControlPlaneName + name: SIMULATED + type: string + - jsonPath: .status.conditions[?(@.type=='AcceptingChanges')].status + name: ACCEPTING-CHANGES + type: string + - jsonPath: .status.conditions[?(@.type=='AcceptingChanges')].reason + name: STATE + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + A Simulation creates a simulation of a source ControlPlane. You can apply a + change set to the simulated control plane. When the Simulation is complete it + will detect the changes and report the difference compared to the source + control plane. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SimulationSpec specifies how to run the simulation. + properties: + completionCriteria: + description: |- + CompletionCriteria specify how Spaces should determine when the + simulation is complete. If any of the criteria are met, Spaces will set + the Simulation's desired state to complete. Omit the criteria if you want + to manually mark the Simulation complete. + items: + description: A CompletionCriterion specifies when a simulation is + complete. + properties: + duration: + description: Duration after which the simulation is complete. + type: string + type: + description: Type of criterion. + enum: + - Duration + type: string + required: + - duration + - type + type: object + type: array + controlPlaneName: + description: |- + ControlPlaneName is the name of the ControlPlane to simulate a change to. + This control plane is known as the Simulation's 'source' control plane. + minLength: 1 + type: string + x-kubernetes-validations: + - message: The source controlplane can't be changed + rule: self == oldSelf + desiredState: + default: AcceptingChanges + description: DesiredState of the simulation. + enum: + - AcceptingChanges + - Complete + - Terminated + type: string + x-kubernetes-validations: + - message: A complete Simulation can only be terminated + rule: oldSelf != 'Complete' || self == 'Complete' || self == 'Terminated' + - message: A Simulation can't be un-terminated + rule: oldSelf != 'Terminated' || self == oldSelf + required: + - controlPlaneName + - desiredState + type: object + status: + description: SimulationStatus represents the observed state of a Simulation. + properties: + changes: + description: |- + Changes detected by the simulation. Only changes that happen while the + simulation is in the AcceptingChanges state are included. + items: + description: |- + A SimulationChange represents an object that changed while the simulation was + in the AcceptingChanges state. + properties: + change: + description: Change type. + enum: + - Unknown + - Create + - Update + - Delete + type: string + objectRef: + description: ObjectReference to the changed object. + properties: + apiVersion: + description: APIVersion of the changed resource. + type: string + kind: + description: Kind of the changed resource. + type: string + name: + description: Name of the changed resource. + type: string + namespace: + description: Namespace of the changed resource. + type: string + required: + - apiVersion + - kind + - name + type: object + required: + - change + - objectRef + type: object + type: array + conditions: + description: Conditions of the resource. + items: + description: A Condition that may apply to a resource. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time this condition transitioned from one + status to another. + format: date-time + type: string + message: + description: |- + A Message containing details about this condition's last transition from + one status to another, if any. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + type: integer + reason: + description: A Reason for this condition's last transition from + one status to another. + type: string + status: + description: Status of this condition; is it currently True, + False, or Unknown? + type: string + type: + description: |- + Type of this condition. At most one of each condition type may apply to + a resource at any point in time. + type: string + required: + - lastTransitionTime + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controlPlaneData: + description: |- + ControlPlaneData exported from the source control plane and imported to + the simulated control plane. + properties: + exportTimestamp: + description: |- + ExportTimestamp is the time at which the source control plane's resources + were exported. Resources are exported to temporary storage before they're + imported to the simulated control plane. + format: date-time + type: string + importTimestamp: + description: |- + ImportTiemstamp is the time at which the source control plane's resources + were imported to the simulated control plane. + format: date-time + type: string + type: object + observedGeneration: + description: |- + ObservedGeneration is the latest metadata.generation + which resulted in either a ready state, or stalled due to error + it can not recover from without human intervention. + format: int64 + type: integer + simulatedControlPlaneName: + description: |- + SimulatedControlPlaneName is the name of the control plane used to run + the simulation. + minLength: 1 + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/utils/vale/styles/Upbound/spelling-exceptions.txt b/utils/vale/styles/Upbound/spelling-exceptions.txt index 1b77a532..88b41191 100644 --- a/utils/vale/styles/Upbound/spelling-exceptions.txt +++ b/utils/vale/styles/Upbound/spelling-exceptions.txt @@ -37,6 +37,7 @@ configmaps CRDs Crossplane Crossplane's +ctx Datadog declaratively downscaling @@ -159,6 +160,7 @@ ctx controlplane dev etcd +GCP keyless preconfigured Preconfigured @@ -186,6 +188,8 @@ autoscale configurationrevisions crossplane dependsOn +nginx +passthrough preload Prepopulate rollouts @@ -194,5 +198,8 @@ xrd aws onboarding XRCs - +Traefik +Traefik's +HTTPRoute +TLSRoute