Gitiles
Code Review Sign In
code.v1.dodo.cloud / helm-charts / ea328da19aadb6b9eeab7254e530f7ca005f69f1 / . / charts / cert-manager-1.12.17 / templates / crds.yaml
blob: 961ccdbbc1494dab06fb5d3d75491f8643346f07 [file] [log] [blame]
Giorgi Lekveishviliea328da2026-07-29 12:15:15 +0400[diff] [blame^]1{{- if .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: certificaterequests.cert-manager.io
6 labels:
7 app: '{{ template "cert-manager.name" . }}'
8 app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
9 app.kubernetes.io/instance: '{{ .Release.Name }}'
10 # Generated labels {{- include "labels" . | nindent 4 }}
11spec:
12 group: cert-manager.io
13 names:
14 kind: CertificateRequest
15 listKind: CertificateRequestList
16 plural: certificaterequests
17 shortNames:
18 - cr
19 - crs
20 singular: certificaterequest
21 categories:
22 - cert-manager
23 scope: Namespaced
24 versions:
25 - name: v1
26 subresources:
27 status: {}
28 additionalPrinterColumns:
29 - jsonPath: .status.conditions[?(@.type=="Approved")].status
30 name: Approved
31 type: string
32 - jsonPath: .status.conditions[?(@.type=="Denied")].status
33 name: Denied
34 type: string
35 - jsonPath: .status.conditions[?(@.type=="Ready")].status
36 name: Ready
37 type: string
38 - jsonPath: .spec.issuerRef.name
39 name: Issuer
40 type: string
41 - jsonPath: .spec.username
42 name: Requestor
43 type: string
44 - jsonPath: .status.conditions[?(@.type=="Ready")].message
45 name: Status
46 priority: 1
47 type: string
48 - jsonPath: .metadata.creationTimestamp
49 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
50 name: Age
51 type: date
52 schema:
53 openAPIV3Schema:
54 description: |-
55 A CertificateRequest is used to request a signed certificate from one of the
56 configured issuers.
57
58 All fields within the CertificateRequest's `spec` are immutable after creation.
59 A CertificateRequest will either succeed or fail, as denoted by its `status.state`
60 field.
61
62 A CertificateRequest is a one-shot resource, meaning it represents a single
63 point in time request for a certificate and cannot be re-used.
64 type: object
65 required:
66 - spec
67 properties:
68 apiVersion:
69 description: |-
70 APIVersion defines the versioned schema of this representation of an object.
71 Servers should convert recognized schemas to the latest internal value, and
72 may reject unrecognized values.
73 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
74 type: string
75 kind:
76 description: |-
77 Kind is a string value representing the REST resource this object represents.
78 Servers may infer this from the endpoint the client submits requests to.
79 Cannot be updated.
80 In CamelCase.
81 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
82 type: string
83 metadata:
84 type: object
85 spec:
86 description: Desired state of the CertificateRequest resource.
87 type: object
88 required:
89 - issuerRef
90 - request
91 properties:
92 duration:
93 description: |-
94 The requested 'duration' (i.e. lifetime) of the Certificate.
95 This option may be ignored/overridden by some issuer types.
96 type: string
97 extra:
98 description: |-
99 Extra contains extra attributes of the user that created the CertificateRequest.
100 Populated by the cert-manager webhook on creation and immutable.
101 type: object
102 additionalProperties:
103 type: array
104 items:
105 type: string
106 groups:
107 description: |-
108 Groups contains group membership of the user that created the CertificateRequest.
109 Populated by the cert-manager webhook on creation and immutable.
110 type: array
111 items:
112 type: string
113 x-kubernetes-list-type: atomic
114 isCA:
115 description: |-
116 IsCA will request to mark the certificate as valid for certificate signing
117 when submitting to the issuer.
118 This will automatically add the `cert sign` usage to the list of `usages`.
119 type: boolean
120 issuerRef:
121 description: |-
122 IssuerRef is a reference to the issuer for this CertificateRequest. If
123 the `kind` field is not set, or set to `Issuer`, an Issuer resource with
124 the given name in the same namespace as the CertificateRequest will be
125 used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with
126 the provided name will be used. The `name` field in this stanza is
127 required at all times. The group field refers to the API group of the
128 issuer which defaults to `cert-manager.io` if empty.
129 type: object
130 required:
131 - name
132 properties:
133 group:
134 description: Group of the resource being referred to.
135 type: string
136 kind:
137 description: Kind of the resource being referred to.
138 type: string
139 name:
140 description: Name of the resource being referred to.
141 type: string
142 request:
143 description: |-
144 The PEM-encoded x509 certificate signing request to be submitted to the
145 CA for signing.
146 type: string
147 format: byte
148 uid:
149 description: |-
150 UID contains the uid of the user that created the CertificateRequest.
151 Populated by the cert-manager webhook on creation and immutable.
152 type: string
153 usages:
154 description: |-
155 Usages is the set of x509 usages that are requested for the certificate.
156 If usages are set they SHOULD be encoded inside the CSR spec
157 Defaults to `digital signature` and `key encipherment` if not specified.
158 type: array
159 items:
160 description: |-
161 KeyUsage specifies valid usage contexts for keys.
162 See:
163 https://tools.ietf.org/html/rfc5280#section-4.2.1.3
164 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
165
166 Valid KeyUsage values are as follows:
167 "signing",
168 "digital signature",
169 "content commitment",
170 "key encipherment",
171 "key agreement",
172 "data encipherment",
173 "cert sign",
174 "crl sign",
175 "encipher only",
176 "decipher only",
177 "any",
178 "server auth",
179 "client auth",
180 "code signing",
181 "email protection",
182 "s/mime",
183 "ipsec end system",
184 "ipsec tunnel",
185 "ipsec user",
186 "timestamping",
187 "ocsp signing",
188 "microsoft sgc",
189 "netscape sgc"
190 type: string
191 enum:
192 - signing
193 - digital signature
194 - content commitment
195 - key encipherment
196 - key agreement
197 - data encipherment
198 - cert sign
199 - crl sign
200 - encipher only
201 - decipher only
202 - any
203 - server auth
204 - client auth
205 - code signing
206 - email protection
207 - s/mime
208 - ipsec end system
209 - ipsec tunnel
210 - ipsec user
211 - timestamping
212 - ocsp signing
213 - microsoft sgc
214 - netscape sgc
215 username:
216 description: |-
217 Username contains the name of the user that created the CertificateRequest.
218 Populated by the cert-manager webhook on creation and immutable.
219 type: string
220 status:
221 description: Status of the CertificateRequest. This is set and managed automatically.
222 type: object
223 properties:
224 ca:
225 description: |-
226 The PEM encoded x509 certificate of the signer, also known as the CA
227 (Certificate Authority).
228 This is set on a best-effort basis by different issuers.
229 If not set, the CA is assumed to be unknown/not available.
230 type: string
231 format: byte
232 certificate:
233 description: |-
234 The PEM encoded x509 certificate resulting from the certificate
235 signing request.
236 If not set, the CertificateRequest has either not been completed or has
237 failed. More information on failure can be found by checking the
238 `conditions` field.
239 type: string
240 format: byte
241 conditions:
242 description: |-
243 List of status conditions to indicate the status of a CertificateRequest.
244 Known condition types are `Ready` and `InvalidRequest`.
245 type: array
246 items:
247 description: CertificateRequestCondition contains condition information for a CertificateRequest.
248 type: object
249 required:
250 - status
251 - type
252 properties:
253 lastTransitionTime:
254 description: |-
255 LastTransitionTime is the timestamp corresponding to the last status
256 change of this condition.
257 type: string
258 format: date-time
259 message:
260 description: |-
261 Message is a human readable description of the details of the last
262 transition, complementing reason.
263 type: string
264 reason:
265 description: |-
266 Reason is a brief machine readable explanation for the condition's last
267 transition.
268 type: string
269 status:
270 description: Status of the condition, one of (`True`, `False`, `Unknown`).
271 type: string
272 enum:
273 - "True"
274 - "False"
275 - Unknown
276 type:
277 description: |-
278 Type of the condition, known values are (`Ready`, `InvalidRequest`,
279 `Approved`, `Denied`).
280 type: string
281 x-kubernetes-list-map-keys:
282 - type
283 x-kubernetes-list-type: map
284 failureTime:
285 description: |-
286 FailureTime stores the time that this CertificateRequest failed. This is
287 used to influence garbage collection and back-off.
288 type: string
289 format: date-time
290 served: true
291 storage: true
292---
293apiVersion: apiextensions.k8s.io/v1
294kind: CustomResourceDefinition
295metadata:
296 name: certificates.cert-manager.io
297 labels:
298 app: '{{ template "cert-manager.name" . }}'
299 app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
300 app.kubernetes.io/instance: '{{ .Release.Name }}'
301 # Generated labels {{- include "labels" . | nindent 4 }}
302spec:
303 group: cert-manager.io
304 names:
305 kind: Certificate
306 listKind: CertificateList
307 plural: certificates
308 shortNames:
309 - cert
310 - certs
311 singular: certificate
312 categories:
313 - cert-manager
314 scope: Namespaced
315 versions:
316 - name: v1
317 subresources:
318 status: {}
319 additionalPrinterColumns:
320 - jsonPath: .status.conditions[?(@.type=="Ready")].status
321 name: Ready
322 type: string
323 - jsonPath: .spec.secretName
324 name: Secret
325 type: string
326 - jsonPath: .spec.issuerRef.name
327 name: Issuer
328 priority: 1
329 type: string
330 - jsonPath: .status.conditions[?(@.type=="Ready")].message
331 name: Status
332 priority: 1
333 type: string
334 - jsonPath: .metadata.creationTimestamp
335 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
336 name: Age
337 type: date
338 schema:
339 openAPIV3Schema:
340 description: |-
341 A Certificate resource should be created to ensure an up to date and signed
342 x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
343
344 The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
345 type: object
346 required:
347 - spec
348 properties:
349 apiVersion:
350 description: |-
351 APIVersion defines the versioned schema of this representation of an object.
352 Servers should convert recognized schemas to the latest internal value, and
353 may reject unrecognized values.
354 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
355 type: string
356 kind:
357 description: |-
358 Kind is a string value representing the REST resource this object represents.
359 Servers may infer this from the endpoint the client submits requests to.
360 Cannot be updated.
361 In CamelCase.
362 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
363 type: string
364 metadata:
365 type: object
366 spec:
367 description: Desired state of the Certificate resource.
368 type: object
369 required:
370 - issuerRef
371 - secretName
372 properties:
373 additionalOutputFormats:
374 description: |-
375 AdditionalOutputFormats defines extra output formats of the private key
376 and signed certificate chain to be written to this Certificate's target
377 Secret. This is an Alpha Feature and is only enabled with the
378 `--feature-gates=AdditionalCertificateOutputFormats=true` option on both
379 the controller and webhook components.
380 type: array
381 items:
382 description: |-
383 CertificateAdditionalOutputFormat defines an additional output format of a
384 Certificate resource. These contain supplementary data formats of the signed
385 certificate chain and paired private key.
386 type: object
387 required:
388 - type
389 properties:
390 type:
391 description: |-
392 Type is the name of the format type that should be written to the
393 Certificate's target Secret.
394 type: string
395 enum:
396 - DER
397 - CombinedPEM
398 commonName:
399 description: |-
400 CommonName is a common name to be used on the Certificate.
401 The CommonName should have a length of 64 characters or fewer to avoid
402 generating invalid CSRs.
403 This value is ignored by TLS clients when any subject alt name is set.
404 This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4
405 type: string
406 dnsNames:
407 description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate.
408 type: array
409 items:
410 type: string
411 duration:
412 description: |-
413 The requested 'duration' (i.e. lifetime) of the Certificate. This option
414 may be ignored/overridden by some issuer types. If unset this defaults to
415 90 days. Certificate will be renewed either 2/3 through its duration or
416 `renewBefore` period before its expiry, whichever is later. Minimum
417 accepted duration is 1 hour. Value must be in units accepted by Go
418 time.ParseDuration https://golang.org/pkg/time/#ParseDuration
419 type: string
420 emailAddresses:
421 description: EmailAddresses is a list of email subjectAltNames to be set on the Certificate.
422 type: array
423 items:
424 type: string
425 encodeUsagesInRequest:
426 description: |-
427 EncodeUsagesInRequest controls whether key usages should be present
428 in the CertificateRequest
429 type: boolean
430 ipAddresses:
431 description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate.
432 type: array
433 items:
434 type: string
435 isCA:
436 description: |-
437 IsCA will mark this Certificate as valid for certificate signing.
438 This will automatically add the `cert sign` usage to the list of `usages`.
439 type: boolean
440 issuerRef:
441 description: |-
442 IssuerRef is a reference to the issuer for this certificate.
443 If the `kind` field is not set, or set to `Issuer`, an Issuer resource
444 with the given name in the same namespace as the Certificate will be used.
445 If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the
446 provided name will be used.
447 The `name` field in this stanza is required at all times.
448 type: object
449 required:
450 - name
451 properties:
452 group:
453 description: Group of the resource being referred to.
454 type: string
455 kind:
456 description: Kind of the resource being referred to.
457 type: string
458 name:
459 description: Name of the resource being referred to.
460 type: string
461 keystores:
462 description: |-
463 Keystores configures additional keystore output formats stored in the
464 `secretName` Secret resource.
465 type: object
466 properties:
467 jks:
468 description: |-
469 JKS configures options for storing a JKS keystore in the
470 `spec.secretName` Secret resource.
471 type: object
472 required:
473 - create
474 - passwordSecretRef
475 properties:
476 create:
477 description: |-
478 Create enables JKS keystore creation for the Certificate.
479 If true, a file named `keystore.jks` will be created in the target
480 Secret resource, encrypted using the password stored in
481 `passwordSecretRef`.
482 The keystore file will be updated immediately.
483 If the issuer provided a CA certificate, a file named `truststore.jks`
484 will also be created in the target Secret resource, encrypted using the
485 password stored in `passwordSecretRef`
486 containing the issuing Certificate Authority
487 type: boolean
488 passwordSecretRef:
489 description: |-
490 PasswordSecretRef is a reference to a key in a Secret resource
491 containing the password used to encrypt the JKS keystore.
492 type: object
493 required:
494 - name
495 properties:
496 key:
497 description: |-
498 The key of the entry in the Secret resource's `data` field to be used.
499 Some instances of this field may be defaulted, in others it may be
500 required.
501 type: string
502 name:
503 description: |-
504 Name of the resource being referred to.
505 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
506 type: string
507 pkcs12:
508 description: |-
509 PKCS12 configures options for storing a PKCS12 keystore in the
510 `spec.secretName` Secret resource.
511 type: object
512 required:
513 - create
514 - passwordSecretRef
515 properties:
516 create:
517 description: |-
518 Create enables PKCS12 keystore creation for the Certificate.
519 If true, a file named `keystore.p12` will be created in the target
520 Secret resource, encrypted using the password stored in
521 `passwordSecretRef`.
522 The keystore file will be updated immediately.
523 If the issuer provided a CA certificate, a file named `truststore.p12` will
524 also be created in the target Secret resource, encrypted using the
525 password stored in `passwordSecretRef` containing the issuing Certificate
526 Authority
527 type: boolean
528 passwordSecretRef:
529 description: |-
530 PasswordSecretRef is a reference to a key in a Secret resource
531 containing the password used to encrypt the PKCS12 keystore.
532 type: object
533 required:
534 - name
535 properties:
536 key:
537 description: |-
538 The key of the entry in the Secret resource's `data` field to be used.
539 Some instances of this field may be defaulted, in others it may be
540 required.
541 type: string
542 name:
543 description: |-
544 Name of the resource being referred to.
545 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
546 type: string
547 literalSubject:
548 description: |-
549 LiteralSubject is an LDAP formatted string that represents the [X.509 Subject field](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6).
550 Use this *instead* of the Subject field if you need to ensure the correct ordering of the RDN sequence, such as when issuing certs for LDAP authentication. See https://github.com/cert-manager/cert-manager/issues/3203, https://github.com/cert-manager/cert-manager/issues/4424.
551 This field is alpha level and is only supported by cert-manager installations where LiteralCertificateSubject feature gate is enabled on both cert-manager controller and webhook.
552 type: string
553 privateKey:
554 description: Options to control private keys used for the Certificate.
555 type: object
556 properties:
557 algorithm:
558 description: |-
559 Algorithm is the private key algorithm of the corresponding private key
560 for this certificate. If provided, allowed values are either `RSA`,`Ed25519` or `ECDSA`
561 If `algorithm` is specified and `size` is not provided,
562 key size of 256 will be used for `ECDSA` key algorithm and
563 key size of 2048 will be used for `RSA` key algorithm.
564 key size is ignored when using the `Ed25519` key algorithm.
565 type: string
566 enum:
567 - RSA
568 - ECDSA
569 - Ed25519
570 encoding:
571 description: |-
572 The private key cryptography standards (PKCS) encoding for this
573 certificate's private key to be encoded in.
574 If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
575 and PKCS#8, respectively.
576 Defaults to `PKCS1` if not specified.
577 type: string
578 enum:
579 - PKCS1
580 - PKCS8
581 rotationPolicy:
582 description: |-
583 RotationPolicy controls how private keys should be regenerated when a
584 re-issuance is being processed.
585 If set to Never, a private key will only be generated if one does not
586 already exist in the target `spec.secretName`. If one does exists but it
587 does not have the correct algorithm or size, a warning will be raised
588 to await user intervention.
589 If set to Always, a private key matching the specified requirements
590 will be generated whenever a re-issuance occurs.
591 Default is 'Never' for backward compatibility.
592 type: string
593 enum:
594 - Never
595 - Always
596 size:
597 description: |-
598 Size is the key bit size of the corresponding private key for this certificate.
599 If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
600 and will default to `2048` if not specified.
601 If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
602 and will default to `256` if not specified.
603 If `algorithm` is set to `Ed25519`, Size is ignored.
604 No other values are allowed.
605 type: integer
606 renewBefore:
607 description: |-
608 How long before the currently issued certificate's expiry
609 cert-manager should renew the certificate. The default is 2/3 of the
610 issued certificate's duration. Minimum accepted value is 5 minutes.
611 Value must be in units accepted by Go time.ParseDuration
612 https://golang.org/pkg/time/#ParseDuration
613 type: string
614 revisionHistoryLimit:
615 description: |-
616 revisionHistoryLimit is the maximum number of CertificateRequest revisions
617 that are maintained in the Certificate's history. Each revision represents
618 a single `CertificateRequest` created by this Certificate, either when it
619 was created, renewed, or Spec was changed. Revisions will be removed by
620 oldest first if the number of revisions exceeds this number. If set,
621 revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`),
622 revisions will not be garbage collected. Default value is `nil`.
623 type: integer
624 format: int32
625 secretName:
626 description: |-
627 SecretName is the name of the secret resource that will be automatically
628 created and managed by this Certificate resource.
629 It will be populated with a private key and certificate, signed by the
630 denoted issuer.
631 type: string
632 secretTemplate:
633 description: |-
634 SecretTemplate defines annotations and labels to be copied to the
635 Certificate's Secret. Labels and annotations on the Secret will be changed
636 as they appear on the SecretTemplate when added or removed. SecretTemplate
637 annotations are added in conjunction with, and cannot overwrite, the base
638 set of annotations cert-manager sets on the Certificate's Secret.
639 type: object
640 properties:
641 annotations:
642 description: Annotations is a key value map to be copied to the target Kubernetes Secret.
643 type: object
644 additionalProperties:
645 type: string
646 labels:
647 description: Labels is a key value map to be copied to the target Kubernetes Secret.
648 type: object
649 additionalProperties:
650 type: string
651 subject:
652 description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
653 type: object
654 properties:
655 countries:
656 description: Countries to be used on the Certificate.
657 type: array
658 items:
659 type: string
660 localities:
661 description: Cities to be used on the Certificate.
662 type: array
663 items:
664 type: string
665 organizationalUnits:
666 description: Organizational Units to be used on the Certificate.
667 type: array
668 items:
669 type: string
670 organizations:
671 description: Organizations to be used on the Certificate.
672 type: array
673 items:
674 type: string
675 postalCodes:
676 description: Postal codes to be used on the Certificate.
677 type: array
678 items:
679 type: string
680 provinces:
681 description: State/Provinces to be used on the Certificate.
682 type: array
683 items:
684 type: string
685 serialNumber:
686 description: Serial number to be used on the Certificate.
687 type: string
688 streetAddresses:
689 description: Street addresses to be used on the Certificate.
690 type: array
691 items:
692 type: string
693 uris:
694 description: URIs is a list of URI subjectAltNames to be set on the Certificate.
695 type: array
696 items:
697 type: string
698 usages:
699 description: |-
700 Usages is the set of x509 usages that are requested for the certificate.
701 Defaults to `digital signature` and `key encipherment` if not specified.
702 type: array
703 items:
704 description: |-
705 KeyUsage specifies valid usage contexts for keys.
706 See:
707 https://tools.ietf.org/html/rfc5280#section-4.2.1.3
708 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
709
710 Valid KeyUsage values are as follows:
711 "signing",
712 "digital signature",
713 "content commitment",
714 "key encipherment",
715 "key agreement",
716 "data encipherment",
717 "cert sign",
718 "crl sign",
719 "encipher only",
720 "decipher only",
721 "any",
722 "server auth",
723 "client auth",
724 "code signing",
725 "email protection",
726 "s/mime",
727 "ipsec end system",
728 "ipsec tunnel",
729 "ipsec user",
730 "timestamping",
731 "ocsp signing",
732 "microsoft sgc",
733 "netscape sgc"
734 type: string
735 enum:
736 - signing
737 - digital signature
738 - content commitment
739 - key encipherment
740 - key agreement
741 - data encipherment
742 - cert sign
743 - crl sign
744 - encipher only
745 - decipher only
746 - any
747 - server auth
748 - client auth
749 - code signing
750 - email protection
751 - s/mime
752 - ipsec end system
753 - ipsec tunnel
754 - ipsec user
755 - timestamping
756 - ocsp signing
757 - microsoft sgc
758 - netscape sgc
759 status:
760 description: Status of the Certificate. This is set and managed automatically.
761 type: object
762 properties:
763 conditions:
764 description: |-
765 List of status conditions to indicate the status of certificates.
766 Known condition types are `Ready` and `Issuing`.
767 type: array
768 items:
769 description: CertificateCondition contains condition information for an Certificate.
770 type: object
771 required:
772 - status
773 - type
774 properties:
775 lastTransitionTime:
776 description: |-
777 LastTransitionTime is the timestamp corresponding to the last status
778 change of this condition.
779 type: string
780 format: date-time
781 message:
782 description: |-
783 Message is a human readable description of the details of the last
784 transition, complementing reason.
785 type: string
786 observedGeneration:
787 description: |-
788 If set, this represents the .metadata.generation that the condition was
789 set based upon.
790 For instance, if .metadata.generation is currently 12, but the
791 .status.condition[x].observedGeneration is 9, the condition is out of date
792 with respect to the current state of the Certificate.
793 type: integer
794 format: int64
795 reason:
796 description: |-
797 Reason is a brief machine readable explanation for the condition's last
798 transition.
799 type: string
800 status:
801 description: Status of the condition, one of (`True`, `False`, `Unknown`).
802 type: string
803 enum:
804 - "True"
805 - "False"
806 - Unknown
807 type:
808 description: Type of the condition, known values are (`Ready`, `Issuing`).
809 type: string
810 x-kubernetes-list-map-keys:
811 - type
812 x-kubernetes-list-type: map
813 failedIssuanceAttempts:
814 description: |-
815 The number of continuous failed issuance attempts up till now. This
816 field gets removed (if set) on a successful issuance and gets set to
817 1 if unset and an issuance has failed. If an issuance has failed, the
818 delay till the next issuance will be calculated using formula
819 time.Hour * 2 ^ (failedIssuanceAttempts - 1).
820 type: integer
821 lastFailureTime:
822 description: |-
823 LastFailureTime is set only if the lastest issuance for this
824 Certificate failed and contains the time of the failure. If an
825 issuance has failed, the delay till the next issuance will be
826 calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
827 1). If the latest issuance has succeeded this field will be unset.
828 type: string
829 format: date-time
830 nextPrivateKeySecretName:
831 description: |-
832 The name of the Secret resource containing the private key to be used
833 for the next certificate iteration.
834 The keymanager controller will automatically set this field if the
835 `Issuing` condition is set to `True`.
836 It will automatically unset this field when the Issuing condition is
837 not set or False.
838 type: string
839 notAfter:
840 description: |-
841 The expiration time of the certificate stored in the secret named
842 by this resource in `spec.secretName`.
843 type: string
844 format: date-time
845 notBefore:
846 description: |-
847 The time after which the certificate stored in the secret named
848 by this resource in spec.secretName is valid.
849 type: string
850 format: date-time
851 renewalTime:
852 description: |-
853 RenewalTime is the time at which the certificate will be next
854 renewed.
855 If not set, no upcoming renewal is scheduled.
856 type: string
857 format: date-time
858 revision:
859 description: |-
860 The current 'revision' of the certificate as issued.
861
862 When a CertificateRequest resource is created, it will have the
863 `cert-manager.io/certificate-revision` set to one greater than the
864 current value of this field.
865
866 Upon issuance, this field will be set to the value of the annotation
867 on the CertificateRequest resource used to issue the certificate.
868
869 Persisting the value on the CertificateRequest resource allows the
870 certificates controller to know whether a request is part of an old
871 issuance or if it is part of the ongoing revision's issuance by
872 checking if the revision value in the annotation is greater than this
873 field.
874 type: integer
875 served: true
876 storage: true
877---
878apiVersion: apiextensions.k8s.io/v1
879kind: CustomResourceDefinition
880metadata:
881 name: challenges.acme.cert-manager.io
882 labels:
883 app: '{{ template "cert-manager.name" . }}'
884 app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
885 app.kubernetes.io/instance: '{{ .Release.Name }}'
886 # Generated labels {{- include "labels" . | nindent 4 }}
887spec:
888 group: acme.cert-manager.io
889 names:
890 kind: Challenge
891 listKind: ChallengeList
892 plural: challenges
893 singular: challenge
894 categories:
895 - cert-manager
896 - cert-manager-acme
897 scope: Namespaced
898 versions:
899 - additionalPrinterColumns:
900 - jsonPath: .status.state
901 name: State
902 type: string
903 - jsonPath: .spec.dnsName
904 name: Domain
905 type: string
906 - jsonPath: .status.reason
907 name: Reason
908 priority: 1
909 type: string
910 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
911 jsonPath: .metadata.creationTimestamp
912 name: Age
913 type: date
914 name: v1
915 schema:
916 openAPIV3Schema:
917 description: Challenge is a type to represent a Challenge request with an ACME server
918 type: object
919 required:
920 - metadata
921 - spec
922 properties:
923 apiVersion:
924 description: |-
925 APIVersion defines the versioned schema of this representation of an object.
926 Servers should convert recognized schemas to the latest internal value, and
927 may reject unrecognized values.
928 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
929 type: string
930 kind:
931 description: |-
932 Kind is a string value representing the REST resource this object represents.
933 Servers may infer this from the endpoint the client submits requests to.
934 Cannot be updated.
935 In CamelCase.
936 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
937 type: string
938 metadata:
939 type: object
940 spec:
941 type: object
942 required:
943 - authorizationURL
944 - dnsName
945 - issuerRef
946 - key
947 - solver
948 - token
949 - type
950 - url
951 properties:
952 authorizationURL:
953 description: |-
954 The URL to the ACME Authorization resource that this
955 challenge is a part of.
956 type: string
957 dnsName:
958 description: |-
959 dnsName is the identifier that this challenge is for, e.g. example.com.
960 If the requested DNSName is a 'wildcard', this field MUST be set to the
961 non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
962 type: string
963 issuerRef:
964 description: |-
965 References a properly configured ACME-type Issuer which should
966 be used to create this Challenge.
967 If the Issuer does not exist, processing will be retried.
968 If the Issuer is not an 'ACME' Issuer, an error will be returned and the
969 Challenge will be marked as failed.
970 type: object
971 required:
972 - name
973 properties:
974 group:
975 description: Group of the resource being referred to.
976 type: string
977 kind:
978 description: Kind of the resource being referred to.
979 type: string
980 name:
981 description: Name of the resource being referred to.
982 type: string
983 key:
984 description: |-
985 The ACME challenge key for this challenge
986 For HTTP01 challenges, this is the value that must be responded with to
987 complete the HTTP01 challenge in the format:
988 `<private key JWK thumbprint>.<key from acme server for challenge>`.
989 For DNS01 challenges, this is the base64 encoded SHA256 sum of the
990 `<private key JWK thumbprint>.<key from acme server for challenge>`
991 text that must be set as the TXT record content.
992 type: string
993 solver:
994 description: |-
995 Contains the domain solving configuration that should be used to
996 solve this challenge resource.
997 type: object
998 properties:
999 dns01:
1000 description: |-
1001 Configures cert-manager to attempt to complete authorizations by
1002 performing the DNS01 challenge flow.
1003 type: object
1004 properties:
1005 acmeDNS:
1006 description: |-
1007 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
1008 DNS01 challenge records.
1009 type: object
1010 required:
1011 - accountSecretRef
1012 - host
1013 properties:
1014 accountSecretRef:
1015 description: |-
1016 A reference to a specific 'key' within a Secret resource.
1017 In some instances, `key` is a required field.
1018 type: object
1019 required:
1020 - name
1021 properties:
1022 key:
1023 description: |-
1024 The key of the entry in the Secret resource's `data` field to be used.
1025 Some instances of this field may be defaulted, in others it may be
1026 required.
1027 type: string
1028 name:
1029 description: |-
1030 Name of the resource being referred to.
1031 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1032 type: string
1033 host:
1034 type: string
1035 akamai:
1036 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
1037 type: object
1038 required:
1039 - accessTokenSecretRef
1040 - clientSecretSecretRef
1041 - clientTokenSecretRef
1042 - serviceConsumerDomain
1043 properties:
1044 accessTokenSecretRef:
1045 description: |-
1046 A reference to a specific 'key' within a Secret resource.
1047 In some instances, `key` is a required field.
1048 type: object
1049 required:
1050 - name
1051 properties:
1052 key:
1053 description: |-
1054 The key of the entry in the Secret resource's `data` field to be used.
1055 Some instances of this field may be defaulted, in others it may be
1056 required.
1057 type: string
1058 name:
1059 description: |-
1060 Name of the resource being referred to.
1061 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1062 type: string
1063 clientSecretSecretRef:
1064 description: |-
1065 A reference to a specific 'key' within a Secret resource.
1066 In some instances, `key` is a required field.
1067 type: object
1068 required:
1069 - name
1070 properties:
1071 key:
1072 description: |-
1073 The key of the entry in the Secret resource's `data` field to be used.
1074 Some instances of this field may be defaulted, in others it may be
1075 required.
1076 type: string
1077 name:
1078 description: |-
1079 Name of the resource being referred to.
1080 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1081 type: string
1082 clientTokenSecretRef:
1083 description: |-
1084 A reference to a specific 'key' within a Secret resource.
1085 In some instances, `key` is a required field.
1086 type: object
1087 required:
1088 - name
1089 properties:
1090 key:
1091 description: |-
1092 The key of the entry in the Secret resource's `data` field to be used.
1093 Some instances of this field may be defaulted, in others it may be
1094 required.
1095 type: string
1096 name:
1097 description: |-
1098 Name of the resource being referred to.
1099 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1100 type: string
1101 serviceConsumerDomain:
1102 type: string
1103 azureDNS:
1104 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
1105 type: object
1106 required:
1107 - resourceGroupName
1108 - subscriptionID
1109 properties:
1110 clientID:
1111 description: if both this and ClientSecret are left unset MSI will be used
1112 type: string
1113 clientSecretSecretRef:
1114 description: if both this and ClientID are left unset MSI will be used
1115 type: object
1116 required:
1117 - name
1118 properties:
1119 key:
1120 description: |-
1121 The key of the entry in the Secret resource's `data` field to be used.
1122 Some instances of this field may be defaulted, in others it may be
1123 required.
1124 type: string
1125 name:
1126 description: |-
1127 Name of the resource being referred to.
1128 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1129 type: string
1130 environment:
1131 description: name of the Azure environment (default AzurePublicCloud)
1132 type: string
1133 enum:
1134 - AzurePublicCloud
1135 - AzureChinaCloud
1136 - AzureGermanCloud
1137 - AzureUSGovernmentCloud
1138 hostedZoneName:
1139 description: name of the DNS zone that should be used
1140 type: string
1141 managedIdentity:
1142 description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID
1143 type: object
1144 properties:
1145 clientID:
1146 description: client ID of the managed identity, can not be used at the same time as resourceID
1147 type: string
1148 resourceID:
1149 description: resource ID of the managed identity, can not be used at the same time as clientID
1150 type: string
1151 resourceGroupName:
1152 description: resource group the DNS zone is located in
1153 type: string
1154 subscriptionID:
1155 description: ID of the Azure subscription
1156 type: string
1157 tenantID:
1158 description: when specifying ClientID and ClientSecret then this field is also needed
1159 type: string
1160 cloudDNS:
1161 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
1162 type: object
1163 required:
1164 - project
1165 properties:
1166 hostedZoneName:
1167 description: |-
1168 HostedZoneName is an optional field that tells cert-manager in which
1169 Cloud DNS zone the challenge record has to be created.
1170 If left empty cert-manager will automatically choose a zone.
1171 type: string
1172 project:
1173 type: string
1174 serviceAccountSecretRef:
1175 description: |-
1176 A reference to a specific 'key' within a Secret resource.
1177 In some instances, `key` is a required field.
1178 type: object
1179 required:
1180 - name
1181 properties:
1182 key:
1183 description: |-
1184 The key of the entry in the Secret resource's `data` field to be used.
1185 Some instances of this field may be defaulted, in others it may be
1186 required.
1187 type: string
1188 name:
1189 description: |-
1190 Name of the resource being referred to.
1191 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1192 type: string
1193 cloudflare:
1194 description: Use the Cloudflare API to manage DNS01 challenge records.
1195 type: object
1196 properties:
1197 apiKeySecretRef:
1198 description: |-
1199 API key to use to authenticate with Cloudflare.
1200 Note: using an API token to authenticate is now the recommended method
1201 as it allows greater control of permissions.
1202 type: object
1203 required:
1204 - name
1205 properties:
1206 key:
1207 description: |-
1208 The key of the entry in the Secret resource's `data` field to be used.
1209 Some instances of this field may be defaulted, in others it may be
1210 required.
1211 type: string
1212 name:
1213 description: |-
1214 Name of the resource being referred to.
1215 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1216 type: string
1217 apiTokenSecretRef:
1218 description: API token used to authenticate with Cloudflare.
1219 type: object
1220 required:
1221 - name
1222 properties:
1223 key:
1224 description: |-
1225 The key of the entry in the Secret resource's `data` field to be used.
1226 Some instances of this field may be defaulted, in others it may be
1227 required.
1228 type: string
1229 name:
1230 description: |-
1231 Name of the resource being referred to.
1232 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1233 type: string
1234 email:
1235 description: Email of the account, only required when using API key based authentication.
1236 type: string
1237 cnameStrategy:
1238 description: |-
1239 CNAMEStrategy configures how the DNS01 provider should handle CNAME
1240 records when found in DNS zones.
1241 type: string
1242 enum:
1243 - None
1244 - Follow
1245 digitalocean:
1246 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
1247 type: object
1248 required:
1249 - tokenSecretRef
1250 properties:
1251 tokenSecretRef:
1252 description: |-
1253 A reference to a specific 'key' within a Secret resource.
1254 In some instances, `key` is a required field.
1255 type: object
1256 required:
1257 - name
1258 properties:
1259 key:
1260 description: |-
1261 The key of the entry in the Secret resource's `data` field to be used.
1262 Some instances of this field may be defaulted, in others it may be
1263 required.
1264 type: string
1265 name:
1266 description: |-
1267 Name of the resource being referred to.
1268 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1269 type: string
1270 rfc2136:
1271 description: |-
1272 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
1273 to manage DNS01 challenge records.
1274 type: object
1275 required:
1276 - nameserver
1277 properties:
1278 nameserver:
1279 description: |-
1280 The IP address or hostname of an authoritative DNS server supporting
1281 RFC2136 in the form host:port. If the host is an IPv6 address it must be
1282 enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
1283 This field is required.
1284 type: string
1285 tsigAlgorithm:
1286 description: |-
1287 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
1288 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
1289 Supported values are (case-insensitive): ``HMACMD5`` (default),
1290 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
1291 type: string
1292 tsigKeyName:
1293 description: |-
1294 The TSIG Key name configured in the DNS.
1295 If ``tsigSecretSecretRef`` is defined, this field is required.
1296 type: string
1297 tsigSecretSecretRef:
1298 description: |-
1299 The name of the secret containing the TSIG value.
1300 If ``tsigKeyName`` is defined, this field is required.
1301 type: object
1302 required:
1303 - name
1304 properties:
1305 key:
1306 description: |-
1307 The key of the entry in the Secret resource's `data` field to be used.
1308 Some instances of this field may be defaulted, in others it may be
1309 required.
1310 type: string
1311 name:
1312 description: |-
1313 Name of the resource being referred to.
1314 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1315 type: string
1316 route53:
1317 description: Use the AWS Route53 API to manage DNS01 challenge records.
1318 type: object
1319 required:
1320 - region
1321 properties:
1322 accessKeyID:
1323 description: |-
1324 The AccessKeyID is used for authentication.
1325 Cannot be set when SecretAccessKeyID is set.
1326 If neither the Access Key nor Key ID are set, we fall-back to using env
1327 vars, shared credentials file or AWS Instance metadata,
1328 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
1329 type: string
1330 accessKeyIDSecretRef:
1331 description: |-
1332 The SecretAccessKey is used for authentication. If set, pull the AWS
1333 access key ID from a key within a Kubernetes Secret.
1334 Cannot be set when AccessKeyID is set.
1335 If neither the Access Key nor Key ID are set, we fall-back to using env
1336 vars, shared credentials file or AWS Instance metadata,
1337 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
1338 type: object
1339 required:
1340 - name
1341 properties:
1342 key:
1343 description: |-
1344 The key of the entry in the Secret resource's `data` field to be used.
1345 Some instances of this field may be defaulted, in others it may be
1346 required.
1347 type: string
1348 name:
1349 description: |-
1350 Name of the resource being referred to.
1351 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1352 type: string
1353 hostedZoneID:
1354 description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
1355 type: string
1356 region:
1357 description: Always set the region when using AccessKeyID and SecretAccessKey
1358 type: string
1359 role:
1360 description: |-
1361 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
1362 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
1363 type: string
1364 secretAccessKeySecretRef:
1365 description: |-
1366 The SecretAccessKey is used for authentication.
1367 If neither the Access Key nor Key ID are set, we fall-back to using env
1368 vars, shared credentials file or AWS Instance metadata,
1369 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
1370 type: object
1371 required:
1372 - name
1373 properties:
1374 key:
1375 description: |-
1376 The key of the entry in the Secret resource's `data` field to be used.
1377 Some instances of this field may be defaulted, in others it may be
1378 required.
1379 type: string
1380 name:
1381 description: |-
1382 Name of the resource being referred to.
1383 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1384 type: string
1385 webhook:
1386 description: |-
1387 Configure an external webhook based DNS01 challenge solver to manage
1388 DNS01 challenge records.
1389 type: object
1390 required:
1391 - groupName
1392 - solverName
1393 properties:
1394 config:
1395 description: |-
1396 Additional configuration that should be passed to the webhook apiserver
1397 when challenges are processed.
1398 This can contain arbitrary JSON data.
1399 Secret values should not be specified in this stanza.
1400 If secret values are needed (e.g. credentials for a DNS service), you
1401 should use a SecretKeySelector to reference a Secret resource.
1402 For details on the schema of this field, consult the webhook provider
1403 implementation's documentation.
1404 x-kubernetes-preserve-unknown-fields: true
1405 groupName:
1406 description: |-
1407 The API group name that should be used when POSTing ChallengePayload
1408 resources to the webhook apiserver.
1409 This should be the same as the GroupName specified in the webhook
1410 provider implementation.
1411 type: string
1412 solverName:
1413 description: |-
1414 The name of the solver to use, as defined in the webhook provider
1415 implementation.
1416 This will typically be the name of the provider, e.g. 'cloudflare'.
1417 type: string
1418 http01:
1419 description: |-
1420 Configures cert-manager to attempt to complete authorizations by
1421 performing the HTTP01 challenge flow.
1422 It is not possible to obtain certificates for wildcard domain names
1423 (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
1424 type: object
1425 properties:
1426 gatewayHTTPRoute:
1427 description: |-
1428 The Gateway API is a sig-network community API that models service networking
1429 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
1430 create HTTPRoutes with the specified labels in the same namespace as the challenge.
1431 This solver is experimental, and fields / behaviour may change in the future.
1432 type: object
1433 properties:
1434 labels:
1435 description: |-
1436 Custom labels that will be applied to HTTPRoutes created by cert-manager
1437 while solving HTTP-01 challenges.
1438 type: object
1439 additionalProperties:
1440 type: string
1441 parentRefs:
1442 description: |-
1443 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
1444 cert-manager needs to know which parentRefs should be used when creating
1445 the HTTPRoute. Usually, the parentRef references a Gateway. See:
1446 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
1447 type: array
1448 items:
1449 description: |-
1450 ParentReference identifies an API object (usually a Gateway) that can be considered
1451 a parent of this resource (usually a route). The only kind of parent resource
1452 with "Core" support is Gateway. This API may be extended in the future to
1453 support additional kinds of parent resources, such as HTTPRoute.
1454
1455 The API object must be valid in the cluster; the Group and Kind must
1456 be registered in the cluster for this reference to be valid.
1457 type: object
1458 required:
1459 - name
1460 properties:
1461 group:
1462 description: |-
1463 Group is the group of the referent.
1464 When unspecified, "gateway.networking.k8s.io" is inferred.
1465 To set the core API group (such as for a "Service" kind referent),
1466 Group must be explicitly set to "" (empty string).
1467
1468 Support: Core
1469 type: string
1470 default: gateway.networking.k8s.io
1471 maxLength: 253
1472 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1473 kind:
1474 description: |-
1475 Kind is kind of the referent.
1476
1477 Support: Core (Gateway)
1478
1479 Support: Implementation-specific (Other Resources)
1480 type: string
1481 default: Gateway
1482 maxLength: 63
1483 minLength: 1
1484 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1485 name:
1486 description: |-
1487 Name is the name of the referent.
1488
1489 Support: Core
1490 type: string
1491 maxLength: 253
1492 minLength: 1
1493 namespace:
1494 description: |-
1495 Namespace is the namespace of the referent. When unspecified, this refers
1496 to the local namespace of the Route.
1497
1498 Note that there are specific rules for ParentRefs which cross namespace
1499 boundaries. Cross-namespace references are only valid if they are explicitly
1500 allowed by something in the namespace they are referring to. For example:
1501 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
1502 generic way to enable any other kind of cross-namespace reference.
1503
1504 Support: Core
1505 type: string
1506 maxLength: 63
1507 minLength: 1
1508 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1509 port:
1510 description: |-
1511 Port is the network port this Route targets. It can be interpreted
1512 differently based on the type of parent resource.
1513
1514 When the parent resource is a Gateway, this targets all listeners
1515 listening on the specified port that also support this kind of Route(and
1516 select this Route). It's not recommended to set `Port` unless the
1517 networking behaviors specified in a Route must apply to a specific port
1518 as opposed to a listener(s) whose port(s) may be changed. When both Port
1519 and SectionName are specified, the name and port of the selected listener
1520 must match both specified values.
1521
1522 Implementations MAY choose to support other parent resources.
1523 Implementations supporting other types of parent resources MUST clearly
1524 document how/if Port is interpreted.
1525
1526 For the purpose of status, an attachment is considered successful as
1527 long as the parent resource accepts it partially. For example, Gateway
1528 listeners can restrict which Routes can attach to them by Route kind,
1529 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
1530 from the referencing Route, the Route MUST be considered successfully
1531 attached. If no Gateway listeners accept attachment from this Route,
1532 the Route MUST be considered detached from the Gateway.
1533
1534 Support: Extended
1535
1536 <gateway:experimental>
1537 type: integer
1538 format: int32
1539 maximum: 65535
1540 minimum: 1
1541 sectionName:
1542 description: |-
1543 SectionName is the name of a section within the target resource. In the
1544 following resources, SectionName is interpreted as the following:
1545
1546 * Gateway: Listener Name. When both Port (experimental) and SectionName
1547 are specified, the name and port of the selected listener must match
1548 both specified values.
1549
1550 Implementations MAY choose to support attaching Routes to other resources.
1551 If that is the case, they MUST clearly document how SectionName is
1552 interpreted.
1553
1554 When unspecified (empty string), this will reference the entire resource.
1555 For the purpose of status, an attachment is considered successful if at
1556 least one section in the parent resource accepts it. For example, Gateway
1557 listeners can restrict which Routes can attach to them by Route kind,
1558 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
1559 the referencing Route, the Route MUST be considered successfully
1560 attached. If no Gateway listeners accept attachment from this Route, the
1561 Route MUST be considered detached from the Gateway.
1562
1563 Support: Core
1564 type: string
1565 maxLength: 253
1566 minLength: 1
1567 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1568 serviceType:
1569 description: |-
1570 Optional service type for Kubernetes solver service. Supported values
1571 are NodePort or ClusterIP. If unset, defaults to NodePort.
1572 type: string
1573 ingress:
1574 description: |-
1575 The ingress based HTTP01 challenge solver will solve challenges by
1576 creating or modifying Ingress resources in order to route requests for
1577 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
1578 provisioned by cert-manager for each Challenge to be completed.
1579 type: object
1580 properties:
1581 class:
1582 description: |-
1583 This field configures the annotation `kubernetes.io/ingress.class` when
1584 creating Ingress resources to solve ACME challenges that use this
1585 challenge solver. Only one of `class`, `name` or `ingressClassName` may
1586 be specified.
1587 type: string
1588 ingressClassName:
1589 description: |-
1590 This field configures the field `ingressClassName` on the created Ingress
1591 resources used to solve ACME challenges that use this challenge solver.
1592 This is the recommended way of configuring the ingress class. Only one of
1593 `class`, `name` or `ingressClassName` may be specified.
1594 type: string
1595 ingressTemplate:
1596 description: |-
1597 Optional ingress template used to configure the ACME challenge solver
1598 ingress used for HTTP01 challenges.
1599 type: object
1600 properties:
1601 metadata:
1602 description: |-
1603 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
1604 Only the 'labels' and 'annotations' fields may be set.
1605 If labels or annotations overlap with in-built values, the values here
1606 will override the in-built values.
1607 type: object
1608 properties:
1609 annotations:
1610 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
1611 type: object
1612 additionalProperties:
1613 type: string
1614 labels:
1615 description: Labels that should be added to the created ACME HTTP01 solver ingress.
1616 type: object
1617 additionalProperties:
1618 type: string
1619 name:
1620 description: |-
1621 The name of the ingress resource that should have ACME challenge solving
1622 routes inserted into it in order to solve HTTP01 challenges.
1623 This is typically used in conjunction with ingress controllers like
1624 ingress-gce, which maintains a 1:1 mapping between external IPs and
1625 ingress resources. Only one of `class`, `name` or `ingressClassName` may
1626 be specified.
1627 type: string
1628 podTemplate:
1629 description: |-
1630 Optional pod template used to configure the ACME challenge solver pods
1631 used for HTTP01 challenges.
1632 type: object
1633 properties:
1634 metadata:
1635 description: |-
1636 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
1637 Only the 'labels' and 'annotations' fields may be set.
1638 If labels or annotations overlap with in-built values, the values here
1639 will override the in-built values.
1640 type: object
1641 properties:
1642 annotations:
1643 description: Annotations that should be added to the create ACME HTTP01 solver pods.
1644 type: object
1645 additionalProperties:
1646 type: string
1647 labels:
1648 description: Labels that should be added to the created ACME HTTP01 solver pods.
1649 type: object
1650 additionalProperties:
1651 type: string
1652 spec:
1653 description: |-
1654 PodSpec defines overrides for the HTTP01 challenge solver pod.
1655 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
1656 All other fields will be ignored.
1657 type: object
1658 properties:
1659 affinity:
1660 description: If specified, the pod's scheduling constraints
1661 type: object
1662 properties:
1663 nodeAffinity:
1664 description: Describes node affinity scheduling rules for the pod.
1665 type: object
1666 properties:
1667 preferredDuringSchedulingIgnoredDuringExecution:
1668 description: |-
1669 The scheduler will prefer to schedule pods to nodes that satisfy
1670 the affinity expressions specified by this field, but it may choose
1671 a node that violates one or more of the expressions. The node that is
1672 most preferred is the one with the greatest sum of weights, i.e.
1673 for each node that meets all of the scheduling requirements (resource
1674 request, requiredDuringScheduling affinity expressions, etc.),
1675 compute a sum by iterating through the elements of this field and adding
1676 "weight" to the sum if the node matches the corresponding matchExpressions; the
1677 node(s) with the highest sum are the most preferred.
1678 type: array
1679 items:
1680 description: |-
1681 An empty preferred scheduling term matches all objects with implicit weight 0
1682 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
1683 type: object
1684 required:
1685 - preference
1686 - weight
1687 properties:
1688 preference:
1689 description: A node selector term, associated with the corresponding weight.
1690 type: object
1691 properties:
1692 matchExpressions:
1693 description: A list of node selector requirements by node's labels.
1694 type: array
1695 items:
1696 description: |-
1697 A node selector requirement is a selector that contains values, a key, and an operator
1698 that relates the key and values.
1699 type: object
1700 required:
1701 - key
1702 - operator
1703 properties:
1704 key:
1705 description: The label key that the selector applies to.
1706 type: string
1707 operator:
1708 description: |-
1709 Represents a key's relationship to a set of values.
1710 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1711 type: string
1712 values:
1713 description: |-
1714 An array of string values. If the operator is In or NotIn,
1715 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1716 the values array must be empty. If the operator is Gt or Lt, the values
1717 array must have a single element, which will be interpreted as an integer.
1718 This array is replaced during a strategic merge patch.
1719 type: array
1720 items:
1721 type: string
1722 matchFields:
1723 description: A list of node selector requirements by node's fields.
1724 type: array
1725 items:
1726 description: |-
1727 A node selector requirement is a selector that contains values, a key, and an operator
1728 that relates the key and values.
1729 type: object
1730 required:
1731 - key
1732 - operator
1733 properties:
1734 key:
1735 description: The label key that the selector applies to.
1736 type: string
1737 operator:
1738 description: |-
1739 Represents a key's relationship to a set of values.
1740 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1741 type: string
1742 values:
1743 description: |-
1744 An array of string values. If the operator is In or NotIn,
1745 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1746 the values array must be empty. If the operator is Gt or Lt, the values
1747 array must have a single element, which will be interpreted as an integer.
1748 This array is replaced during a strategic merge patch.
1749 type: array
1750 items:
1751 type: string
1752 x-kubernetes-map-type: atomic
1753 weight:
1754 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
1755 type: integer
1756 format: int32
1757 requiredDuringSchedulingIgnoredDuringExecution:
1758 description: |-
1759 If the affinity requirements specified by this field are not met at
1760 scheduling time, the pod will not be scheduled onto the node.
1761 If the affinity requirements specified by this field cease to be met
1762 at some point during pod execution (e.g. due to an update), the system
1763 may or may not try to eventually evict the pod from its node.
1764 type: object
1765 required:
1766 - nodeSelectorTerms
1767 properties:
1768 nodeSelectorTerms:
1769 description: Required. A list of node selector terms. The terms are ORed.
1770 type: array
1771 items:
1772 description: |-
1773 A null or empty node selector term matches no objects. The requirements of
1774 them are ANDed.
1775 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
1776 type: object
1777 properties:
1778 matchExpressions:
1779 description: A list of node selector requirements by node's labels.
1780 type: array
1781 items:
1782 description: |-
1783 A node selector requirement is a selector that contains values, a key, and an operator
1784 that relates the key and values.
1785 type: object
1786 required:
1787 - key
1788 - operator
1789 properties:
1790 key:
1791 description: The label key that the selector applies to.
1792 type: string
1793 operator:
1794 description: |-
1795 Represents a key's relationship to a set of values.
1796 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1797 type: string
1798 values:
1799 description: |-
1800 An array of string values. If the operator is In or NotIn,
1801 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1802 the values array must be empty. If the operator is Gt or Lt, the values
1803 array must have a single element, which will be interpreted as an integer.
1804 This array is replaced during a strategic merge patch.
1805 type: array
1806 items:
1807 type: string
1808 matchFields:
1809 description: A list of node selector requirements by node's fields.
1810 type: array
1811 items:
1812 description: |-
1813 A node selector requirement is a selector that contains values, a key, and an operator
1814 that relates the key and values.
1815 type: object
1816 required:
1817 - key
1818 - operator
1819 properties:
1820 key:
1821 description: The label key that the selector applies to.
1822 type: string
1823 operator:
1824 description: |-
1825 Represents a key's relationship to a set of values.
1826 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1827 type: string
1828 values:
1829 description: |-
1830 An array of string values. If the operator is In or NotIn,
1831 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1832 the values array must be empty. If the operator is Gt or Lt, the values
1833 array must have a single element, which will be interpreted as an integer.
1834 This array is replaced during a strategic merge patch.
1835 type: array
1836 items:
1837 type: string
1838 x-kubernetes-map-type: atomic
1839 x-kubernetes-map-type: atomic
1840 podAffinity:
1841 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
1842 type: object
1843 properties:
1844 preferredDuringSchedulingIgnoredDuringExecution:
1845 description: |-
1846 The scheduler will prefer to schedule pods to nodes that satisfy
1847 the affinity expressions specified by this field, but it may choose
1848 a node that violates one or more of the expressions. The node that is
1849 most preferred is the one with the greatest sum of weights, i.e.
1850 for each node that meets all of the scheduling requirements (resource
1851 request, requiredDuringScheduling affinity expressions, etc.),
1852 compute a sum by iterating through the elements of this field and adding
1853 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
1854 node(s) with the highest sum are the most preferred.
1855 type: array
1856 items:
1857 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1858 type: object
1859 required:
1860 - podAffinityTerm
1861 - weight
1862 properties:
1863 podAffinityTerm:
1864 description: Required. A pod affinity term, associated with the corresponding weight.
1865 type: object
1866 required:
1867 - topologyKey
1868 properties:
1869 labelSelector:
1870 description: |-
1871 A label query over a set of resources, in this case pods.
1872 If it's null, this PodAffinityTerm matches with no Pods.
1873 type: object
1874 properties:
1875 matchExpressions:
1876 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1877 type: array
1878 items:
1879 description: |-
1880 A label selector requirement is a selector that contains values, a key, and an operator that
1881 relates the key and values.
1882 type: object
1883 required:
1884 - key
1885 - operator
1886 properties:
1887 key:
1888 description: key is the label key that the selector applies to.
1889 type: string
1890 operator:
1891 description: |-
1892 operator represents a key's relationship to a set of values.
1893 Valid operators are In, NotIn, Exists and DoesNotExist.
1894 type: string
1895 values:
1896 description: |-
1897 values is an array of string values. If the operator is In or NotIn,
1898 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1899 the values array must be empty. This array is replaced during a strategic
1900 merge patch.
1901 type: array
1902 items:
1903 type: string
1904 matchLabels:
1905 description: |-
1906 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1907 map is equivalent to an element of matchExpressions, whose key field is "key", the
1908 operator is "In", and the values array contains only "value". The requirements are ANDed.
1909 type: object
1910 additionalProperties:
1911 type: string
1912 x-kubernetes-map-type: atomic
1913 matchLabelKeys:
1914 description: |-
1915 MatchLabelKeys is a set of pod label keys to select which pods will
1916 be taken into consideration. The keys are used to lookup values from the
1917 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
1918 to select the group of existing pods which pods will be taken into consideration
1919 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1920 pod labels will be ignored. The default value is empty.
1921 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
1922 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
1923 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
1924 type: array
1925 items:
1926 type: string
1927 x-kubernetes-list-type: atomic
1928 mismatchLabelKeys:
1929 description: |-
1930 MismatchLabelKeys is a set of pod label keys to select which pods will
1931 be taken into consideration. The keys are used to lookup values from the
1932 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
1933 to select the group of existing pods which pods will be taken into consideration
1934 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1935 pod labels will be ignored. The default value is empty.
1936 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
1937 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
1938 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
1939 type: array
1940 items:
1941 type: string
1942 x-kubernetes-list-type: atomic
1943 namespaceSelector:
1944 description: |-
1945 A label query over the set of namespaces that the term applies to.
1946 The term is applied to the union of the namespaces selected by this field
1947 and the ones listed in the namespaces field.
1948 null selector and null or empty namespaces list means "this pod's namespace".
1949 An empty selector ({}) matches all namespaces.
1950 type: object
1951 properties:
1952 matchExpressions:
1953 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1954 type: array
1955 items:
1956 description: |-
1957 A label selector requirement is a selector that contains values, a key, and an operator that
1958 relates the key and values.
1959 type: object
1960 required:
1961 - key
1962 - operator
1963 properties:
1964 key:
1965 description: key is the label key that the selector applies to.
1966 type: string
1967 operator:
1968 description: |-
1969 operator represents a key's relationship to a set of values.
1970 Valid operators are In, NotIn, Exists and DoesNotExist.
1971 type: string
1972 values:
1973 description: |-
1974 values is an array of string values. If the operator is In or NotIn,
1975 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1976 the values array must be empty. This array is replaced during a strategic
1977 merge patch.
1978 type: array
1979 items:
1980 type: string
1981 matchLabels:
1982 description: |-
1983 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1984 map is equivalent to an element of matchExpressions, whose key field is "key", the
1985 operator is "In", and the values array contains only "value". The requirements are ANDed.
1986 type: object
1987 additionalProperties:
1988 type: string
1989 x-kubernetes-map-type: atomic
1990 namespaces:
1991 description: |-
1992 namespaces specifies a static list of namespace names that the term applies to.
1993 The term is applied to the union of the namespaces listed in this field
1994 and the ones selected by namespaceSelector.
1995 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1996 type: array
1997 items:
1998 type: string
1999 topologyKey:
2000 description: |-
2001 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2002 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2003 whose value of the label with key topologyKey matches that of any node on which any of the
2004 selected pods is running.
2005 Empty topologyKey is not allowed.
2006 type: string
2007 weight:
2008 description: |-
2009 weight associated with matching the corresponding podAffinityTerm,
2010 in the range 1-100.
2011 type: integer
2012 format: int32
2013 requiredDuringSchedulingIgnoredDuringExecution:
2014 description: |-
2015 If the affinity requirements specified by this field are not met at
2016 scheduling time, the pod will not be scheduled onto the node.
2017 If the affinity requirements specified by this field cease to be met
2018 at some point during pod execution (e.g. due to a pod label update), the
2019 system may or may not try to eventually evict the pod from its node.
2020 When there are multiple elements, the lists of nodes corresponding to each
2021 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2022 type: array
2023 items:
2024 description: |-
2025 Defines a set of pods (namely those matching the labelSelector
2026 relative to the given namespace(s)) that this pod should be
2027 co-located (affinity) or not co-located (anti-affinity) with,
2028 where co-located is defined as running on a node whose value of
2029 the label with key <topologyKey> matches that of any node on which
2030 a pod of the set of pods is running
2031 type: object
2032 required:
2033 - topologyKey
2034 properties:
2035 labelSelector:
2036 description: |-
2037 A label query over a set of resources, in this case pods.
2038 If it's null, this PodAffinityTerm matches with no Pods.
2039 type: object
2040 properties:
2041 matchExpressions:
2042 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2043 type: array
2044 items:
2045 description: |-
2046 A label selector requirement is a selector that contains values, a key, and an operator that
2047 relates the key and values.
2048 type: object
2049 required:
2050 - key
2051 - operator
2052 properties:
2053 key:
2054 description: key is the label key that the selector applies to.
2055 type: string
2056 operator:
2057 description: |-
2058 operator represents a key's relationship to a set of values.
2059 Valid operators are In, NotIn, Exists and DoesNotExist.
2060 type: string
2061 values:
2062 description: |-
2063 values is an array of string values. If the operator is In or NotIn,
2064 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2065 the values array must be empty. This array is replaced during a strategic
2066 merge patch.
2067 type: array
2068 items:
2069 type: string
2070 matchLabels:
2071 description: |-
2072 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2073 map is equivalent to an element of matchExpressions, whose key field is "key", the
2074 operator is "In", and the values array contains only "value". The requirements are ANDed.
2075 type: object
2076 additionalProperties:
2077 type: string
2078 x-kubernetes-map-type: atomic
2079 matchLabelKeys:
2080 description: |-
2081 MatchLabelKeys is a set of pod label keys to select which pods will
2082 be taken into consideration. The keys are used to lookup values from the
2083 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
2084 to select the group of existing pods which pods will be taken into consideration
2085 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2086 pod labels will be ignored. The default value is empty.
2087 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
2088 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
2089 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
2090 type: array
2091 items:
2092 type: string
2093 x-kubernetes-list-type: atomic
2094 mismatchLabelKeys:
2095 description: |-
2096 MismatchLabelKeys is a set of pod label keys to select which pods will
2097 be taken into consideration. The keys are used to lookup values from the
2098 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
2099 to select the group of existing pods which pods will be taken into consideration
2100 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2101 pod labels will be ignored. The default value is empty.
2102 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
2103 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
2104 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
2105 type: array
2106 items:
2107 type: string
2108 x-kubernetes-list-type: atomic
2109 namespaceSelector:
2110 description: |-
2111 A label query over the set of namespaces that the term applies to.
2112 The term is applied to the union of the namespaces selected by this field
2113 and the ones listed in the namespaces field.
2114 null selector and null or empty namespaces list means "this pod's namespace".
2115 An empty selector ({}) matches all namespaces.
2116 type: object
2117 properties:
2118 matchExpressions:
2119 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2120 type: array
2121 items:
2122 description: |-
2123 A label selector requirement is a selector that contains values, a key, and an operator that
2124 relates the key and values.
2125 type: object
2126 required:
2127 - key
2128 - operator
2129 properties:
2130 key:
2131 description: key is the label key that the selector applies to.
2132 type: string
2133 operator:
2134 description: |-
2135 operator represents a key's relationship to a set of values.
2136 Valid operators are In, NotIn, Exists and DoesNotExist.
2137 type: string
2138 values:
2139 description: |-
2140 values is an array of string values. If the operator is In or NotIn,
2141 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2142 the values array must be empty. This array is replaced during a strategic
2143 merge patch.
2144 type: array
2145 items:
2146 type: string
2147 matchLabels:
2148 description: |-
2149 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2150 map is equivalent to an element of matchExpressions, whose key field is "key", the
2151 operator is "In", and the values array contains only "value". The requirements are ANDed.
2152 type: object
2153 additionalProperties:
2154 type: string
2155 x-kubernetes-map-type: atomic
2156 namespaces:
2157 description: |-
2158 namespaces specifies a static list of namespace names that the term applies to.
2159 The term is applied to the union of the namespaces listed in this field
2160 and the ones selected by namespaceSelector.
2161 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2162 type: array
2163 items:
2164 type: string
2165 topologyKey:
2166 description: |-
2167 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2168 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2169 whose value of the label with key topologyKey matches that of any node on which any of the
2170 selected pods is running.
2171 Empty topologyKey is not allowed.
2172 type: string
2173 podAntiAffinity:
2174 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
2175 type: object
2176 properties:
2177 preferredDuringSchedulingIgnoredDuringExecution:
2178 description: |-
2179 The scheduler will prefer to schedule pods to nodes that satisfy
2180 the anti-affinity expressions specified by this field, but it may choose
2181 a node that violates one or more of the expressions. The node that is
2182 most preferred is the one with the greatest sum of weights, i.e.
2183 for each node that meets all of the scheduling requirements (resource
2184 request, requiredDuringScheduling anti-affinity expressions, etc.),
2185 compute a sum by iterating through the elements of this field and adding
2186 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
2187 node(s) with the highest sum are the most preferred.
2188 type: array
2189 items:
2190 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2191 type: object
2192 required:
2193 - podAffinityTerm
2194 - weight
2195 properties:
2196 podAffinityTerm:
2197 description: Required. A pod affinity term, associated with the corresponding weight.
2198 type: object
2199 required:
2200 - topologyKey
2201 properties:
2202 labelSelector:
2203 description: |-
2204 A label query over a set of resources, in this case pods.
2205 If it's null, this PodAffinityTerm matches with no Pods.
2206 type: object
2207 properties:
2208 matchExpressions:
2209 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2210 type: array
2211 items:
2212 description: |-
2213 A label selector requirement is a selector that contains values, a key, and an operator that
2214 relates the key and values.
2215 type: object
2216 required:
2217 - key
2218 - operator
2219 properties:
2220 key:
2221 description: key is the label key that the selector applies to.
2222 type: string
2223 operator:
2224 description: |-
2225 operator represents a key's relationship to a set of values.
2226 Valid operators are In, NotIn, Exists and DoesNotExist.
2227 type: string
2228 values:
2229 description: |-
2230 values is an array of string values. If the operator is In or NotIn,
2231 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2232 the values array must be empty. This array is replaced during a strategic
2233 merge patch.
2234 type: array
2235 items:
2236 type: string
2237 matchLabels:
2238 description: |-
2239 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2240 map is equivalent to an element of matchExpressions, whose key field is "key", the
2241 operator is "In", and the values array contains only "value". The requirements are ANDed.
2242 type: object
2243 additionalProperties:
2244 type: string
2245 x-kubernetes-map-type: atomic
2246 matchLabelKeys:
2247 description: |-
2248 MatchLabelKeys is a set of pod label keys to select which pods will
2249 be taken into consideration. The keys are used to lookup values from the
2250 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
2251 to select the group of existing pods which pods will be taken into consideration
2252 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2253 pod labels will be ignored. The default value is empty.
2254 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
2255 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
2256 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
2257 type: array
2258 items:
2259 type: string
2260 x-kubernetes-list-type: atomic
2261 mismatchLabelKeys:
2262 description: |-
2263 MismatchLabelKeys is a set of pod label keys to select which pods will
2264 be taken into consideration. The keys are used to lookup values from the
2265 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
2266 to select the group of existing pods which pods will be taken into consideration
2267 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2268 pod labels will be ignored. The default value is empty.
2269 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
2270 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
2271 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
2272 type: array
2273 items:
2274 type: string
2275 x-kubernetes-list-type: atomic
2276 namespaceSelector:
2277 description: |-
2278 A label query over the set of namespaces that the term applies to.
2279 The term is applied to the union of the namespaces selected by this field
2280 and the ones listed in the namespaces field.
2281 null selector and null or empty namespaces list means "this pod's namespace".
2282 An empty selector ({}) matches all namespaces.
2283 type: object
2284 properties:
2285 matchExpressions:
2286 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2287 type: array
2288 items:
2289 description: |-
2290 A label selector requirement is a selector that contains values, a key, and an operator that
2291 relates the key and values.
2292 type: object
2293 required:
2294 - key
2295 - operator
2296 properties:
2297 key:
2298 description: key is the label key that the selector applies to.
2299 type: string
2300 operator:
2301 description: |-
2302 operator represents a key's relationship to a set of values.
2303 Valid operators are In, NotIn, Exists and DoesNotExist.
2304 type: string
2305 values:
2306 description: |-
2307 values is an array of string values. If the operator is In or NotIn,
2308 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2309 the values array must be empty. This array is replaced during a strategic
2310 merge patch.
2311 type: array
2312 items:
2313 type: string
2314 matchLabels:
2315 description: |-
2316 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2317 map is equivalent to an element of matchExpressions, whose key field is "key", the
2318 operator is "In", and the values array contains only "value". The requirements are ANDed.
2319 type: object
2320 additionalProperties:
2321 type: string
2322 x-kubernetes-map-type: atomic
2323 namespaces:
2324 description: |-
2325 namespaces specifies a static list of namespace names that the term applies to.
2326 The term is applied to the union of the namespaces listed in this field
2327 and the ones selected by namespaceSelector.
2328 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2329 type: array
2330 items:
2331 type: string
2332 topologyKey:
2333 description: |-
2334 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2335 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2336 whose value of the label with key topologyKey matches that of any node on which any of the
2337 selected pods is running.
2338 Empty topologyKey is not allowed.
2339 type: string
2340 weight:
2341 description: |-
2342 weight associated with matching the corresponding podAffinityTerm,
2343 in the range 1-100.
2344 type: integer
2345 format: int32
2346 requiredDuringSchedulingIgnoredDuringExecution:
2347 description: |-
2348 If the anti-affinity requirements specified by this field are not met at
2349 scheduling time, the pod will not be scheduled onto the node.
2350 If the anti-affinity requirements specified by this field cease to be met
2351 at some point during pod execution (e.g. due to a pod label update), the
2352 system may or may not try to eventually evict the pod from its node.
2353 When there are multiple elements, the lists of nodes corresponding to each
2354 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2355 type: array
2356 items:
2357 description: |-
2358 Defines a set of pods (namely those matching the labelSelector
2359 relative to the given namespace(s)) that this pod should be
2360 co-located (affinity) or not co-located (anti-affinity) with,
2361 where co-located is defined as running on a node whose value of
2362 the label with key <topologyKey> matches that of any node on which
2363 a pod of the set of pods is running
2364 type: object
2365 required:
2366 - topologyKey
2367 properties:
2368 labelSelector:
2369 description: |-
2370 A label query over a set of resources, in this case pods.
2371 If it's null, this PodAffinityTerm matches with no Pods.
2372 type: object
2373 properties:
2374 matchExpressions:
2375 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2376 type: array
2377 items:
2378 description: |-
2379 A label selector requirement is a selector that contains values, a key, and an operator that
2380 relates the key and values.
2381 type: object
2382 required:
2383 - key
2384 - operator
2385 properties:
2386 key:
2387 description: key is the label key that the selector applies to.
2388 type: string
2389 operator:
2390 description: |-
2391 operator represents a key's relationship to a set of values.
2392 Valid operators are In, NotIn, Exists and DoesNotExist.
2393 type: string
2394 values:
2395 description: |-
2396 values is an array of string values. If the operator is In or NotIn,
2397 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2398 the values array must be empty. This array is replaced during a strategic
2399 merge patch.
2400 type: array
2401 items:
2402 type: string
2403 matchLabels:
2404 description: |-
2405 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2406 map is equivalent to an element of matchExpressions, whose key field is "key", the
2407 operator is "In", and the values array contains only "value". The requirements are ANDed.
2408 type: object
2409 additionalProperties:
2410 type: string
2411 x-kubernetes-map-type: atomic
2412 matchLabelKeys:
2413 description: |-
2414 MatchLabelKeys is a set of pod label keys to select which pods will
2415 be taken into consideration. The keys are used to lookup values from the
2416 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
2417 to select the group of existing pods which pods will be taken into consideration
2418 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2419 pod labels will be ignored. The default value is empty.
2420 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
2421 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
2422 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
2423 type: array
2424 items:
2425 type: string
2426 x-kubernetes-list-type: atomic
2427 mismatchLabelKeys:
2428 description: |-
2429 MismatchLabelKeys is a set of pod label keys to select which pods will
2430 be taken into consideration. The keys are used to lookup values from the
2431 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
2432 to select the group of existing pods which pods will be taken into consideration
2433 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2434 pod labels will be ignored. The default value is empty.
2435 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
2436 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
2437 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
2438 type: array
2439 items:
2440 type: string
2441 x-kubernetes-list-type: atomic
2442 namespaceSelector:
2443 description: |-
2444 A label query over the set of namespaces that the term applies to.
2445 The term is applied to the union of the namespaces selected by this field
2446 and the ones listed in the namespaces field.
2447 null selector and null or empty namespaces list means "this pod's namespace".
2448 An empty selector ({}) matches all namespaces.
2449 type: object
2450 properties:
2451 matchExpressions:
2452 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2453 type: array
2454 items:
2455 description: |-
2456 A label selector requirement is a selector that contains values, a key, and an operator that
2457 relates the key and values.
2458 type: object
2459 required:
2460 - key
2461 - operator
2462 properties:
2463 key:
2464 description: key is the label key that the selector applies to.
2465 type: string
2466 operator:
2467 description: |-
2468 operator represents a key's relationship to a set of values.
2469 Valid operators are In, NotIn, Exists and DoesNotExist.
2470 type: string
2471 values:
2472 description: |-
2473 values is an array of string values. If the operator is In or NotIn,
2474 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2475 the values array must be empty. This array is replaced during a strategic
2476 merge patch.
2477 type: array
2478 items:
2479 type: string
2480 matchLabels:
2481 description: |-
2482 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2483 map is equivalent to an element of matchExpressions, whose key field is "key", the
2484 operator is "In", and the values array contains only "value". The requirements are ANDed.
2485 type: object
2486 additionalProperties:
2487 type: string
2488 x-kubernetes-map-type: atomic
2489 namespaces:
2490 description: |-
2491 namespaces specifies a static list of namespace names that the term applies to.
2492 The term is applied to the union of the namespaces listed in this field
2493 and the ones selected by namespaceSelector.
2494 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2495 type: array
2496 items:
2497 type: string
2498 topologyKey:
2499 description: |-
2500 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2501 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2502 whose value of the label with key topologyKey matches that of any node on which any of the
2503 selected pods is running.
2504 Empty topologyKey is not allowed.
2505 type: string
2506 imagePullSecrets:
2507 description: If specified, the pod's imagePullSecrets
2508 type: array
2509 items:
2510 description: |-
2511 LocalObjectReference contains enough information to let you locate the
2512 referenced object inside the same namespace.
2513 type: object
2514 properties:
2515 name:
2516 description: |-
2517 Name of the referent.
2518 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2519 type: string
2520 x-kubernetes-map-type: atomic
2521 nodeSelector:
2522 description: |-
2523 NodeSelector is a selector which must be true for the pod to fit on a node.
2524 Selector which must match a node's labels for the pod to be scheduled on that node.
2525 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
2526 type: object
2527 additionalProperties:
2528 type: string
2529 priorityClassName:
2530 description: If specified, the pod's priorityClassName.
2531 type: string
2532 serviceAccountName:
2533 description: If specified, the pod's service account
2534 type: string
2535 tolerations:
2536 description: If specified, the pod's tolerations.
2537 type: array
2538 items:
2539 description: |-
2540 The pod this Toleration is attached to tolerates any taint that matches
2541 the triple <key,value,effect> using the matching operator <operator>.
2542 type: object
2543 properties:
2544 effect:
2545 description: |-
2546 Effect indicates the taint effect to match. Empty means match all taint effects.
2547 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
2548 type: string
2549 key:
2550 description: |-
2551 Key is the taint key that the toleration applies to. Empty means match all taint keys.
2552 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
2553 type: string
2554 operator:
2555 description: |-
2556 Operator represents a key's relationship to the value.
2557 Valid operators are Exists and Equal. Defaults to Equal.
2558 Exists is equivalent to wildcard for value, so that a pod can
2559 tolerate all taints of a particular category.
2560 type: string
2561 tolerationSeconds:
2562 description: |-
2563 TolerationSeconds represents the period of time the toleration (which must be
2564 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
2565 it is not set, which means tolerate the taint forever (do not evict). Zero and
2566 negative values will be treated as 0 (evict immediately) by the system.
2567 type: integer
2568 format: int64
2569 value:
2570 description: |-
2571 Value is the taint value the toleration matches to.
2572 If the operator is Exists, the value should be empty, otherwise just a regular string.
2573 type: string
2574 serviceType:
2575 description: |-
2576 Optional service type for Kubernetes solver service. Supported values
2577 are NodePort or ClusterIP. If unset, defaults to NodePort.
2578 type: string
2579 selector:
2580 description: |-
2581 Selector selects a set of DNSNames on the Certificate resource that
2582 should be solved using this challenge solver.
2583 If not specified, the solver will be treated as the 'default' solver
2584 with the lowest priority, i.e. if any other solver has a more specific
2585 match, it will be used instead.
2586 type: object
2587 properties:
2588 dnsNames:
2589 description: |-
2590 List of DNSNames that this solver will be used to solve.
2591 If specified and a match is found, a dnsNames selector will take
2592 precedence over a dnsZones selector.
2593 If multiple solvers match with the same dnsNames value, the solver
2594 with the most matching labels in matchLabels will be selected.
2595 If neither has more matches, the solver defined earlier in the list
2596 will be selected.
2597 type: array
2598 items:
2599 type: string
2600 dnsZones:
2601 description: |-
2602 List of DNSZones that this solver will be used to solve.
2603 The most specific DNS zone match specified here will take precedence
2604 over other DNS zone matches, so a solver specifying sys.example.com
2605 will be selected over one specifying example.com for the domain
2606 www.sys.example.com.
2607 If multiple solvers match with the same dnsZones value, the solver
2608 with the most matching labels in matchLabels will be selected.
2609 If neither has more matches, the solver defined earlier in the list
2610 will be selected.
2611 type: array
2612 items:
2613 type: string
2614 matchLabels:
2615 description: |-
2616 A label selector that is used to refine the set of certificate's that
2617 this challenge solver will apply to.
2618 type: object
2619 additionalProperties:
2620 type: string
2621 token:
2622 description: |-
2623 The ACME challenge token for this challenge.
2624 This is the raw value returned from the ACME server.
2625 type: string
2626 type:
2627 description: |-
2628 The type of ACME challenge this resource represents.
2629 One of "HTTP-01" or "DNS-01".
2630 type: string
2631 enum:
2632 - HTTP-01
2633 - DNS-01
2634 url:
2635 description: |-
2636 The URL of the ACME Challenge resource for this challenge.
2637 This can be used to lookup details about the status of this challenge.
2638 type: string
2639 wildcard:
2640 description: |-
2641 wildcard will be true if this challenge is for a wildcard identifier,
2642 for example '*.example.com'.
2643 type: boolean
2644 status:
2645 type: object
2646 properties:
2647 presented:
2648 description: |-
2649 presented will be set to true if the challenge values for this challenge
2650 are currently 'presented'.
2651 This *does not* imply the self check is passing. Only that the values
2652 have been 'submitted' for the appropriate challenge mechanism (i.e. the
2653 DNS01 TXT record has been presented, or the HTTP01 configuration has been
2654 configured).
2655 type: boolean
2656 processing:
2657 description: |-
2658 Used to denote whether this challenge should be processed or not.
2659 This field will only be set to true by the 'scheduling' component.
2660 It will only be set to false by the 'challenges' controller, after the
2661 challenge has reached a final state or timed out.
2662 If this field is set to false, the challenge controller will not take
2663 any more action.
2664 type: boolean
2665 reason:
2666 description: |-
2667 Contains human readable information on why the Challenge is in the
2668 current state.
2669 type: string
2670 state:
2671 description: |-
2672 Contains the current 'state' of the challenge.
2673 If not set, the state of the challenge is unknown.
2674 type: string
2675 enum:
2676 - valid
2677 - ready
2678 - pending
2679 - processing
2680 - invalid
2681 - expired
2682 - errored
2683 served: true
2684 storage: true
2685 subresources:
2686 status: {}
2687---
2688apiVersion: apiextensions.k8s.io/v1
2689kind: CustomResourceDefinition
2690metadata:
2691 name: clusterissuers.cert-manager.io
2692 labels:
2693 app: '{{ template "cert-manager.name" . }}'
2694 app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
2695 app.kubernetes.io/instance: "{{ .Release.Name }}"
2696 # Generated labels {{- include "labels" . | nindent 4 }}
2697spec:
2698 group: cert-manager.io
2699 names:
2700 kind: ClusterIssuer
2701 listKind: ClusterIssuerList
2702 plural: clusterissuers
2703 singular: clusterissuer
2704 categories:
2705 - cert-manager
2706 scope: Cluster
2707 versions:
2708 - name: v1
2709 subresources:
2710 status: {}
2711 additionalPrinterColumns:
2712 - jsonPath: .status.conditions[?(@.type=="Ready")].status
2713 name: Ready
2714 type: string
2715 - jsonPath: .status.conditions[?(@.type=="Ready")].message
2716 name: Status
2717 priority: 1
2718 type: string
2719 - jsonPath: .metadata.creationTimestamp
2720 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
2721 name: Age
2722 type: date
2723 schema:
2724 openAPIV3Schema:
2725 description: |-
2726 A ClusterIssuer represents a certificate issuing authority which can be
2727 referenced as part of `issuerRef` fields.
2728 It is similar to an Issuer, however it is cluster-scoped and therefore can
2729 be referenced by resources that exist in *any* namespace, not just the same
2730 namespace as the referent.
2731 type: object
2732 required:
2733 - spec
2734 properties:
2735 apiVersion:
2736 description: |-
2737 APIVersion defines the versioned schema of this representation of an object.
2738 Servers should convert recognized schemas to the latest internal value, and
2739 may reject unrecognized values.
2740 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
2741 type: string
2742 kind:
2743 description: |-
2744 Kind is a string value representing the REST resource this object represents.
2745 Servers may infer this from the endpoint the client submits requests to.
2746 Cannot be updated.
2747 In CamelCase.
2748 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
2749 type: string
2750 metadata:
2751 type: object
2752 spec:
2753 description: Desired state of the ClusterIssuer resource.
2754 type: object
2755 properties:
2756 acme:
2757 description: |-
2758 ACME configures this issuer to communicate with a RFC8555 (ACME) server
2759 to obtain signed x509 certificates.
2760 type: object
2761 required:
2762 - privateKeySecretRef
2763 - server
2764 properties:
2765 caBundle:
2766 description: |-
2767 Base64-encoded bundle of PEM CAs which can be used to validate the certificate
2768 chain presented by the ACME server.
2769 Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
2770 kinds of security vulnerabilities.
2771 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
2772 the container is used to validate the TLS connection.
2773 type: string
2774 format: byte
2775 disableAccountKeyGeneration:
2776 description: |-
2777 Enables or disables generating a new ACME account key.
2778 If true, the Issuer resource will *not* request a new account but will expect
2779 the account key to be supplied via an existing secret.
2780 If false, the cert-manager system will generate a new ACME account key
2781 for the Issuer.
2782 Defaults to false.
2783 type: boolean
2784 email:
2785 description: |-
2786 Email is the email address to be associated with the ACME account.
2787 This field is optional, but it is strongly recommended to be set.
2788 It will be used to contact you in case of issues with your account or
2789 certificates, including expiry notification emails.
2790 This field may be updated after the account is initially registered.
2791 type: string
2792 enableDurationFeature:
2793 description: |-
2794 Enables requesting a Not After date on certificates that matches the
2795 duration of the certificate. This is not supported by all ACME servers
2796 like Let's Encrypt. If set to true when the ACME server does not support
2797 it it will create an error on the Order.
2798 Defaults to false.
2799 type: boolean
2800 externalAccountBinding:
2801 description: |-
2802 ExternalAccountBinding is a reference to a CA external account of the ACME
2803 server.
2804 If set, upon registration cert-manager will attempt to associate the given
2805 external account credentials with the registered ACME account.
2806 type: object
2807 required:
2808 - keyID
2809 - keySecretRef
2810 properties:
2811 keyAlgorithm:
2812 description: |-
2813 Deprecated: keyAlgorithm field exists for historical compatibility
2814 reasons and should not be used. The algorithm is now hardcoded to HS256
2815 in golang/x/crypto/acme.
2816 type: string
2817 enum:
2818 - HS256
2819 - HS384
2820 - HS512
2821 keyID:
2822 description: keyID is the ID of the CA key that the External Account is bound to.
2823 type: string
2824 keySecretRef:
2825 description: |-
2826 keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
2827 Secret which holds the symmetric MAC key of the External Account Binding.
2828 The `key` is the index string that is paired with the key data in the
2829 Secret and should not be confused with the key data itself, or indeed with
2830 the External Account Binding keyID above.
2831 The secret key stored in the Secret **must** be un-padded, base64 URL
2832 encoded data.
2833 type: object
2834 required:
2835 - name
2836 properties:
2837 key:
2838 description: |-
2839 The key of the entry in the Secret resource's `data` field to be used.
2840 Some instances of this field may be defaulted, in others it may be
2841 required.
2842 type: string
2843 name:
2844 description: |-
2845 Name of the resource being referred to.
2846 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2847 type: string
2848 preferredChain:
2849 description: |-
2850 PreferredChain is the chain to use if the ACME server outputs multiple.
2851 PreferredChain is no guarantee that this one gets delivered by the ACME
2852 endpoint.
2853 For example, for Let's Encrypt's DST crosssign you would use:
2854 "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
2855 This value picks the first certificate bundle in the ACME alternative
2856 chains that has a certificate with this value as its issuer's CN
2857 type: string
2858 maxLength: 64
2859 privateKeySecretRef:
2860 description: |-
2861 PrivateKey is the name of a Kubernetes Secret resource that will be used to
2862 store the automatically generated ACME account private key.
2863 Optionally, a `key` may be specified to select a specific entry within
2864 the named Secret resource.
2865 If `key` is not specified, a default of `tls.key` will be used.
2866 type: object
2867 required:
2868 - name
2869 properties:
2870 key:
2871 description: |-
2872 The key of the entry in the Secret resource's `data` field to be used.
2873 Some instances of this field may be defaulted, in others it may be
2874 required.
2875 type: string
2876 name:
2877 description: |-
2878 Name of the resource being referred to.
2879 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2880 type: string
2881 server:
2882 description: |-
2883 Server is the URL used to access the ACME server's 'directory' endpoint.
2884 For example, for Let's Encrypt's staging endpoint, you would use:
2885 "https://acme-staging-v02.api.letsencrypt.org/directory".
2886 Only ACME v2 endpoints (i.e. RFC 8555) are supported.
2887 type: string
2888 skipTLSVerify:
2889 description: |-
2890 INSECURE: Enables or disables validation of the ACME server TLS certificate.
2891 If true, requests to the ACME server will not have the TLS certificate chain
2892 validated.
2893 Mutually exclusive with CABundle; prefer using CABundle to prevent various
2894 kinds of security vulnerabilities.
2895 Only enable this option in development environments.
2896 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
2897 the container is used to validate the TLS connection.
2898 Defaults to false.
2899 type: boolean
2900 solvers:
2901 description: |-
2902 Solvers is a list of challenge solvers that will be used to solve
2903 ACME challenges for the matching domains.
2904 Solver configurations must be provided in order to obtain certificates
2905 from an ACME server.
2906 For more information, see: https://cert-manager.io/docs/configuration/acme/
2907 type: array
2908 items:
2909 description: |-
2910 An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
2911 A selector may be provided to use different solving strategies for different DNS names.
2912 Only one of HTTP01 or DNS01 must be provided.
2913 type: object
2914 properties:
2915 dns01:
2916 description: |-
2917 Configures cert-manager to attempt to complete authorizations by
2918 performing the DNS01 challenge flow.
2919 type: object
2920 properties:
2921 acmeDNS:
2922 description: |-
2923 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
2924 DNS01 challenge records.
2925 type: object
2926 required:
2927 - accountSecretRef
2928 - host
2929 properties:
2930 accountSecretRef:
2931 description: |-
2932 A reference to a specific 'key' within a Secret resource.
2933 In some instances, `key` is a required field.
2934 type: object
2935 required:
2936 - name
2937 properties:
2938 key:
2939 description: |-
2940 The key of the entry in the Secret resource's `data` field to be used.
2941 Some instances of this field may be defaulted, in others it may be
2942 required.
2943 type: string
2944 name:
2945 description: |-
2946 Name of the resource being referred to.
2947 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2948 type: string
2949 host:
2950 type: string
2951 akamai:
2952 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
2953 type: object
2954 required:
2955 - accessTokenSecretRef
2956 - clientSecretSecretRef
2957 - clientTokenSecretRef
2958 - serviceConsumerDomain
2959 properties:
2960 accessTokenSecretRef:
2961 description: |-
2962 A reference to a specific 'key' within a Secret resource.
2963 In some instances, `key` is a required field.
2964 type: object
2965 required:
2966 - name
2967 properties:
2968 key:
2969 description: |-
2970 The key of the entry in the Secret resource's `data` field to be used.
2971 Some instances of this field may be defaulted, in others it may be
2972 required.
2973 type: string
2974 name:
2975 description: |-
2976 Name of the resource being referred to.
2977 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2978 type: string
2979 clientSecretSecretRef:
2980 description: |-
2981 A reference to a specific 'key' within a Secret resource.
2982 In some instances, `key` is a required field.
2983 type: object
2984 required:
2985 - name
2986 properties:
2987 key:
2988 description: |-
2989 The key of the entry in the Secret resource's `data` field to be used.
2990 Some instances of this field may be defaulted, in others it may be
2991 required.
2992 type: string
2993 name:
2994 description: |-
2995 Name of the resource being referred to.
2996 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2997 type: string
2998 clientTokenSecretRef:
2999 description: |-
3000 A reference to a specific 'key' within a Secret resource.
3001 In some instances, `key` is a required field.
3002 type: object
3003 required:
3004 - name
3005 properties:
3006 key:
3007 description: |-
3008 The key of the entry in the Secret resource's `data` field to be used.
3009 Some instances of this field may be defaulted, in others it may be
3010 required.
3011 type: string
3012 name:
3013 description: |-
3014 Name of the resource being referred to.
3015 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3016 type: string
3017 serviceConsumerDomain:
3018 type: string
3019 azureDNS:
3020 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
3021 type: object
3022 required:
3023 - resourceGroupName
3024 - subscriptionID
3025 properties:
3026 clientID:
3027 description: if both this and ClientSecret are left unset MSI will be used
3028 type: string
3029 clientSecretSecretRef:
3030 description: if both this and ClientID are left unset MSI will be used
3031 type: object
3032 required:
3033 - name
3034 properties:
3035 key:
3036 description: |-
3037 The key of the entry in the Secret resource's `data` field to be used.
3038 Some instances of this field may be defaulted, in others it may be
3039 required.
3040 type: string
3041 name:
3042 description: |-
3043 Name of the resource being referred to.
3044 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3045 type: string
3046 environment:
3047 description: name of the Azure environment (default AzurePublicCloud)
3048 type: string
3049 enum:
3050 - AzurePublicCloud
3051 - AzureChinaCloud
3052 - AzureGermanCloud
3053 - AzureUSGovernmentCloud
3054 hostedZoneName:
3055 description: name of the DNS zone that should be used
3056 type: string
3057 managedIdentity:
3058 description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID
3059 type: object
3060 properties:
3061 clientID:
3062 description: client ID of the managed identity, can not be used at the same time as resourceID
3063 type: string
3064 resourceID:
3065 description: resource ID of the managed identity, can not be used at the same time as clientID
3066 type: string
3067 resourceGroupName:
3068 description: resource group the DNS zone is located in
3069 type: string
3070 subscriptionID:
3071 description: ID of the Azure subscription
3072 type: string
3073 tenantID:
3074 description: when specifying ClientID and ClientSecret then this field is also needed
3075 type: string
3076 cloudDNS:
3077 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
3078 type: object
3079 required:
3080 - project
3081 properties:
3082 hostedZoneName:
3083 description: |-
3084 HostedZoneName is an optional field that tells cert-manager in which
3085 Cloud DNS zone the challenge record has to be created.
3086 If left empty cert-manager will automatically choose a zone.
3087 type: string
3088 project:
3089 type: string
3090 serviceAccountSecretRef:
3091 description: |-
3092 A reference to a specific 'key' within a Secret resource.
3093 In some instances, `key` is a required field.
3094 type: object
3095 required:
3096 - name
3097 properties:
3098 key:
3099 description: |-
3100 The key of the entry in the Secret resource's `data` field to be used.
3101 Some instances of this field may be defaulted, in others it may be
3102 required.
3103 type: string
3104 name:
3105 description: |-
3106 Name of the resource being referred to.
3107 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3108 type: string
3109 cloudflare:
3110 description: Use the Cloudflare API to manage DNS01 challenge records.
3111 type: object
3112 properties:
3113 apiKeySecretRef:
3114 description: |-
3115 API key to use to authenticate with Cloudflare.
3116 Note: using an API token to authenticate is now the recommended method
3117 as it allows greater control of permissions.
3118 type: object
3119 required:
3120 - name
3121 properties:
3122 key:
3123 description: |-
3124 The key of the entry in the Secret resource's `data` field to be used.
3125 Some instances of this field may be defaulted, in others it may be
3126 required.
3127 type: string
3128 name:
3129 description: |-
3130 Name of the resource being referred to.
3131 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3132 type: string
3133 apiTokenSecretRef:
3134 description: API token used to authenticate with Cloudflare.
3135 type: object
3136 required:
3137 - name
3138 properties:
3139 key:
3140 description: |-
3141 The key of the entry in the Secret resource's `data` field to be used.
3142 Some instances of this field may be defaulted, in others it may be
3143 required.
3144 type: string
3145 name:
3146 description: |-
3147 Name of the resource being referred to.
3148 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3149 type: string
3150 email:
3151 description: Email of the account, only required when using API key based authentication.
3152 type: string
3153 cnameStrategy:
3154 description: |-
3155 CNAMEStrategy configures how the DNS01 provider should handle CNAME
3156 records when found in DNS zones.
3157 type: string
3158 enum:
3159 - None
3160 - Follow
3161 digitalocean:
3162 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
3163 type: object
3164 required:
3165 - tokenSecretRef
3166 properties:
3167 tokenSecretRef:
3168 description: |-
3169 A reference to a specific 'key' within a Secret resource.
3170 In some instances, `key` is a required field.
3171 type: object
3172 required:
3173 - name
3174 properties:
3175 key:
3176 description: |-
3177 The key of the entry in the Secret resource's `data` field to be used.
3178 Some instances of this field may be defaulted, in others it may be
3179 required.
3180 type: string
3181 name:
3182 description: |-
3183 Name of the resource being referred to.
3184 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3185 type: string
3186 rfc2136:
3187 description: |-
3188 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
3189 to manage DNS01 challenge records.
3190 type: object
3191 required:
3192 - nameserver
3193 properties:
3194 nameserver:
3195 description: |-
3196 The IP address or hostname of an authoritative DNS server supporting
3197 RFC2136 in the form host:port. If the host is an IPv6 address it must be
3198 enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
3199 This field is required.
3200 type: string
3201 tsigAlgorithm:
3202 description: |-
3203 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
3204 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
3205 Supported values are (case-insensitive): ``HMACMD5`` (default),
3206 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
3207 type: string
3208 tsigKeyName:
3209 description: |-
3210 The TSIG Key name configured in the DNS.
3211 If ``tsigSecretSecretRef`` is defined, this field is required.
3212 type: string
3213 tsigSecretSecretRef:
3214 description: |-
3215 The name of the secret containing the TSIG value.
3216 If ``tsigKeyName`` is defined, this field is required.
3217 type: object
3218 required:
3219 - name
3220 properties:
3221 key:
3222 description: |-
3223 The key of the entry in the Secret resource's `data` field to be used.
3224 Some instances of this field may be defaulted, in others it may be
3225 required.
3226 type: string
3227 name:
3228 description: |-
3229 Name of the resource being referred to.
3230 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3231 type: string
3232 route53:
3233 description: Use the AWS Route53 API to manage DNS01 challenge records.
3234 type: object
3235 required:
3236 - region
3237 properties:
3238 accessKeyID:
3239 description: |-
3240 The AccessKeyID is used for authentication.
3241 Cannot be set when SecretAccessKeyID is set.
3242 If neither the Access Key nor Key ID are set, we fall-back to using env
3243 vars, shared credentials file or AWS Instance metadata,
3244 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
3245 type: string
3246 accessKeyIDSecretRef:
3247 description: |-
3248 The SecretAccessKey is used for authentication. If set, pull the AWS
3249 access key ID from a key within a Kubernetes Secret.
3250 Cannot be set when AccessKeyID is set.
3251 If neither the Access Key nor Key ID are set, we fall-back to using env
3252 vars, shared credentials file or AWS Instance metadata,
3253 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
3254 type: object
3255 required:
3256 - name
3257 properties:
3258 key:
3259 description: |-
3260 The key of the entry in the Secret resource's `data` field to be used.
3261 Some instances of this field may be defaulted, in others it may be
3262 required.
3263 type: string
3264 name:
3265 description: |-
3266 Name of the resource being referred to.
3267 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3268 type: string
3269 hostedZoneID:
3270 description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
3271 type: string
3272 region:
3273 description: Always set the region when using AccessKeyID and SecretAccessKey
3274 type: string
3275 role:
3276 description: |-
3277 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
3278 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
3279 type: string
3280 secretAccessKeySecretRef:
3281 description: |-
3282 The SecretAccessKey is used for authentication.
3283 If neither the Access Key nor Key ID are set, we fall-back to using env
3284 vars, shared credentials file or AWS Instance metadata,
3285 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
3286 type: object
3287 required:
3288 - name
3289 properties:
3290 key:
3291 description: |-
3292 The key of the entry in the Secret resource's `data` field to be used.
3293 Some instances of this field may be defaulted, in others it may be
3294 required.
3295 type: string
3296 name:
3297 description: |-
3298 Name of the resource being referred to.
3299 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3300 type: string
3301 webhook:
3302 description: |-
3303 Configure an external webhook based DNS01 challenge solver to manage
3304 DNS01 challenge records.
3305 type: object
3306 required:
3307 - groupName
3308 - solverName
3309 properties:
3310 config:
3311 description: |-
3312 Additional configuration that should be passed to the webhook apiserver
3313 when challenges are processed.
3314 This can contain arbitrary JSON data.
3315 Secret values should not be specified in this stanza.
3316 If secret values are needed (e.g. credentials for a DNS service), you
3317 should use a SecretKeySelector to reference a Secret resource.
3318 For details on the schema of this field, consult the webhook provider
3319 implementation's documentation.
3320 x-kubernetes-preserve-unknown-fields: true
3321 groupName:
3322 description: |-
3323 The API group name that should be used when POSTing ChallengePayload
3324 resources to the webhook apiserver.
3325 This should be the same as the GroupName specified in the webhook
3326 provider implementation.
3327 type: string
3328 solverName:
3329 description: |-
3330 The name of the solver to use, as defined in the webhook provider
3331 implementation.
3332 This will typically be the name of the provider, e.g. 'cloudflare'.
3333 type: string
3334 http01:
3335 description: |-
3336 Configures cert-manager to attempt to complete authorizations by
3337 performing the HTTP01 challenge flow.
3338 It is not possible to obtain certificates for wildcard domain names
3339 (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
3340 type: object
3341 properties:
3342 gatewayHTTPRoute:
3343 description: |-
3344 The Gateway API is a sig-network community API that models service networking
3345 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
3346 create HTTPRoutes with the specified labels in the same namespace as the challenge.
3347 This solver is experimental, and fields / behaviour may change in the future.
3348 type: object
3349 properties:
3350 labels:
3351 description: |-
3352 Custom labels that will be applied to HTTPRoutes created by cert-manager
3353 while solving HTTP-01 challenges.
3354 type: object
3355 additionalProperties:
3356 type: string
3357 parentRefs:
3358 description: |-
3359 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
3360 cert-manager needs to know which parentRefs should be used when creating
3361 the HTTPRoute. Usually, the parentRef references a Gateway. See:
3362 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
3363 type: array
3364 items:
3365 description: |-
3366 ParentReference identifies an API object (usually a Gateway) that can be considered
3367 a parent of this resource (usually a route). The only kind of parent resource
3368 with "Core" support is Gateway. This API may be extended in the future to
3369 support additional kinds of parent resources, such as HTTPRoute.
3370
3371 The API object must be valid in the cluster; the Group and Kind must
3372 be registered in the cluster for this reference to be valid.
3373 type: object
3374 required:
3375 - name
3376 properties:
3377 group:
3378 description: |-
3379 Group is the group of the referent.
3380 When unspecified, "gateway.networking.k8s.io" is inferred.
3381 To set the core API group (such as for a "Service" kind referent),
3382 Group must be explicitly set to "" (empty string).
3383
3384 Support: Core
3385 type: string
3386 default: gateway.networking.k8s.io
3387 maxLength: 253
3388 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
3389 kind:
3390 description: |-
3391 Kind is kind of the referent.
3392
3393 Support: Core (Gateway)
3394
3395 Support: Implementation-specific (Other Resources)
3396 type: string
3397 default: Gateway
3398 maxLength: 63
3399 minLength: 1
3400 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
3401 name:
3402 description: |-
3403 Name is the name of the referent.
3404
3405 Support: Core
3406 type: string
3407 maxLength: 253
3408 minLength: 1
3409 namespace:
3410 description: |-
3411 Namespace is the namespace of the referent. When unspecified, this refers
3412 to the local namespace of the Route.
3413
3414 Note that there are specific rules for ParentRefs which cross namespace
3415 boundaries. Cross-namespace references are only valid if they are explicitly
3416 allowed by something in the namespace they are referring to. For example:
3417 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
3418 generic way to enable any other kind of cross-namespace reference.
3419
3420 Support: Core
3421 type: string
3422 maxLength: 63
3423 minLength: 1
3424 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
3425 port:
3426 description: |-
3427 Port is the network port this Route targets. It can be interpreted
3428 differently based on the type of parent resource.
3429
3430 When the parent resource is a Gateway, this targets all listeners
3431 listening on the specified port that also support this kind of Route(and
3432 select this Route). It's not recommended to set `Port` unless the
3433 networking behaviors specified in a Route must apply to a specific port
3434 as opposed to a listener(s) whose port(s) may be changed. When both Port
3435 and SectionName are specified, the name and port of the selected listener
3436 must match both specified values.
3437
3438 Implementations MAY choose to support other parent resources.
3439 Implementations supporting other types of parent resources MUST clearly
3440 document how/if Port is interpreted.
3441
3442 For the purpose of status, an attachment is considered successful as
3443 long as the parent resource accepts it partially. For example, Gateway
3444 listeners can restrict which Routes can attach to them by Route kind,
3445 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
3446 from the referencing Route, the Route MUST be considered successfully
3447 attached. If no Gateway listeners accept attachment from this Route,
3448 the Route MUST be considered detached from the Gateway.
3449
3450 Support: Extended
3451
3452 <gateway:experimental>
3453 type: integer
3454 format: int32
3455 maximum: 65535
3456 minimum: 1
3457 sectionName:
3458 description: |-
3459 SectionName is the name of a section within the target resource. In the
3460 following resources, SectionName is interpreted as the following:
3461
3462 * Gateway: Listener Name. When both Port (experimental) and SectionName
3463 are specified, the name and port of the selected listener must match
3464 both specified values.
3465
3466 Implementations MAY choose to support attaching Routes to other resources.
3467 If that is the case, they MUST clearly document how SectionName is
3468 interpreted.
3469
3470 When unspecified (empty string), this will reference the entire resource.
3471 For the purpose of status, an attachment is considered successful if at
3472 least one section in the parent resource accepts it. For example, Gateway
3473 listeners can restrict which Routes can attach to them by Route kind,
3474 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
3475 the referencing Route, the Route MUST be considered successfully
3476 attached. If no Gateway listeners accept attachment from this Route, the
3477 Route MUST be considered detached from the Gateway.
3478
3479 Support: Core
3480 type: string
3481 maxLength: 253
3482 minLength: 1
3483 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
3484 serviceType:
3485 description: |-
3486 Optional service type for Kubernetes solver service. Supported values
3487 are NodePort or ClusterIP. If unset, defaults to NodePort.
3488 type: string
3489 ingress:
3490 description: |-
3491 The ingress based HTTP01 challenge solver will solve challenges by
3492 creating or modifying Ingress resources in order to route requests for
3493 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
3494 provisioned by cert-manager for each Challenge to be completed.
3495 type: object
3496 properties:
3497 class:
3498 description: |-
3499 This field configures the annotation `kubernetes.io/ingress.class` when
3500 creating Ingress resources to solve ACME challenges that use this
3501 challenge solver. Only one of `class`, `name` or `ingressClassName` may
3502 be specified.
3503 type: string
3504 ingressClassName:
3505 description: |-
3506 This field configures the field `ingressClassName` on the created Ingress
3507 resources used to solve ACME challenges that use this challenge solver.
3508 This is the recommended way of configuring the ingress class. Only one of
3509 `class`, `name` or `ingressClassName` may be specified.
3510 type: string
3511 ingressTemplate:
3512 description: |-
3513 Optional ingress template used to configure the ACME challenge solver
3514 ingress used for HTTP01 challenges.
3515 type: object
3516 properties:
3517 metadata:
3518 description: |-
3519 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
3520 Only the 'labels' and 'annotations' fields may be set.
3521 If labels or annotations overlap with in-built values, the values here
3522 will override the in-built values.
3523 type: object
3524 properties:
3525 annotations:
3526 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
3527 type: object
3528 additionalProperties:
3529 type: string
3530 labels:
3531 description: Labels that should be added to the created ACME HTTP01 solver ingress.
3532 type: object
3533 additionalProperties:
3534 type: string
3535 name:
3536 description: |-
3537 The name of the ingress resource that should have ACME challenge solving
3538 routes inserted into it in order to solve HTTP01 challenges.
3539 This is typically used in conjunction with ingress controllers like
3540 ingress-gce, which maintains a 1:1 mapping between external IPs and
3541 ingress resources. Only one of `class`, `name` or `ingressClassName` may
3542 be specified.
3543 type: string
3544 podTemplate:
3545 description: |-
3546 Optional pod template used to configure the ACME challenge solver pods
3547 used for HTTP01 challenges.
3548 type: object
3549 properties:
3550 metadata:
3551 description: |-
3552 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
3553 Only the 'labels' and 'annotations' fields may be set.
3554 If labels or annotations overlap with in-built values, the values here
3555 will override the in-built values.
3556 type: object
3557 properties:
3558 annotations:
3559 description: Annotations that should be added to the create ACME HTTP01 solver pods.
3560 type: object
3561 additionalProperties:
3562 type: string
3563 labels:
3564 description: Labels that should be added to the created ACME HTTP01 solver pods.
3565 type: object
3566 additionalProperties:
3567 type: string
3568 spec:
3569 description: |-
3570 PodSpec defines overrides for the HTTP01 challenge solver pod.
3571 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
3572 All other fields will be ignored.
3573 type: object
3574 properties:
3575 affinity:
3576 description: If specified, the pod's scheduling constraints
3577 type: object
3578 properties:
3579 nodeAffinity:
3580 description: Describes node affinity scheduling rules for the pod.
3581 type: object
3582 properties:
3583 preferredDuringSchedulingIgnoredDuringExecution:
3584 description: |-
3585 The scheduler will prefer to schedule pods to nodes that satisfy
3586 the affinity expressions specified by this field, but it may choose
3587 a node that violates one or more of the expressions. The node that is
3588 most preferred is the one with the greatest sum of weights, i.e.
3589 for each node that meets all of the scheduling requirements (resource
3590 request, requiredDuringScheduling affinity expressions, etc.),
3591 compute a sum by iterating through the elements of this field and adding
3592 "weight" to the sum if the node matches the corresponding matchExpressions; the
3593 node(s) with the highest sum are the most preferred.
3594 type: array
3595 items:
3596 description: |-
3597 An empty preferred scheduling term matches all objects with implicit weight 0
3598 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
3599 type: object
3600 required:
3601 - preference
3602 - weight
3603 properties:
3604 preference:
3605 description: A node selector term, associated with the corresponding weight.
3606 type: object
3607 properties:
3608 matchExpressions:
3609 description: A list of node selector requirements by node's labels.
3610 type: array
3611 items:
3612 description: |-
3613 A node selector requirement is a selector that contains values, a key, and an operator
3614 that relates the key and values.
3615 type: object
3616 required:
3617 - key
3618 - operator
3619 properties:
3620 key:
3621 description: The label key that the selector applies to.
3622 type: string
3623 operator:
3624 description: |-
3625 Represents a key's relationship to a set of values.
3626 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
3627 type: string
3628 values:
3629 description: |-
3630 An array of string values. If the operator is In or NotIn,
3631 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3632 the values array must be empty. If the operator is Gt or Lt, the values
3633 array must have a single element, which will be interpreted as an integer.
3634 This array is replaced during a strategic merge patch.
3635 type: array
3636 items:
3637 type: string
3638 matchFields:
3639 description: A list of node selector requirements by node's fields.
3640 type: array
3641 items:
3642 description: |-
3643 A node selector requirement is a selector that contains values, a key, and an operator
3644 that relates the key and values.
3645 type: object
3646 required:
3647 - key
3648 - operator
3649 properties:
3650 key:
3651 description: The label key that the selector applies to.
3652 type: string
3653 operator:
3654 description: |-
3655 Represents a key's relationship to a set of values.
3656 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
3657 type: string
3658 values:
3659 description: |-
3660 An array of string values. If the operator is In or NotIn,
3661 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3662 the values array must be empty. If the operator is Gt or Lt, the values
3663 array must have a single element, which will be interpreted as an integer.
3664 This array is replaced during a strategic merge patch.
3665 type: array
3666 items:
3667 type: string
3668 x-kubernetes-map-type: atomic
3669 weight:
3670 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
3671 type: integer
3672 format: int32
3673 requiredDuringSchedulingIgnoredDuringExecution:
3674 description: |-
3675 If the affinity requirements specified by this field are not met at
3676 scheduling time, the pod will not be scheduled onto the node.
3677 If the affinity requirements specified by this field cease to be met
3678 at some point during pod execution (e.g. due to an update), the system
3679 may or may not try to eventually evict the pod from its node.
3680 type: object
3681 required:
3682 - nodeSelectorTerms
3683 properties:
3684 nodeSelectorTerms:
3685 description: Required. A list of node selector terms. The terms are ORed.
3686 type: array
3687 items:
3688 description: |-
3689 A null or empty node selector term matches no objects. The requirements of
3690 them are ANDed.
3691 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
3692 type: object
3693 properties:
3694 matchExpressions:
3695 description: A list of node selector requirements by node's labels.
3696 type: array
3697 items:
3698 description: |-
3699 A node selector requirement is a selector that contains values, a key, and an operator
3700 that relates the key and values.
3701 type: object
3702 required:
3703 - key
3704 - operator
3705 properties:
3706 key:
3707 description: The label key that the selector applies to.
3708 type: string
3709 operator:
3710 description: |-
3711 Represents a key's relationship to a set of values.
3712 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
3713 type: string
3714 values:
3715 description: |-
3716 An array of string values. If the operator is In or NotIn,
3717 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3718 the values array must be empty. If the operator is Gt or Lt, the values
3719 array must have a single element, which will be interpreted as an integer.
3720 This array is replaced during a strategic merge patch.
3721 type: array
3722 items:
3723 type: string
3724 matchFields:
3725 description: A list of node selector requirements by node's fields.
3726 type: array
3727 items:
3728 description: |-
3729 A node selector requirement is a selector that contains values, a key, and an operator
3730 that relates the key and values.
3731 type: object
3732 required:
3733 - key
3734 - operator
3735 properties:
3736 key:
3737 description: The label key that the selector applies to.
3738 type: string
3739 operator:
3740 description: |-
3741 Represents a key's relationship to a set of values.
3742 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
3743 type: string
3744 values:
3745 description: |-
3746 An array of string values. If the operator is In or NotIn,
3747 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3748 the values array must be empty. If the operator is Gt or Lt, the values
3749 array must have a single element, which will be interpreted as an integer.
3750 This array is replaced during a strategic merge patch.
3751 type: array
3752 items:
3753 type: string
3754 x-kubernetes-map-type: atomic
3755 x-kubernetes-map-type: atomic
3756 podAffinity:
3757 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
3758 type: object
3759 properties:
3760 preferredDuringSchedulingIgnoredDuringExecution:
3761 description: |-
3762 The scheduler will prefer to schedule pods to nodes that satisfy
3763 the affinity expressions specified by this field, but it may choose
3764 a node that violates one or more of the expressions. The node that is
3765 most preferred is the one with the greatest sum of weights, i.e.
3766 for each node that meets all of the scheduling requirements (resource
3767 request, requiredDuringScheduling affinity expressions, etc.),
3768 compute a sum by iterating through the elements of this field and adding
3769 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
3770 node(s) with the highest sum are the most preferred.
3771 type: array
3772 items:
3773 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
3774 type: object
3775 required:
3776 - podAffinityTerm
3777 - weight
3778 properties:
3779 podAffinityTerm:
3780 description: Required. A pod affinity term, associated with the corresponding weight.
3781 type: object
3782 required:
3783 - topologyKey
3784 properties:
3785 labelSelector:
3786 description: |-
3787 A label query over a set of resources, in this case pods.
3788 If it's null, this PodAffinityTerm matches with no Pods.
3789 type: object
3790 properties:
3791 matchExpressions:
3792 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
3793 type: array
3794 items:
3795 description: |-
3796 A label selector requirement is a selector that contains values, a key, and an operator that
3797 relates the key and values.
3798 type: object
3799 required:
3800 - key
3801 - operator
3802 properties:
3803 key:
3804 description: key is the label key that the selector applies to.
3805 type: string
3806 operator:
3807 description: |-
3808 operator represents a key's relationship to a set of values.
3809 Valid operators are In, NotIn, Exists and DoesNotExist.
3810 type: string
3811 values:
3812 description: |-
3813 values is an array of string values. If the operator is In or NotIn,
3814 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3815 the values array must be empty. This array is replaced during a strategic
3816 merge patch.
3817 type: array
3818 items:
3819 type: string
3820 matchLabels:
3821 description: |-
3822 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
3823 map is equivalent to an element of matchExpressions, whose key field is "key", the
3824 operator is "In", and the values array contains only "value". The requirements are ANDed.
3825 type: object
3826 additionalProperties:
3827 type: string
3828 x-kubernetes-map-type: atomic
3829 matchLabelKeys:
3830 description: |-
3831 MatchLabelKeys is a set of pod label keys to select which pods will
3832 be taken into consideration. The keys are used to lookup values from the
3833 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
3834 to select the group of existing pods which pods will be taken into consideration
3835 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
3836 pod labels will be ignored. The default value is empty.
3837 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
3838 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
3839 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
3840 type: array
3841 items:
3842 type: string
3843 x-kubernetes-list-type: atomic
3844 mismatchLabelKeys:
3845 description: |-
3846 MismatchLabelKeys is a set of pod label keys to select which pods will
3847 be taken into consideration. The keys are used to lookup values from the
3848 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
3849 to select the group of existing pods which pods will be taken into consideration
3850 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
3851 pod labels will be ignored. The default value is empty.
3852 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
3853 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
3854 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
3855 type: array
3856 items:
3857 type: string
3858 x-kubernetes-list-type: atomic
3859 namespaceSelector:
3860 description: |-
3861 A label query over the set of namespaces that the term applies to.
3862 The term is applied to the union of the namespaces selected by this field
3863 and the ones listed in the namespaces field.
3864 null selector and null or empty namespaces list means "this pod's namespace".
3865 An empty selector ({}) matches all namespaces.
3866 type: object
3867 properties:
3868 matchExpressions:
3869 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
3870 type: array
3871 items:
3872 description: |-
3873 A label selector requirement is a selector that contains values, a key, and an operator that
3874 relates the key and values.
3875 type: object
3876 required:
3877 - key
3878 - operator
3879 properties:
3880 key:
3881 description: key is the label key that the selector applies to.
3882 type: string
3883 operator:
3884 description: |-
3885 operator represents a key's relationship to a set of values.
3886 Valid operators are In, NotIn, Exists and DoesNotExist.
3887 type: string
3888 values:
3889 description: |-
3890 values is an array of string values. If the operator is In or NotIn,
3891 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3892 the values array must be empty. This array is replaced during a strategic
3893 merge patch.
3894 type: array
3895 items:
3896 type: string
3897 matchLabels:
3898 description: |-
3899 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
3900 map is equivalent to an element of matchExpressions, whose key field is "key", the
3901 operator is "In", and the values array contains only "value". The requirements are ANDed.
3902 type: object
3903 additionalProperties:
3904 type: string
3905 x-kubernetes-map-type: atomic
3906 namespaces:
3907 description: |-
3908 namespaces specifies a static list of namespace names that the term applies to.
3909 The term is applied to the union of the namespaces listed in this field
3910 and the ones selected by namespaceSelector.
3911 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
3912 type: array
3913 items:
3914 type: string
3915 topologyKey:
3916 description: |-
3917 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
3918 the labelSelector in the specified namespaces, where co-located is defined as running on a node
3919 whose value of the label with key topologyKey matches that of any node on which any of the
3920 selected pods is running.
3921 Empty topologyKey is not allowed.
3922 type: string
3923 weight:
3924 description: |-
3925 weight associated with matching the corresponding podAffinityTerm,
3926 in the range 1-100.
3927 type: integer
3928 format: int32
3929 requiredDuringSchedulingIgnoredDuringExecution:
3930 description: |-
3931 If the affinity requirements specified by this field are not met at
3932 scheduling time, the pod will not be scheduled onto the node.
3933 If the affinity requirements specified by this field cease to be met
3934 at some point during pod execution (e.g. due to a pod label update), the
3935 system may or may not try to eventually evict the pod from its node.
3936 When there are multiple elements, the lists of nodes corresponding to each
3937 podAffinityTerm are intersected, i.e. all terms must be satisfied.
3938 type: array
3939 items:
3940 description: |-
3941 Defines a set of pods (namely those matching the labelSelector
3942 relative to the given namespace(s)) that this pod should be
3943 co-located (affinity) or not co-located (anti-affinity) with,
3944 where co-located is defined as running on a node whose value of
3945 the label with key <topologyKey> matches that of any node on which
3946 a pod of the set of pods is running
3947 type: object
3948 required:
3949 - topologyKey
3950 properties:
3951 labelSelector:
3952 description: |-
3953 A label query over a set of resources, in this case pods.
3954 If it's null, this PodAffinityTerm matches with no Pods.
3955 type: object
3956 properties:
3957 matchExpressions:
3958 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
3959 type: array
3960 items:
3961 description: |-
3962 A label selector requirement is a selector that contains values, a key, and an operator that
3963 relates the key and values.
3964 type: object
3965 required:
3966 - key
3967 - operator
3968 properties:
3969 key:
3970 description: key is the label key that the selector applies to.
3971 type: string
3972 operator:
3973 description: |-
3974 operator represents a key's relationship to a set of values.
3975 Valid operators are In, NotIn, Exists and DoesNotExist.
3976 type: string
3977 values:
3978 description: |-
3979 values is an array of string values. If the operator is In or NotIn,
3980 the values array must be non-empty. If the operator is Exists or DoesNotExist,
3981 the values array must be empty. This array is replaced during a strategic
3982 merge patch.
3983 type: array
3984 items:
3985 type: string
3986 matchLabels:
3987 description: |-
3988 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
3989 map is equivalent to an element of matchExpressions, whose key field is "key", the
3990 operator is "In", and the values array contains only "value". The requirements are ANDed.
3991 type: object
3992 additionalProperties:
3993 type: string
3994 x-kubernetes-map-type: atomic
3995 matchLabelKeys:
3996 description: |-
3997 MatchLabelKeys is a set of pod label keys to select which pods will
3998 be taken into consideration. The keys are used to lookup values from the
3999 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
4000 to select the group of existing pods which pods will be taken into consideration
4001 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
4002 pod labels will be ignored. The default value is empty.
4003 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
4004 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
4005 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
4006 type: array
4007 items:
4008 type: string
4009 x-kubernetes-list-type: atomic
4010 mismatchLabelKeys:
4011 description: |-
4012 MismatchLabelKeys is a set of pod label keys to select which pods will
4013 be taken into consideration. The keys are used to lookup values from the
4014 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
4015 to select the group of existing pods which pods will be taken into consideration
4016 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
4017 pod labels will be ignored. The default value is empty.
4018 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
4019 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
4020 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
4021 type: array
4022 items:
4023 type: string
4024 x-kubernetes-list-type: atomic
4025 namespaceSelector:
4026 description: |-
4027 A label query over the set of namespaces that the term applies to.
4028 The term is applied to the union of the namespaces selected by this field
4029 and the ones listed in the namespaces field.
4030 null selector and null or empty namespaces list means "this pod's namespace".
4031 An empty selector ({}) matches all namespaces.
4032 type: object
4033 properties:
4034 matchExpressions:
4035 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
4036 type: array
4037 items:
4038 description: |-
4039 A label selector requirement is a selector that contains values, a key, and an operator that
4040 relates the key and values.
4041 type: object
4042 required:
4043 - key
4044 - operator
4045 properties:
4046 key:
4047 description: key is the label key that the selector applies to.
4048 type: string
4049 operator:
4050 description: |-
4051 operator represents a key's relationship to a set of values.
4052 Valid operators are In, NotIn, Exists and DoesNotExist.
4053 type: string
4054 values:
4055 description: |-
4056 values is an array of string values. If the operator is In or NotIn,
4057 the values array must be non-empty. If the operator is Exists or DoesNotExist,
4058 the values array must be empty. This array is replaced during a strategic
4059 merge patch.
4060 type: array
4061 items:
4062 type: string
4063 matchLabels:
4064 description: |-
4065 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
4066 map is equivalent to an element of matchExpressions, whose key field is "key", the
4067 operator is "In", and the values array contains only "value". The requirements are ANDed.
4068 type: object
4069 additionalProperties:
4070 type: string
4071 x-kubernetes-map-type: atomic
4072 namespaces:
4073 description: |-
4074 namespaces specifies a static list of namespace names that the term applies to.
4075 The term is applied to the union of the namespaces listed in this field
4076 and the ones selected by namespaceSelector.
4077 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
4078 type: array
4079 items:
4080 type: string
4081 topologyKey:
4082 description: |-
4083 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
4084 the labelSelector in the specified namespaces, where co-located is defined as running on a node
4085 whose value of the label with key topologyKey matches that of any node on which any of the
4086 selected pods is running.
4087 Empty topologyKey is not allowed.
4088 type: string
4089 podAntiAffinity:
4090 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
4091 type: object
4092 properties:
4093 preferredDuringSchedulingIgnoredDuringExecution:
4094 description: |-
4095 The scheduler will prefer to schedule pods to nodes that satisfy
4096 the anti-affinity expressions specified by this field, but it may choose
4097 a node that violates one or more of the expressions. The node that is
4098 most preferred is the one with the greatest sum of weights, i.e.
4099 for each node that meets all of the scheduling requirements (resource
4100 request, requiredDuringScheduling anti-affinity expressions, etc.),
4101 compute a sum by iterating through the elements of this field and adding
4102 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
4103 node(s) with the highest sum are the most preferred.
4104 type: array
4105 items:
4106 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
4107 type: object
4108 required:
4109 - podAffinityTerm
4110 - weight
4111 properties:
4112 podAffinityTerm:
4113 description: Required. A pod affinity term, associated with the corresponding weight.
4114 type: object
4115 required:
4116 - topologyKey
4117 properties:
4118 labelSelector:
4119 description: |-
4120 A label query over a set of resources, in this case pods.
4121 If it's null, this PodAffinityTerm matches with no Pods.
4122 type: object
4123 properties:
4124 matchExpressions:
4125 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
4126 type: array
4127 items:
4128 description: |-
4129 A label selector requirement is a selector that contains values, a key, and an operator that
4130 relates the key and values.
4131 type: object
4132 required:
4133 - key
4134 - operator
4135 properties:
4136 key:
4137 description: key is the label key that the selector applies to.
4138 type: string
4139 operator:
4140 description: |-
4141 operator represents a key's relationship to a set of values.
4142 Valid operators are In, NotIn, Exists and DoesNotExist.
4143 type: string
4144 values:
4145 description: |-
4146 values is an array of string values. If the operator is In or NotIn,
4147 the values array must be non-empty. If the operator is Exists or DoesNotExist,
4148 the values array must be empty. This array is replaced during a strategic
4149 merge patch.
4150 type: array
4151 items:
4152 type: string
4153 matchLabels:
4154 description: |-
4155 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
4156 map is equivalent to an element of matchExpressions, whose key field is "key", the
4157 operator is "In", and the values array contains only "value". The requirements are ANDed.
4158 type: object
4159 additionalProperties:
4160 type: string
4161 x-kubernetes-map-type: atomic
4162 matchLabelKeys:
4163 description: |-
4164 MatchLabelKeys is a set of pod label keys to select which pods will
4165 be taken into consideration. The keys are used to lookup values from the
4166 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
4167 to select the group of existing pods which pods will be taken into consideration
4168 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
4169 pod labels will be ignored. The default value is empty.
4170 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
4171 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
4172 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
4173 type: array
4174 items:
4175 type: string
4176 x-kubernetes-list-type: atomic
4177 mismatchLabelKeys:
4178 description: |-
4179 MismatchLabelKeys is a set of pod label keys to select which pods will
4180 be taken into consideration. The keys are used to lookup values from the
4181 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
4182 to select the group of existing pods which pods will be taken into consideration
4183 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
4184 pod labels will be ignored. The default value is empty.
4185 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
4186 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
4187 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
4188 type: array
4189 items:
4190 type: string
4191 x-kubernetes-list-type: atomic
4192 namespaceSelector:
4193 description: |-
4194 A label query over the set of namespaces that the term applies to.
4195 The term is applied to the union of the namespaces selected by this field
4196 and the ones listed in the namespaces field.
4197 null selector and null or empty namespaces list means "this pod's namespace".
4198 An empty selector ({}) matches all namespaces.
4199 type: object
4200 properties:
4201 matchExpressions:
4202 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
4203 type: array
4204 items:
4205 description: |-
4206 A label selector requirement is a selector that contains values, a key, and an operator that
4207 relates the key and values.
4208 type: object
4209 required:
4210 - key
4211 - operator
4212 properties:
4213 key:
4214 description: key is the label key that the selector applies to.
4215 type: string
4216 operator:
4217 description: |-
4218 operator represents a key's relationship to a set of values.
4219 Valid operators are In, NotIn, Exists and DoesNotExist.
4220 type: string
4221 values:
4222 description: |-
4223 values is an array of string values. If the operator is In or NotIn,
4224 the values array must be non-empty. If the operator is Exists or DoesNotExist,
4225 the values array must be empty. This array is replaced during a strategic
4226 merge patch.
4227 type: array
4228 items:
4229 type: string
4230 matchLabels:
4231 description: |-
4232 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
4233 map is equivalent to an element of matchExpressions, whose key field is "key", the
4234 operator is "In", and the values array contains only "value". The requirements are ANDed.
4235 type: object
4236 additionalProperties:
4237 type: string
4238 x-kubernetes-map-type: atomic
4239 namespaces:
4240 description: |-
4241 namespaces specifies a static list of namespace names that the term applies to.
4242 The term is applied to the union of the namespaces listed in this field
4243 and the ones selected by namespaceSelector.
4244 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
4245 type: array
4246 items:
4247 type: string
4248 topologyKey:
4249 description: |-
4250 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
4251 the labelSelector in the specified namespaces, where co-located is defined as running on a node
4252 whose value of the label with key topologyKey matches that of any node on which any of the
4253 selected pods is running.
4254 Empty topologyKey is not allowed.
4255 type: string
4256 weight:
4257 description: |-
4258 weight associated with matching the corresponding podAffinityTerm,
4259 in the range 1-100.
4260 type: integer
4261 format: int32
4262 requiredDuringSchedulingIgnoredDuringExecution:
4263 description: |-
4264 If the anti-affinity requirements specified by this field are not met at
4265 scheduling time, the pod will not be scheduled onto the node.
4266 If the anti-affinity requirements specified by this field cease to be met
4267 at some point during pod execution (e.g. due to a pod label update), the
4268 system may or may not try to eventually evict the pod from its node.
4269 When there are multiple elements, the lists of nodes corresponding to each
4270 podAffinityTerm are intersected, i.e. all terms must be satisfied.
4271 type: array
4272 items:
4273 description: |-
4274 Defines a set of pods (namely those matching the labelSelector
4275 relative to the given namespace(s)) that this pod should be
4276 co-located (affinity) or not co-located (anti-affinity) with,
4277 where co-located is defined as running on a node whose value of
4278 the label with key <topologyKey> matches that of any node on which
4279 a pod of the set of pods is running
4280 type: object
4281 required:
4282 - topologyKey
4283 properties:
4284 labelSelector:
4285 description: |-
4286 A label query over a set of resources, in this case pods.
4287 If it's null, this PodAffinityTerm matches with no Pods.
4288 type: object
4289 properties:
4290 matchExpressions:
4291 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
4292 type: array
4293 items:
4294 description: |-
4295 A label selector requirement is a selector that contains values, a key, and an operator that
4296 relates the key and values.
4297 type: object
4298 required:
4299 - key
4300 - operator
4301 properties:
4302 key:
4303 description: key is the label key that the selector applies to.
4304 type: string
4305 operator:
4306 description: |-
4307 operator represents a key's relationship to a set of values.
4308 Valid operators are In, NotIn, Exists and DoesNotExist.
4309 type: string
4310 values:
4311 description: |-
4312 values is an array of string values. If the operator is In or NotIn,
4313 the values array must be non-empty. If the operator is Exists or DoesNotExist,
4314 the values array must be empty. This array is replaced during a strategic
4315 merge patch.
4316 type: array
4317 items:
4318 type: string
4319 matchLabels:
4320 description: |-
4321 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
4322 map is equivalent to an element of matchExpressions, whose key field is "key", the
4323 operator is "In", and the values array contains only "value". The requirements are ANDed.
4324 type: object
4325 additionalProperties:
4326 type: string
4327 x-kubernetes-map-type: atomic
4328 matchLabelKeys:
4329 description: |-
4330 MatchLabelKeys is a set of pod label keys to select which pods will
4331 be taken into consideration. The keys are used to lookup values from the
4332 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
4333 to select the group of existing pods which pods will be taken into consideration
4334 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
4335 pod labels will be ignored. The default value is empty.
4336 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
4337 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
4338 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
4339 type: array
4340 items:
4341 type: string
4342 x-kubernetes-list-type: atomic
4343 mismatchLabelKeys:
4344 description: |-
4345 MismatchLabelKeys is a set of pod label keys to select which pods will
4346 be taken into consideration. The keys are used to lookup values from the
4347 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
4348 to select the group of existing pods which pods will be taken into consideration
4349 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
4350 pod labels will be ignored. The default value is empty.
4351 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
4352 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
4353 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
4354 type: array
4355 items:
4356 type: string
4357 x-kubernetes-list-type: atomic
4358 namespaceSelector:
4359 description: |-
4360 A label query over the set of namespaces that the term applies to.
4361 The term is applied to the union of the namespaces selected by this field
4362 and the ones listed in the namespaces field.
4363 null selector and null or empty namespaces list means "this pod's namespace".
4364 An empty selector ({}) matches all namespaces.
4365 type: object
4366 properties:
4367 matchExpressions:
4368 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
4369 type: array
4370 items:
4371 description: |-
4372 A label selector requirement is a selector that contains values, a key, and an operator that
4373 relates the key and values.
4374 type: object
4375 required:
4376 - key
4377 - operator
4378 properties:
4379 key:
4380 description: key is the label key that the selector applies to.
4381 type: string
4382 operator:
4383 description: |-
4384 operator represents a key's relationship to a set of values.
4385 Valid operators are In, NotIn, Exists and DoesNotExist.
4386 type: string
4387 values:
4388 description: |-
4389 values is an array of string values. If the operator is In or NotIn,
4390 the values array must be non-empty. If the operator is Exists or DoesNotExist,
4391 the values array must be empty. This array is replaced during a strategic
4392 merge patch.
4393 type: array
4394 items:
4395 type: string
4396 matchLabels:
4397 description: |-
4398 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
4399 map is equivalent to an element of matchExpressions, whose key field is "key", the
4400 operator is "In", and the values array contains only "value". The requirements are ANDed.
4401 type: object
4402 additionalProperties:
4403 type: string
4404 x-kubernetes-map-type: atomic
4405 namespaces:
4406 description: |-
4407 namespaces specifies a static list of namespace names that the term applies to.
4408 The term is applied to the union of the namespaces listed in this field
4409 and the ones selected by namespaceSelector.
4410 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
4411 type: array
4412 items:
4413 type: string
4414 topologyKey:
4415 description: |-
4416 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
4417 the labelSelector in the specified namespaces, where co-located is defined as running on a node
4418 whose value of the label with key topologyKey matches that of any node on which any of the
4419 selected pods is running.
4420 Empty topologyKey is not allowed.
4421 type: string
4422 imagePullSecrets:
4423 description: If specified, the pod's imagePullSecrets
4424 type: array
4425 items:
4426 description: |-
4427 LocalObjectReference contains enough information to let you locate the
4428 referenced object inside the same namespace.
4429 type: object
4430 properties:
4431 name:
4432 description: |-
4433 Name of the referent.
4434 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4435 type: string
4436 x-kubernetes-map-type: atomic
4437 nodeSelector:
4438 description: |-
4439 NodeSelector is a selector which must be true for the pod to fit on a node.
4440 Selector which must match a node's labels for the pod to be scheduled on that node.
4441 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
4442 type: object
4443 additionalProperties:
4444 type: string
4445 priorityClassName:
4446 description: If specified, the pod's priorityClassName.
4447 type: string
4448 serviceAccountName:
4449 description: If specified, the pod's service account
4450 type: string
4451 tolerations:
4452 description: If specified, the pod's tolerations.
4453 type: array
4454 items:
4455 description: |-
4456 The pod this Toleration is attached to tolerates any taint that matches
4457 the triple <key,value,effect> using the matching operator <operator>.
4458 type: object
4459 properties:
4460 effect:
4461 description: |-
4462 Effect indicates the taint effect to match. Empty means match all taint effects.
4463 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
4464 type: string
4465 key:
4466 description: |-
4467 Key is the taint key that the toleration applies to. Empty means match all taint keys.
4468 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
4469 type: string
4470 operator:
4471 description: |-
4472 Operator represents a key's relationship to the value.
4473 Valid operators are Exists and Equal. Defaults to Equal.
4474 Exists is equivalent to wildcard for value, so that a pod can
4475 tolerate all taints of a particular category.
4476 type: string
4477 tolerationSeconds:
4478 description: |-
4479 TolerationSeconds represents the period of time the toleration (which must be
4480 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
4481 it is not set, which means tolerate the taint forever (do not evict). Zero and
4482 negative values will be treated as 0 (evict immediately) by the system.
4483 type: integer
4484 format: int64
4485 value:
4486 description: |-
4487 Value is the taint value the toleration matches to.
4488 If the operator is Exists, the value should be empty, otherwise just a regular string.
4489 type: string
4490 serviceType:
4491 description: |-
4492 Optional service type for Kubernetes solver service. Supported values
4493 are NodePort or ClusterIP. If unset, defaults to NodePort.
4494 type: string
4495 selector:
4496 description: |-
4497 Selector selects a set of DNSNames on the Certificate resource that
4498 should be solved using this challenge solver.
4499 If not specified, the solver will be treated as the 'default' solver
4500 with the lowest priority, i.e. if any other solver has a more specific
4501 match, it will be used instead.
4502 type: object
4503 properties:
4504 dnsNames:
4505 description: |-
4506 List of DNSNames that this solver will be used to solve.
4507 If specified and a match is found, a dnsNames selector will take
4508 precedence over a dnsZones selector.
4509 If multiple solvers match with the same dnsNames value, the solver
4510 with the most matching labels in matchLabels will be selected.
4511 If neither has more matches, the solver defined earlier in the list
4512 will be selected.
4513 type: array
4514 items:
4515 type: string
4516 dnsZones:
4517 description: |-
4518 List of DNSZones that this solver will be used to solve.
4519 The most specific DNS zone match specified here will take precedence
4520 over other DNS zone matches, so a solver specifying sys.example.com
4521 will be selected over one specifying example.com for the domain
4522 www.sys.example.com.
4523 If multiple solvers match with the same dnsZones value, the solver
4524 with the most matching labels in matchLabels will be selected.
4525 If neither has more matches, the solver defined earlier in the list
4526 will be selected.
4527 type: array
4528 items:
4529 type: string
4530 matchLabels:
4531 description: |-
4532 A label selector that is used to refine the set of certificate's that
4533 this challenge solver will apply to.
4534 type: object
4535 additionalProperties:
4536 type: string
4537 ca:
4538 description: |-
4539 CA configures this issuer to sign certificates using a signing CA keypair
4540 stored in a Secret resource.
4541 This is used to build internal PKIs that are managed by cert-manager.
4542 type: object
4543 required:
4544 - secretName
4545 properties:
4546 crlDistributionPoints:
4547 description: |-
4548 The CRL distribution points is an X.509 v3 certificate extension which identifies
4549 the location of the CRL from which the revocation of this certificate can be checked.
4550 If not set, certificates will be issued without distribution points set.
4551 type: array
4552 items:
4553 type: string
4554 ocspServers:
4555 description: |-
4556 The OCSP server list is an X.509 v3 extension that defines a list of
4557 URLs of OCSP responders. The OCSP responders can be queried for the
4558 revocation status of an issued certificate. If not set, the
4559 certificate will be issued with no OCSP servers set. For example, an
4560 OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
4561 type: array
4562 items:
4563 type: string
4564 secretName:
4565 description: |-
4566 SecretName is the name of the secret used to sign Certificates issued
4567 by this Issuer.
4568 type: string
4569 selfSigned:
4570 description: |-
4571 SelfSigned configures this issuer to 'self sign' certificates using the
4572 private key used to create the CertificateRequest object.
4573 type: object
4574 properties:
4575 crlDistributionPoints:
4576 description: |-
4577 The CRL distribution points is an X.509 v3 certificate extension which identifies
4578 the location of the CRL from which the revocation of this certificate can be checked.
4579 If not set certificate will be issued without CDP. Values are strings.
4580 type: array
4581 items:
4582 type: string
4583 vault:
4584 description: |-
4585 Vault configures this issuer to sign certificates using a HashiCorp Vault
4586 PKI backend.
4587 type: object
4588 required:
4589 - auth
4590 - path
4591 - server
4592 properties:
4593 auth:
4594 description: Auth configures how cert-manager authenticates with the Vault server.
4595 type: object
4596 properties:
4597 appRole:
4598 description: |-
4599 AppRole authenticates with Vault using the App Role auth mechanism,
4600 with the role and secret stored in a Kubernetes Secret resource.
4601 type: object
4602 required:
4603 - path
4604 - roleId
4605 - secretRef
4606 properties:
4607 path:
4608 description: |-
4609 Path where the App Role authentication backend is mounted in Vault, e.g:
4610 "approle"
4611 type: string
4612 roleId:
4613 description: |-
4614 RoleID configured in the App Role authentication backend when setting
4615 up the authentication backend in Vault.
4616 type: string
4617 secretRef:
4618 description: |-
4619 Reference to a key in a Secret that contains the App Role secret used
4620 to authenticate with Vault.
4621 The `key` field must be specified and denotes which entry within the Secret
4622 resource is used as the app role secret.
4623 type: object
4624 required:
4625 - name
4626 properties:
4627 key:
4628 description: |-
4629 The key of the entry in the Secret resource's `data` field to be used.
4630 Some instances of this field may be defaulted, in others it may be
4631 required.
4632 type: string
4633 name:
4634 description: |-
4635 Name of the resource being referred to.
4636 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4637 type: string
4638 kubernetes:
4639 description: |-
4640 Kubernetes authenticates with Vault by passing the ServiceAccount
4641 token stored in the named Secret resource to the Vault server.
4642 type: object
4643 required:
4644 - role
4645 properties:
4646 mountPath:
4647 description: |-
4648 The Vault mountPath here is the mount path to use when authenticating with
4649 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
4650 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
4651 default value "/v1/auth/kubernetes" will be used.
4652 type: string
4653 role:
4654 description: |-
4655 A required field containing the Vault Role to assume. A Role binds a
4656 Kubernetes ServiceAccount with a set of Vault policies.
4657 type: string
4658 secretRef:
4659 description: |-
4660 The required Secret field containing a Kubernetes ServiceAccount JWT used
4661 for authenticating with Vault. Use of 'ambient credentials' is not
4662 supported.
4663 type: object
4664 required:
4665 - name
4666 properties:
4667 key:
4668 description: |-
4669 The key of the entry in the Secret resource's `data` field to be used.
4670 Some instances of this field may be defaulted, in others it may be
4671 required.
4672 type: string
4673 name:
4674 description: |-
4675 Name of the resource being referred to.
4676 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4677 type: string
4678 serviceAccountRef:
4679 description: |-
4680 A reference to a service account that will be used to request a bound
4681 token (also known as "projected token"). Compared to using "secretRef",
4682 using this field means that you don't rely on statically bound tokens. To
4683 use this field, you must configure an RBAC rule to let cert-manager
4684 request a token.
4685 type: object
4686 required:
4687 - name
4688 properties:
4689 name:
4690 description: Name of the ServiceAccount used to request a token.
4691 type: string
4692 tokenSecretRef:
4693 description: TokenSecretRef authenticates with Vault by presenting a token.
4694 type: object
4695 required:
4696 - name
4697 properties:
4698 key:
4699 description: |-
4700 The key of the entry in the Secret resource's `data` field to be used.
4701 Some instances of this field may be defaulted, in others it may be
4702 required.
4703 type: string
4704 name:
4705 description: |-
4706 Name of the resource being referred to.
4707 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4708 type: string
4709 caBundle:
4710 description: |-
4711 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
4712 chain presented by Vault. Only used if using HTTPS to connect to Vault and
4713 ignored for HTTP connections.
4714 Mutually exclusive with CABundleSecretRef.
4715 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
4716 the cert-manager controller container is used to validate the TLS connection.
4717 type: string
4718 format: byte
4719 caBundleSecretRef:
4720 description: |-
4721 Reference to a Secret containing a bundle of PEM-encoded CAs to use when
4722 verifying the certificate chain presented by Vault when using HTTPS.
4723 Mutually exclusive with CABundle.
4724 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
4725 the cert-manager controller container is used to validate the TLS connection.
4726 If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
4727 type: object
4728 required:
4729 - name
4730 properties:
4731 key:
4732 description: |-
4733 The key of the entry in the Secret resource's `data` field to be used.
4734 Some instances of this field may be defaulted, in others it may be
4735 required.
4736 type: string
4737 name:
4738 description: |-
4739 Name of the resource being referred to.
4740 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4741 type: string
4742 namespace:
4743 description: |-
4744 Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
4745 More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
4746 type: string
4747 path:
4748 description: |-
4749 Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
4750 "my_pki_mount/sign/my-role-name".
4751 type: string
4752 server:
4753 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
4754 type: string
4755 venafi:
4756 description: |-
4757 Venafi configures this issuer to sign certificates using a Venafi TPP
4758 or Venafi Cloud policy zone.
4759 type: object
4760 required:
4761 - zone
4762 properties:
4763 cloud:
4764 description: |-
4765 Cloud specifies the Venafi cloud configuration settings.
4766 Only one of TPP or Cloud may be specified.
4767 type: object
4768 required:
4769 - apiTokenSecretRef
4770 properties:
4771 apiTokenSecretRef:
4772 description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
4773 type: object
4774 required:
4775 - name
4776 properties:
4777 key:
4778 description: |-
4779 The key of the entry in the Secret resource's `data` field to be used.
4780 Some instances of this field may be defaulted, in others it may be
4781 required.
4782 type: string
4783 name:
4784 description: |-
4785 Name of the resource being referred to.
4786 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4787 type: string
4788 url:
4789 description: |-
4790 URL is the base URL for Venafi Cloud.
4791 Defaults to "https://api.venafi.cloud/v1".
4792 type: string
4793 tpp:
4794 description: |-
4795 TPP specifies Trust Protection Platform configuration settings.
4796 Only one of TPP or Cloud may be specified.
4797 type: object
4798 required:
4799 - credentialsRef
4800 - url
4801 properties:
4802 caBundle:
4803 description: |-
4804 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
4805 chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
4806 If undefined, the certificate bundle in the cert-manager controller container
4807 is used to validate the chain.
4808 type: string
4809 format: byte
4810 credentialsRef:
4811 description: |-
4812 CredentialsRef is a reference to a Secret containing the username and
4813 password for the TPP server.
4814 The secret must contain two keys, 'username' and 'password'.
4815 type: object
4816 required:
4817 - name
4818 properties:
4819 name:
4820 description: |-
4821 Name of the resource being referred to.
4822 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4823 type: string
4824 url:
4825 description: |-
4826 URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
4827 for example: "https://tpp.example.com/vedsdk".
4828 type: string
4829 zone:
4830 description: |-
4831 Zone is the Venafi Policy Zone to use for this issuer.
4832 All requests made to the Venafi platform will be restricted by the named
4833 zone policy.
4834 This field is required.
4835 type: string
4836 status:
4837 description: Status of the ClusterIssuer. This is set and managed automatically.
4838 type: object
4839 properties:
4840 acme:
4841 description: |-
4842 ACME specific status options.
4843 This field should only be set if the Issuer is configured to use an ACME
4844 server to issue certificates.
4845 type: object
4846 properties:
4847 lastPrivateKeyHash:
4848 description: |-
4849 LastPrivateKeyHash is a hash of the private key associated with the latest
4850 registered ACME account, in order to track changes made to registered account
4851 associated with the Issuer
4852 type: string
4853 lastRegisteredEmail:
4854 description: |-
4855 LastRegisteredEmail is the email associated with the latest registered
4856 ACME account, in order to track changes made to registered account
4857 associated with the Issuer
4858 type: string
4859 uri:
4860 description: |-
4861 URI is the unique account identifier, which can also be used to retrieve
4862 account details from the CA
4863 type: string
4864 conditions:
4865 description: |-
4866 List of status conditions to indicate the status of a CertificateRequest.
4867 Known condition types are `Ready`.
4868 type: array
4869 items:
4870 description: IssuerCondition contains condition information for an Issuer.
4871 type: object
4872 required:
4873 - status
4874 - type
4875 properties:
4876 lastTransitionTime:
4877 description: |-
4878 LastTransitionTime is the timestamp corresponding to the last status
4879 change of this condition.
4880 type: string
4881 format: date-time
4882 message:
4883 description: |-
4884 Message is a human readable description of the details of the last
4885 transition, complementing reason.
4886 type: string
4887 observedGeneration:
4888 description: |-
4889 If set, this represents the .metadata.generation that the condition was
4890 set based upon.
4891 For instance, if .metadata.generation is currently 12, but the
4892 .status.condition[x].observedGeneration is 9, the condition is out of date
4893 with respect to the current state of the Issuer.
4894 type: integer
4895 format: int64
4896 reason:
4897 description: |-
4898 Reason is a brief machine readable explanation for the condition's last
4899 transition.
4900 type: string
4901 status:
4902 description: Status of the condition, one of (`True`, `False`, `Unknown`).
4903 type: string
4904 enum:
4905 - "True"
4906 - "False"
4907 - Unknown
4908 type:
4909 description: Type of the condition, known values are (`Ready`).
4910 type: string
4911 x-kubernetes-list-map-keys:
4912 - type
4913 x-kubernetes-list-type: map
4914 served: true
4915 storage: true
4916---
4917apiVersion: apiextensions.k8s.io/v1
4918kind: CustomResourceDefinition
4919metadata:
4920 name: issuers.cert-manager.io
4921 labels:
4922 app: '{{ template "cert-manager.name" . }}'
4923 app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
4924 app.kubernetes.io/instance: "{{ .Release.Name }}"
4925 # Generated labels {{- include "labels" . | nindent 4 }}
4926spec:
4927 group: cert-manager.io
4928 names:
4929 kind: Issuer
4930 listKind: IssuerList
4931 plural: issuers
4932 singular: issuer
4933 categories:
4934 - cert-manager
4935 scope: Namespaced
4936 versions:
4937 - name: v1
4938 subresources:
4939 status: {}
4940 additionalPrinterColumns:
4941 - jsonPath: .status.conditions[?(@.type=="Ready")].status
4942 name: Ready
4943 type: string
4944 - jsonPath: .status.conditions[?(@.type=="Ready")].message
4945 name: Status
4946 priority: 1
4947 type: string
4948 - jsonPath: .metadata.creationTimestamp
4949 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
4950 name: Age
4951 type: date
4952 schema:
4953 openAPIV3Schema:
4954 description: |-
4955 An Issuer represents a certificate issuing authority which can be
4956 referenced as part of `issuerRef` fields.
4957 It is scoped to a single namespace and can therefore only be referenced by
4958 resources within the same namespace.
4959 type: object
4960 required:
4961 - spec
4962 properties:
4963 apiVersion:
4964 description: |-
4965 APIVersion defines the versioned schema of this representation of an object.
4966 Servers should convert recognized schemas to the latest internal value, and
4967 may reject unrecognized values.
4968 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
4969 type: string
4970 kind:
4971 description: |-
4972 Kind is a string value representing the REST resource this object represents.
4973 Servers may infer this from the endpoint the client submits requests to.
4974 Cannot be updated.
4975 In CamelCase.
4976 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
4977 type: string
4978 metadata:
4979 type: object
4980 spec:
4981 description: Desired state of the Issuer resource.
4982 type: object
4983 properties:
4984 acme:
4985 description: |-
4986 ACME configures this issuer to communicate with a RFC8555 (ACME) server
4987 to obtain signed x509 certificates.
4988 type: object
4989 required:
4990 - privateKeySecretRef
4991 - server
4992 properties:
4993 caBundle:
4994 description: |-
4995 Base64-encoded bundle of PEM CAs which can be used to validate the certificate
4996 chain presented by the ACME server.
4997 Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
4998 kinds of security vulnerabilities.
4999 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
5000 the container is used to validate the TLS connection.
5001 type: string
5002 format: byte
5003 disableAccountKeyGeneration:
5004 description: |-
5005 Enables or disables generating a new ACME account key.
5006 If true, the Issuer resource will *not* request a new account but will expect
5007 the account key to be supplied via an existing secret.
5008 If false, the cert-manager system will generate a new ACME account key
5009 for the Issuer.
5010 Defaults to false.
5011 type: boolean
5012 email:
5013 description: |-
5014 Email is the email address to be associated with the ACME account.
5015 This field is optional, but it is strongly recommended to be set.
5016 It will be used to contact you in case of issues with your account or
5017 certificates, including expiry notification emails.
5018 This field may be updated after the account is initially registered.
5019 type: string
5020 enableDurationFeature:
5021 description: |-
5022 Enables requesting a Not After date on certificates that matches the
5023 duration of the certificate. This is not supported by all ACME servers
5024 like Let's Encrypt. If set to true when the ACME server does not support
5025 it it will create an error on the Order.
5026 Defaults to false.
5027 type: boolean
5028 externalAccountBinding:
5029 description: |-
5030 ExternalAccountBinding is a reference to a CA external account of the ACME
5031 server.
5032 If set, upon registration cert-manager will attempt to associate the given
5033 external account credentials with the registered ACME account.
5034 type: object
5035 required:
5036 - keyID
5037 - keySecretRef
5038 properties:
5039 keyAlgorithm:
5040 description: |-
5041 Deprecated: keyAlgorithm field exists for historical compatibility
5042 reasons and should not be used. The algorithm is now hardcoded to HS256
5043 in golang/x/crypto/acme.
5044 type: string
5045 enum:
5046 - HS256
5047 - HS384
5048 - HS512
5049 keyID:
5050 description: keyID is the ID of the CA key that the External Account is bound to.
5051 type: string
5052 keySecretRef:
5053 description: |-
5054 keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
5055 Secret which holds the symmetric MAC key of the External Account Binding.
5056 The `key` is the index string that is paired with the key data in the
5057 Secret and should not be confused with the key data itself, or indeed with
5058 the External Account Binding keyID above.
5059 The secret key stored in the Secret **must** be un-padded, base64 URL
5060 encoded data.
5061 type: object
5062 required:
5063 - name
5064 properties:
5065 key:
5066 description: |-
5067 The key of the entry in the Secret resource's `data` field to be used.
5068 Some instances of this field may be defaulted, in others it may be
5069 required.
5070 type: string
5071 name:
5072 description: |-
5073 Name of the resource being referred to.
5074 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5075 type: string
5076 preferredChain:
5077 description: |-
5078 PreferredChain is the chain to use if the ACME server outputs multiple.
5079 PreferredChain is no guarantee that this one gets delivered by the ACME
5080 endpoint.
5081 For example, for Let's Encrypt's DST crosssign you would use:
5082 "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
5083 This value picks the first certificate bundle in the ACME alternative
5084 chains that has a certificate with this value as its issuer's CN
5085 type: string
5086 maxLength: 64
5087 privateKeySecretRef:
5088 description: |-
5089 PrivateKey is the name of a Kubernetes Secret resource that will be used to
5090 store the automatically generated ACME account private key.
5091 Optionally, a `key` may be specified to select a specific entry within
5092 the named Secret resource.
5093 If `key` is not specified, a default of `tls.key` will be used.
5094 type: object
5095 required:
5096 - name
5097 properties:
5098 key:
5099 description: |-
5100 The key of the entry in the Secret resource's `data` field to be used.
5101 Some instances of this field may be defaulted, in others it may be
5102 required.
5103 type: string
5104 name:
5105 description: |-
5106 Name of the resource being referred to.
5107 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5108 type: string
5109 server:
5110 description: |-
5111 Server is the URL used to access the ACME server's 'directory' endpoint.
5112 For example, for Let's Encrypt's staging endpoint, you would use:
5113 "https://acme-staging-v02.api.letsencrypt.org/directory".
5114 Only ACME v2 endpoints (i.e. RFC 8555) are supported.
5115 type: string
5116 skipTLSVerify:
5117 description: |-
5118 INSECURE: Enables or disables validation of the ACME server TLS certificate.
5119 If true, requests to the ACME server will not have the TLS certificate chain
5120 validated.
5121 Mutually exclusive with CABundle; prefer using CABundle to prevent various
5122 kinds of security vulnerabilities.
5123 Only enable this option in development environments.
5124 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
5125 the container is used to validate the TLS connection.
5126 Defaults to false.
5127 type: boolean
5128 solvers:
5129 description: |-
5130 Solvers is a list of challenge solvers that will be used to solve
5131 ACME challenges for the matching domains.
5132 Solver configurations must be provided in order to obtain certificates
5133 from an ACME server.
5134 For more information, see: https://cert-manager.io/docs/configuration/acme/
5135 type: array
5136 items:
5137 description: |-
5138 An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
5139 A selector may be provided to use different solving strategies for different DNS names.
5140 Only one of HTTP01 or DNS01 must be provided.
5141 type: object
5142 properties:
5143 dns01:
5144 description: |-
5145 Configures cert-manager to attempt to complete authorizations by
5146 performing the DNS01 challenge flow.
5147 type: object
5148 properties:
5149 acmeDNS:
5150 description: |-
5151 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
5152 DNS01 challenge records.
5153 type: object
5154 required:
5155 - accountSecretRef
5156 - host
5157 properties:
5158 accountSecretRef:
5159 description: |-
5160 A reference to a specific 'key' within a Secret resource.
5161 In some instances, `key` is a required field.
5162 type: object
5163 required:
5164 - name
5165 properties:
5166 key:
5167 description: |-
5168 The key of the entry in the Secret resource's `data` field to be used.
5169 Some instances of this field may be defaulted, in others it may be
5170 required.
5171 type: string
5172 name:
5173 description: |-
5174 Name of the resource being referred to.
5175 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5176 type: string
5177 host:
5178 type: string
5179 akamai:
5180 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
5181 type: object
5182 required:
5183 - accessTokenSecretRef
5184 - clientSecretSecretRef
5185 - clientTokenSecretRef
5186 - serviceConsumerDomain
5187 properties:
5188 accessTokenSecretRef:
5189 description: |-
5190 A reference to a specific 'key' within a Secret resource.
5191 In some instances, `key` is a required field.
5192 type: object
5193 required:
5194 - name
5195 properties:
5196 key:
5197 description: |-
5198 The key of the entry in the Secret resource's `data` field to be used.
5199 Some instances of this field may be defaulted, in others it may be
5200 required.
5201 type: string
5202 name:
5203 description: |-
5204 Name of the resource being referred to.
5205 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5206 type: string
5207 clientSecretSecretRef:
5208 description: |-
5209 A reference to a specific 'key' within a Secret resource.
5210 In some instances, `key` is a required field.
5211 type: object
5212 required:
5213 - name
5214 properties:
5215 key:
5216 description: |-
5217 The key of the entry in the Secret resource's `data` field to be used.
5218 Some instances of this field may be defaulted, in others it may be
5219 required.
5220 type: string
5221 name:
5222 description: |-
5223 Name of the resource being referred to.
5224 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5225 type: string
5226 clientTokenSecretRef:
5227 description: |-
5228 A reference to a specific 'key' within a Secret resource.
5229 In some instances, `key` is a required field.
5230 type: object
5231 required:
5232 - name
5233 properties:
5234 key:
5235 description: |-
5236 The key of the entry in the Secret resource's `data` field to be used.
5237 Some instances of this field may be defaulted, in others it may be
5238 required.
5239 type: string
5240 name:
5241 description: |-
5242 Name of the resource being referred to.
5243 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5244 type: string
5245 serviceConsumerDomain:
5246 type: string
5247 azureDNS:
5248 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
5249 type: object
5250 required:
5251 - resourceGroupName
5252 - subscriptionID
5253 properties:
5254 clientID:
5255 description: if both this and ClientSecret are left unset MSI will be used
5256 type: string
5257 clientSecretSecretRef:
5258 description: if both this and ClientID are left unset MSI will be used
5259 type: object
5260 required:
5261 - name
5262 properties:
5263 key:
5264 description: |-
5265 The key of the entry in the Secret resource's `data` field to be used.
5266 Some instances of this field may be defaulted, in others it may be
5267 required.
5268 type: string
5269 name:
5270 description: |-
5271 Name of the resource being referred to.
5272 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5273 type: string
5274 environment:
5275 description: name of the Azure environment (default AzurePublicCloud)
5276 type: string
5277 enum:
5278 - AzurePublicCloud
5279 - AzureChinaCloud
5280 - AzureGermanCloud
5281 - AzureUSGovernmentCloud
5282 hostedZoneName:
5283 description: name of the DNS zone that should be used
5284 type: string
5285 managedIdentity:
5286 description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID
5287 type: object
5288 properties:
5289 clientID:
5290 description: client ID of the managed identity, can not be used at the same time as resourceID
5291 type: string
5292 resourceID:
5293 description: resource ID of the managed identity, can not be used at the same time as clientID
5294 type: string
5295 resourceGroupName:
5296 description: resource group the DNS zone is located in
5297 type: string
5298 subscriptionID:
5299 description: ID of the Azure subscription
5300 type: string
5301 tenantID:
5302 description: when specifying ClientID and ClientSecret then this field is also needed
5303 type: string
5304 cloudDNS:
5305 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
5306 type: object
5307 required:
5308 - project
5309 properties:
5310 hostedZoneName:
5311 description: |-
5312 HostedZoneName is an optional field that tells cert-manager in which
5313 Cloud DNS zone the challenge record has to be created.
5314 If left empty cert-manager will automatically choose a zone.
5315 type: string
5316 project:
5317 type: string
5318 serviceAccountSecretRef:
5319 description: |-
5320 A reference to a specific 'key' within a Secret resource.
5321 In some instances, `key` is a required field.
5322 type: object
5323 required:
5324 - name
5325 properties:
5326 key:
5327 description: |-
5328 The key of the entry in the Secret resource's `data` field to be used.
5329 Some instances of this field may be defaulted, in others it may be
5330 required.
5331 type: string
5332 name:
5333 description: |-
5334 Name of the resource being referred to.
5335 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5336 type: string
5337 cloudflare:
5338 description: Use the Cloudflare API to manage DNS01 challenge records.
5339 type: object
5340 properties:
5341 apiKeySecretRef:
5342 description: |-
5343 API key to use to authenticate with Cloudflare.
5344 Note: using an API token to authenticate is now the recommended method
5345 as it allows greater control of permissions.
5346 type: object
5347 required:
5348 - name
5349 properties:
5350 key:
5351 description: |-
5352 The key of the entry in the Secret resource's `data` field to be used.
5353 Some instances of this field may be defaulted, in others it may be
5354 required.
5355 type: string
5356 name:
5357 description: |-
5358 Name of the resource being referred to.
5359 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5360 type: string
5361 apiTokenSecretRef:
5362 description: API token used to authenticate with Cloudflare.
5363 type: object
5364 required:
5365 - name
5366 properties:
5367 key:
5368 description: |-
5369 The key of the entry in the Secret resource's `data` field to be used.
5370 Some instances of this field may be defaulted, in others it may be
5371 required.
5372 type: string
5373 name:
5374 description: |-
5375 Name of the resource being referred to.
5376 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5377 type: string
5378 email:
5379 description: Email of the account, only required when using API key based authentication.
5380 type: string
5381 cnameStrategy:
5382 description: |-
5383 CNAMEStrategy configures how the DNS01 provider should handle CNAME
5384 records when found in DNS zones.
5385 type: string
5386 enum:
5387 - None
5388 - Follow
5389 digitalocean:
5390 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
5391 type: object
5392 required:
5393 - tokenSecretRef
5394 properties:
5395 tokenSecretRef:
5396 description: |-
5397 A reference to a specific 'key' within a Secret resource.
5398 In some instances, `key` is a required field.
5399 type: object
5400 required:
5401 - name
5402 properties:
5403 key:
5404 description: |-
5405 The key of the entry in the Secret resource's `data` field to be used.
5406 Some instances of this field may be defaulted, in others it may be
5407 required.
5408 type: string
5409 name:
5410 description: |-
5411 Name of the resource being referred to.
5412 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5413 type: string
5414 rfc2136:
5415 description: |-
5416 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
5417 to manage DNS01 challenge records.
5418 type: object
5419 required:
5420 - nameserver
5421 properties:
5422 nameserver:
5423 description: |-
5424 The IP address or hostname of an authoritative DNS server supporting
5425 RFC2136 in the form host:port. If the host is an IPv6 address it must be
5426 enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
5427 This field is required.
5428 type: string
5429 tsigAlgorithm:
5430 description: |-
5431 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
5432 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
5433 Supported values are (case-insensitive): ``HMACMD5`` (default),
5434 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
5435 type: string
5436 tsigKeyName:
5437 description: |-
5438 The TSIG Key name configured in the DNS.
5439 If ``tsigSecretSecretRef`` is defined, this field is required.
5440 type: string
5441 tsigSecretSecretRef:
5442 description: |-
5443 The name of the secret containing the TSIG value.
5444 If ``tsigKeyName`` is defined, this field is required.
5445 type: object
5446 required:
5447 - name
5448 properties:
5449 key:
5450 description: |-
5451 The key of the entry in the Secret resource's `data` field to be used.
5452 Some instances of this field may be defaulted, in others it may be
5453 required.
5454 type: string
5455 name:
5456 description: |-
5457 Name of the resource being referred to.
5458 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5459 type: string
5460 route53:
5461 description: Use the AWS Route53 API to manage DNS01 challenge records.
5462 type: object
5463 required:
5464 - region
5465 properties:
5466 accessKeyID:
5467 description: |-
5468 The AccessKeyID is used for authentication.
5469 Cannot be set when SecretAccessKeyID is set.
5470 If neither the Access Key nor Key ID are set, we fall-back to using env
5471 vars, shared credentials file or AWS Instance metadata,
5472 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
5473 type: string
5474 accessKeyIDSecretRef:
5475 description: |-
5476 The SecretAccessKey is used for authentication. If set, pull the AWS
5477 access key ID from a key within a Kubernetes Secret.
5478 Cannot be set when AccessKeyID is set.
5479 If neither the Access Key nor Key ID are set, we fall-back to using env
5480 vars, shared credentials file or AWS Instance metadata,
5481 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
5482 type: object
5483 required:
5484 - name
5485 properties:
5486 key:
5487 description: |-
5488 The key of the entry in the Secret resource's `data` field to be used.
5489 Some instances of this field may be defaulted, in others it may be
5490 required.
5491 type: string
5492 name:
5493 description: |-
5494 Name of the resource being referred to.
5495 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5496 type: string
5497 hostedZoneID:
5498 description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
5499 type: string
5500 region:
5501 description: Always set the region when using AccessKeyID and SecretAccessKey
5502 type: string
5503 role:
5504 description: |-
5505 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
5506 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
5507 type: string
5508 secretAccessKeySecretRef:
5509 description: |-
5510 The SecretAccessKey is used for authentication.
5511 If neither the Access Key nor Key ID are set, we fall-back to using env
5512 vars, shared credentials file or AWS Instance metadata,
5513 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
5514 type: object
5515 required:
5516 - name
5517 properties:
5518 key:
5519 description: |-
5520 The key of the entry in the Secret resource's `data` field to be used.
5521 Some instances of this field may be defaulted, in others it may be
5522 required.
5523 type: string
5524 name:
5525 description: |-
5526 Name of the resource being referred to.
5527 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5528 type: string
5529 webhook:
5530 description: |-
5531 Configure an external webhook based DNS01 challenge solver to manage
5532 DNS01 challenge records.
5533 type: object
5534 required:
5535 - groupName
5536 - solverName
5537 properties:
5538 config:
5539 description: |-
5540 Additional configuration that should be passed to the webhook apiserver
5541 when challenges are processed.
5542 This can contain arbitrary JSON data.
5543 Secret values should not be specified in this stanza.
5544 If secret values are needed (e.g. credentials for a DNS service), you
5545 should use a SecretKeySelector to reference a Secret resource.
5546 For details on the schema of this field, consult the webhook provider
5547 implementation's documentation.
5548 x-kubernetes-preserve-unknown-fields: true
5549 groupName:
5550 description: |-
5551 The API group name that should be used when POSTing ChallengePayload
5552 resources to the webhook apiserver.
5553 This should be the same as the GroupName specified in the webhook
5554 provider implementation.
5555 type: string
5556 solverName:
5557 description: |-
5558 The name of the solver to use, as defined in the webhook provider
5559 implementation.
5560 This will typically be the name of the provider, e.g. 'cloudflare'.
5561 type: string
5562 http01:
5563 description: |-
5564 Configures cert-manager to attempt to complete authorizations by
5565 performing the HTTP01 challenge flow.
5566 It is not possible to obtain certificates for wildcard domain names
5567 (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
5568 type: object
5569 properties:
5570 gatewayHTTPRoute:
5571 description: |-
5572 The Gateway API is a sig-network community API that models service networking
5573 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
5574 create HTTPRoutes with the specified labels in the same namespace as the challenge.
5575 This solver is experimental, and fields / behaviour may change in the future.
5576 type: object
5577 properties:
5578 labels:
5579 description: |-
5580 Custom labels that will be applied to HTTPRoutes created by cert-manager
5581 while solving HTTP-01 challenges.
5582 type: object
5583 additionalProperties:
5584 type: string
5585 parentRefs:
5586 description: |-
5587 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
5588 cert-manager needs to know which parentRefs should be used when creating
5589 the HTTPRoute. Usually, the parentRef references a Gateway. See:
5590 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
5591 type: array
5592 items:
5593 description: |-
5594 ParentReference identifies an API object (usually a Gateway) that can be considered
5595 a parent of this resource (usually a route). The only kind of parent resource
5596 with "Core" support is Gateway. This API may be extended in the future to
5597 support additional kinds of parent resources, such as HTTPRoute.
5598
5599 The API object must be valid in the cluster; the Group and Kind must
5600 be registered in the cluster for this reference to be valid.
5601 type: object
5602 required:
5603 - name
5604 properties:
5605 group:
5606 description: |-
5607 Group is the group of the referent.
5608 When unspecified, "gateway.networking.k8s.io" is inferred.
5609 To set the core API group (such as for a "Service" kind referent),
5610 Group must be explicitly set to "" (empty string).
5611
5612 Support: Core
5613 type: string
5614 default: gateway.networking.k8s.io
5615 maxLength: 253
5616 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
5617 kind:
5618 description: |-
5619 Kind is kind of the referent.
5620
5621 Support: Core (Gateway)
5622
5623 Support: Implementation-specific (Other Resources)
5624 type: string
5625 default: Gateway
5626 maxLength: 63
5627 minLength: 1
5628 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
5629 name:
5630 description: |-
5631 Name is the name of the referent.
5632
5633 Support: Core
5634 type: string
5635 maxLength: 253
5636 minLength: 1
5637 namespace:
5638 description: |-
5639 Namespace is the namespace of the referent. When unspecified, this refers
5640 to the local namespace of the Route.
5641
5642 Note that there are specific rules for ParentRefs which cross namespace
5643 boundaries. Cross-namespace references are only valid if they are explicitly
5644 allowed by something in the namespace they are referring to. For example:
5645 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
5646 generic way to enable any other kind of cross-namespace reference.
5647
5648 Support: Core
5649 type: string
5650 maxLength: 63
5651 minLength: 1
5652 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
5653 port:
5654 description: |-
5655 Port is the network port this Route targets. It can be interpreted
5656 differently based on the type of parent resource.
5657
5658 When the parent resource is a Gateway, this targets all listeners
5659 listening on the specified port that also support this kind of Route(and
5660 select this Route). It's not recommended to set `Port` unless the
5661 networking behaviors specified in a Route must apply to a specific port
5662 as opposed to a listener(s) whose port(s) may be changed. When both Port
5663 and SectionName are specified, the name and port of the selected listener
5664 must match both specified values.
5665
5666 Implementations MAY choose to support other parent resources.
5667 Implementations supporting other types of parent resources MUST clearly
5668 document how/if Port is interpreted.
5669
5670 For the purpose of status, an attachment is considered successful as
5671 long as the parent resource accepts it partially. For example, Gateway
5672 listeners can restrict which Routes can attach to them by Route kind,
5673 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
5674 from the referencing Route, the Route MUST be considered successfully
5675 attached. If no Gateway listeners accept attachment from this Route,
5676 the Route MUST be considered detached from the Gateway.
5677
5678 Support: Extended
5679
5680 <gateway:experimental>
5681 type: integer
5682 format: int32
5683 maximum: 65535
5684 minimum: 1
5685 sectionName:
5686 description: |-
5687 SectionName is the name of a section within the target resource. In the
5688 following resources, SectionName is interpreted as the following:
5689
5690 * Gateway: Listener Name. When both Port (experimental) and SectionName
5691 are specified, the name and port of the selected listener must match
5692 both specified values.
5693
5694 Implementations MAY choose to support attaching Routes to other resources.
5695 If that is the case, they MUST clearly document how SectionName is
5696 interpreted.
5697
5698 When unspecified (empty string), this will reference the entire resource.
5699 For the purpose of status, an attachment is considered successful if at
5700 least one section in the parent resource accepts it. For example, Gateway
5701 listeners can restrict which Routes can attach to them by Route kind,
5702 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
5703 the referencing Route, the Route MUST be considered successfully
5704 attached. If no Gateway listeners accept attachment from this Route, the
5705 Route MUST be considered detached from the Gateway.
5706
5707 Support: Core
5708 type: string
5709 maxLength: 253
5710 minLength: 1
5711 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
5712 serviceType:
5713 description: |-
5714 Optional service type for Kubernetes solver service. Supported values
5715 are NodePort or ClusterIP. If unset, defaults to NodePort.
5716 type: string
5717 ingress:
5718 description: |-
5719 The ingress based HTTP01 challenge solver will solve challenges by
5720 creating or modifying Ingress resources in order to route requests for
5721 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
5722 provisioned by cert-manager for each Challenge to be completed.
5723 type: object
5724 properties:
5725 class:
5726 description: |-
5727 This field configures the annotation `kubernetes.io/ingress.class` when
5728 creating Ingress resources to solve ACME challenges that use this
5729 challenge solver. Only one of `class`, `name` or `ingressClassName` may
5730 be specified.
5731 type: string
5732 ingressClassName:
5733 description: |-
5734 This field configures the field `ingressClassName` on the created Ingress
5735 resources used to solve ACME challenges that use this challenge solver.
5736 This is the recommended way of configuring the ingress class. Only one of
5737 `class`, `name` or `ingressClassName` may be specified.
5738 type: string
5739 ingressTemplate:
5740 description: |-
5741 Optional ingress template used to configure the ACME challenge solver
5742 ingress used for HTTP01 challenges.
5743 type: object
5744 properties:
5745 metadata:
5746 description: |-
5747 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
5748 Only the 'labels' and 'annotations' fields may be set.
5749 If labels or annotations overlap with in-built values, the values here
5750 will override the in-built values.
5751 type: object
5752 properties:
5753 annotations:
5754 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
5755 type: object
5756 additionalProperties:
5757 type: string
5758 labels:
5759 description: Labels that should be added to the created ACME HTTP01 solver ingress.
5760 type: object
5761 additionalProperties:
5762 type: string
5763 name:
5764 description: |-
5765 The name of the ingress resource that should have ACME challenge solving
5766 routes inserted into it in order to solve HTTP01 challenges.
5767 This is typically used in conjunction with ingress controllers like
5768 ingress-gce, which maintains a 1:1 mapping between external IPs and
5769 ingress resources. Only one of `class`, `name` or `ingressClassName` may
5770 be specified.
5771 type: string
5772 podTemplate:
5773 description: |-
5774 Optional pod template used to configure the ACME challenge solver pods
5775 used for HTTP01 challenges.
5776 type: object
5777 properties:
5778 metadata:
5779 description: |-
5780 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
5781 Only the 'labels' and 'annotations' fields may be set.
5782 If labels or annotations overlap with in-built values, the values here
5783 will override the in-built values.
5784 type: object
5785 properties:
5786 annotations:
5787 description: Annotations that should be added to the create ACME HTTP01 solver pods.
5788 type: object
5789 additionalProperties:
5790 type: string
5791 labels:
5792 description: Labels that should be added to the created ACME HTTP01 solver pods.
5793 type: object
5794 additionalProperties:
5795 type: string
5796 spec:
5797 description: |-
5798 PodSpec defines overrides for the HTTP01 challenge solver pod.
5799 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
5800 All other fields will be ignored.
5801 type: object
5802 properties:
5803 affinity:
5804 description: If specified, the pod's scheduling constraints
5805 type: object
5806 properties:
5807 nodeAffinity:
5808 description: Describes node affinity scheduling rules for the pod.
5809 type: object
5810 properties:
5811 preferredDuringSchedulingIgnoredDuringExecution:
5812 description: |-
5813 The scheduler will prefer to schedule pods to nodes that satisfy
5814 the affinity expressions specified by this field, but it may choose
5815 a node that violates one or more of the expressions. The node that is
5816 most preferred is the one with the greatest sum of weights, i.e.
5817 for each node that meets all of the scheduling requirements (resource
5818 request, requiredDuringScheduling affinity expressions, etc.),
5819 compute a sum by iterating through the elements of this field and adding
5820 "weight" to the sum if the node matches the corresponding matchExpressions; the
5821 node(s) with the highest sum are the most preferred.
5822 type: array
5823 items:
5824 description: |-
5825 An empty preferred scheduling term matches all objects with implicit weight 0
5826 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
5827 type: object
5828 required:
5829 - preference
5830 - weight
5831 properties:
5832 preference:
5833 description: A node selector term, associated with the corresponding weight.
5834 type: object
5835 properties:
5836 matchExpressions:
5837 description: A list of node selector requirements by node's labels.
5838 type: array
5839 items:
5840 description: |-
5841 A node selector requirement is a selector that contains values, a key, and an operator
5842 that relates the key and values.
5843 type: object
5844 required:
5845 - key
5846 - operator
5847 properties:
5848 key:
5849 description: The label key that the selector applies to.
5850 type: string
5851 operator:
5852 description: |-
5853 Represents a key's relationship to a set of values.
5854 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
5855 type: string
5856 values:
5857 description: |-
5858 An array of string values. If the operator is In or NotIn,
5859 the values array must be non-empty. If the operator is Exists or DoesNotExist,
5860 the values array must be empty. If the operator is Gt or Lt, the values
5861 array must have a single element, which will be interpreted as an integer.
5862 This array is replaced during a strategic merge patch.
5863 type: array
5864 items:
5865 type: string
5866 matchFields:
5867 description: A list of node selector requirements by node's fields.
5868 type: array
5869 items:
5870 description: |-
5871 A node selector requirement is a selector that contains values, a key, and an operator
5872 that relates the key and values.
5873 type: object
5874 required:
5875 - key
5876 - operator
5877 properties:
5878 key:
5879 description: The label key that the selector applies to.
5880 type: string
5881 operator:
5882 description: |-
5883 Represents a key's relationship to a set of values.
5884 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
5885 type: string
5886 values:
5887 description: |-
5888 An array of string values. If the operator is In or NotIn,
5889 the values array must be non-empty. If the operator is Exists or DoesNotExist,
5890 the values array must be empty. If the operator is Gt or Lt, the values
5891 array must have a single element, which will be interpreted as an integer.
5892 This array is replaced during a strategic merge patch.
5893 type: array
5894 items:
5895 type: string
5896 x-kubernetes-map-type: atomic
5897 weight:
5898 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
5899 type: integer
5900 format: int32
5901 requiredDuringSchedulingIgnoredDuringExecution:
5902 description: |-
5903 If the affinity requirements specified by this field are not met at
5904 scheduling time, the pod will not be scheduled onto the node.
5905 If the affinity requirements specified by this field cease to be met
5906 at some point during pod execution (e.g. due to an update), the system
5907 may or may not try to eventually evict the pod from its node.
5908 type: object
5909 required:
5910 - nodeSelectorTerms
5911 properties:
5912 nodeSelectorTerms:
5913 description: Required. A list of node selector terms. The terms are ORed.
5914 type: array
5915 items:
5916 description: |-
5917 A null or empty node selector term matches no objects. The requirements of
5918 them are ANDed.
5919 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
5920 type: object
5921 properties:
5922 matchExpressions:
5923 description: A list of node selector requirements by node's labels.
5924 type: array
5925 items:
5926 description: |-
5927 A node selector requirement is a selector that contains values, a key, and an operator
5928 that relates the key and values.
5929 type: object
5930 required:
5931 - key
5932 - operator
5933 properties:
5934 key:
5935 description: The label key that the selector applies to.
5936 type: string
5937 operator:
5938 description: |-
5939 Represents a key's relationship to a set of values.
5940 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
5941 type: string
5942 values:
5943 description: |-
5944 An array of string values. If the operator is In or NotIn,
5945 the values array must be non-empty. If the operator is Exists or DoesNotExist,
5946 the values array must be empty. If the operator is Gt or Lt, the values
5947 array must have a single element, which will be interpreted as an integer.
5948 This array is replaced during a strategic merge patch.
5949 type: array
5950 items:
5951 type: string
5952 matchFields:
5953 description: A list of node selector requirements by node's fields.
5954 type: array
5955 items:
5956 description: |-
5957 A node selector requirement is a selector that contains values, a key, and an operator
5958 that relates the key and values.
5959 type: object
5960 required:
5961 - key
5962 - operator
5963 properties:
5964 key:
5965 description: The label key that the selector applies to.
5966 type: string
5967 operator:
5968 description: |-
5969 Represents a key's relationship to a set of values.
5970 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
5971 type: string
5972 values:
5973 description: |-
5974 An array of string values. If the operator is In or NotIn,
5975 the values array must be non-empty. If the operator is Exists or DoesNotExist,
5976 the values array must be empty. If the operator is Gt or Lt, the values
5977 array must have a single element, which will be interpreted as an integer.
5978 This array is replaced during a strategic merge patch.
5979 type: array
5980 items:
5981 type: string
5982 x-kubernetes-map-type: atomic
5983 x-kubernetes-map-type: atomic
5984 podAffinity:
5985 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
5986 type: object
5987 properties:
5988 preferredDuringSchedulingIgnoredDuringExecution:
5989 description: |-
5990 The scheduler will prefer to schedule pods to nodes that satisfy
5991 the affinity expressions specified by this field, but it may choose
5992 a node that violates one or more of the expressions. The node that is
5993 most preferred is the one with the greatest sum of weights, i.e.
5994 for each node that meets all of the scheduling requirements (resource
5995 request, requiredDuringScheduling affinity expressions, etc.),
5996 compute a sum by iterating through the elements of this field and adding
5997 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
5998 node(s) with the highest sum are the most preferred.
5999 type: array
6000 items:
6001 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
6002 type: object
6003 required:
6004 - podAffinityTerm
6005 - weight
6006 properties:
6007 podAffinityTerm:
6008 description: Required. A pod affinity term, associated with the corresponding weight.
6009 type: object
6010 required:
6011 - topologyKey
6012 properties:
6013 labelSelector:
6014 description: |-
6015 A label query over a set of resources, in this case pods.
6016 If it's null, this PodAffinityTerm matches with no Pods.
6017 type: object
6018 properties:
6019 matchExpressions:
6020 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6021 type: array
6022 items:
6023 description: |-
6024 A label selector requirement is a selector that contains values, a key, and an operator that
6025 relates the key and values.
6026 type: object
6027 required:
6028 - key
6029 - operator
6030 properties:
6031 key:
6032 description: key is the label key that the selector applies to.
6033 type: string
6034 operator:
6035 description: |-
6036 operator represents a key's relationship to a set of values.
6037 Valid operators are In, NotIn, Exists and DoesNotExist.
6038 type: string
6039 values:
6040 description: |-
6041 values is an array of string values. If the operator is In or NotIn,
6042 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6043 the values array must be empty. This array is replaced during a strategic
6044 merge patch.
6045 type: array
6046 items:
6047 type: string
6048 matchLabels:
6049 description: |-
6050 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6051 map is equivalent to an element of matchExpressions, whose key field is "key", the
6052 operator is "In", and the values array contains only "value". The requirements are ANDed.
6053 type: object
6054 additionalProperties:
6055 type: string
6056 x-kubernetes-map-type: atomic
6057 matchLabelKeys:
6058 description: |-
6059 MatchLabelKeys is a set of pod label keys to select which pods will
6060 be taken into consideration. The keys are used to lookup values from the
6061 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
6062 to select the group of existing pods which pods will be taken into consideration
6063 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6064 pod labels will be ignored. The default value is empty.
6065 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
6066 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
6067 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6068 type: array
6069 items:
6070 type: string
6071 x-kubernetes-list-type: atomic
6072 mismatchLabelKeys:
6073 description: |-
6074 MismatchLabelKeys is a set of pod label keys to select which pods will
6075 be taken into consideration. The keys are used to lookup values from the
6076 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
6077 to select the group of existing pods which pods will be taken into consideration
6078 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6079 pod labels will be ignored. The default value is empty.
6080 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
6081 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
6082 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6083 type: array
6084 items:
6085 type: string
6086 x-kubernetes-list-type: atomic
6087 namespaceSelector:
6088 description: |-
6089 A label query over the set of namespaces that the term applies to.
6090 The term is applied to the union of the namespaces selected by this field
6091 and the ones listed in the namespaces field.
6092 null selector and null or empty namespaces list means "this pod's namespace".
6093 An empty selector ({}) matches all namespaces.
6094 type: object
6095 properties:
6096 matchExpressions:
6097 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6098 type: array
6099 items:
6100 description: |-
6101 A label selector requirement is a selector that contains values, a key, and an operator that
6102 relates the key and values.
6103 type: object
6104 required:
6105 - key
6106 - operator
6107 properties:
6108 key:
6109 description: key is the label key that the selector applies to.
6110 type: string
6111 operator:
6112 description: |-
6113 operator represents a key's relationship to a set of values.
6114 Valid operators are In, NotIn, Exists and DoesNotExist.
6115 type: string
6116 values:
6117 description: |-
6118 values is an array of string values. If the operator is In or NotIn,
6119 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6120 the values array must be empty. This array is replaced during a strategic
6121 merge patch.
6122 type: array
6123 items:
6124 type: string
6125 matchLabels:
6126 description: |-
6127 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6128 map is equivalent to an element of matchExpressions, whose key field is "key", the
6129 operator is "In", and the values array contains only "value". The requirements are ANDed.
6130 type: object
6131 additionalProperties:
6132 type: string
6133 x-kubernetes-map-type: atomic
6134 namespaces:
6135 description: |-
6136 namespaces specifies a static list of namespace names that the term applies to.
6137 The term is applied to the union of the namespaces listed in this field
6138 and the ones selected by namespaceSelector.
6139 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
6140 type: array
6141 items:
6142 type: string
6143 topologyKey:
6144 description: |-
6145 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
6146 the labelSelector in the specified namespaces, where co-located is defined as running on a node
6147 whose value of the label with key topologyKey matches that of any node on which any of the
6148 selected pods is running.
6149 Empty topologyKey is not allowed.
6150 type: string
6151 weight:
6152 description: |-
6153 weight associated with matching the corresponding podAffinityTerm,
6154 in the range 1-100.
6155 type: integer
6156 format: int32
6157 requiredDuringSchedulingIgnoredDuringExecution:
6158 description: |-
6159 If the affinity requirements specified by this field are not met at
6160 scheduling time, the pod will not be scheduled onto the node.
6161 If the affinity requirements specified by this field cease to be met
6162 at some point during pod execution (e.g. due to a pod label update), the
6163 system may or may not try to eventually evict the pod from its node.
6164 When there are multiple elements, the lists of nodes corresponding to each
6165 podAffinityTerm are intersected, i.e. all terms must be satisfied.
6166 type: array
6167 items:
6168 description: |-
6169 Defines a set of pods (namely those matching the labelSelector
6170 relative to the given namespace(s)) that this pod should be
6171 co-located (affinity) or not co-located (anti-affinity) with,
6172 where co-located is defined as running on a node whose value of
6173 the label with key <topologyKey> matches that of any node on which
6174 a pod of the set of pods is running
6175 type: object
6176 required:
6177 - topologyKey
6178 properties:
6179 labelSelector:
6180 description: |-
6181 A label query over a set of resources, in this case pods.
6182 If it's null, this PodAffinityTerm matches with no Pods.
6183 type: object
6184 properties:
6185 matchExpressions:
6186 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6187 type: array
6188 items:
6189 description: |-
6190 A label selector requirement is a selector that contains values, a key, and an operator that
6191 relates the key and values.
6192 type: object
6193 required:
6194 - key
6195 - operator
6196 properties:
6197 key:
6198 description: key is the label key that the selector applies to.
6199 type: string
6200 operator:
6201 description: |-
6202 operator represents a key's relationship to a set of values.
6203 Valid operators are In, NotIn, Exists and DoesNotExist.
6204 type: string
6205 values:
6206 description: |-
6207 values is an array of string values. If the operator is In or NotIn,
6208 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6209 the values array must be empty. This array is replaced during a strategic
6210 merge patch.
6211 type: array
6212 items:
6213 type: string
6214 matchLabels:
6215 description: |-
6216 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6217 map is equivalent to an element of matchExpressions, whose key field is "key", the
6218 operator is "In", and the values array contains only "value". The requirements are ANDed.
6219 type: object
6220 additionalProperties:
6221 type: string
6222 x-kubernetes-map-type: atomic
6223 matchLabelKeys:
6224 description: |-
6225 MatchLabelKeys is a set of pod label keys to select which pods will
6226 be taken into consideration. The keys are used to lookup values from the
6227 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
6228 to select the group of existing pods which pods will be taken into consideration
6229 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6230 pod labels will be ignored. The default value is empty.
6231 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
6232 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
6233 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6234 type: array
6235 items:
6236 type: string
6237 x-kubernetes-list-type: atomic
6238 mismatchLabelKeys:
6239 description: |-
6240 MismatchLabelKeys is a set of pod label keys to select which pods will
6241 be taken into consideration. The keys are used to lookup values from the
6242 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
6243 to select the group of existing pods which pods will be taken into consideration
6244 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6245 pod labels will be ignored. The default value is empty.
6246 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
6247 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
6248 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6249 type: array
6250 items:
6251 type: string
6252 x-kubernetes-list-type: atomic
6253 namespaceSelector:
6254 description: |-
6255 A label query over the set of namespaces that the term applies to.
6256 The term is applied to the union of the namespaces selected by this field
6257 and the ones listed in the namespaces field.
6258 null selector and null or empty namespaces list means "this pod's namespace".
6259 An empty selector ({}) matches all namespaces.
6260 type: object
6261 properties:
6262 matchExpressions:
6263 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6264 type: array
6265 items:
6266 description: |-
6267 A label selector requirement is a selector that contains values, a key, and an operator that
6268 relates the key and values.
6269 type: object
6270 required:
6271 - key
6272 - operator
6273 properties:
6274 key:
6275 description: key is the label key that the selector applies to.
6276 type: string
6277 operator:
6278 description: |-
6279 operator represents a key's relationship to a set of values.
6280 Valid operators are In, NotIn, Exists and DoesNotExist.
6281 type: string
6282 values:
6283 description: |-
6284 values is an array of string values. If the operator is In or NotIn,
6285 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6286 the values array must be empty. This array is replaced during a strategic
6287 merge patch.
6288 type: array
6289 items:
6290 type: string
6291 matchLabels:
6292 description: |-
6293 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6294 map is equivalent to an element of matchExpressions, whose key field is "key", the
6295 operator is "In", and the values array contains only "value". The requirements are ANDed.
6296 type: object
6297 additionalProperties:
6298 type: string
6299 x-kubernetes-map-type: atomic
6300 namespaces:
6301 description: |-
6302 namespaces specifies a static list of namespace names that the term applies to.
6303 The term is applied to the union of the namespaces listed in this field
6304 and the ones selected by namespaceSelector.
6305 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
6306 type: array
6307 items:
6308 type: string
6309 topologyKey:
6310 description: |-
6311 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
6312 the labelSelector in the specified namespaces, where co-located is defined as running on a node
6313 whose value of the label with key topologyKey matches that of any node on which any of the
6314 selected pods is running.
6315 Empty topologyKey is not allowed.
6316 type: string
6317 podAntiAffinity:
6318 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
6319 type: object
6320 properties:
6321 preferredDuringSchedulingIgnoredDuringExecution:
6322 description: |-
6323 The scheduler will prefer to schedule pods to nodes that satisfy
6324 the anti-affinity expressions specified by this field, but it may choose
6325 a node that violates one or more of the expressions. The node that is
6326 most preferred is the one with the greatest sum of weights, i.e.
6327 for each node that meets all of the scheduling requirements (resource
6328 request, requiredDuringScheduling anti-affinity expressions, etc.),
6329 compute a sum by iterating through the elements of this field and adding
6330 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
6331 node(s) with the highest sum are the most preferred.
6332 type: array
6333 items:
6334 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
6335 type: object
6336 required:
6337 - podAffinityTerm
6338 - weight
6339 properties:
6340 podAffinityTerm:
6341 description: Required. A pod affinity term, associated with the corresponding weight.
6342 type: object
6343 required:
6344 - topologyKey
6345 properties:
6346 labelSelector:
6347 description: |-
6348 A label query over a set of resources, in this case pods.
6349 If it's null, this PodAffinityTerm matches with no Pods.
6350 type: object
6351 properties:
6352 matchExpressions:
6353 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6354 type: array
6355 items:
6356 description: |-
6357 A label selector requirement is a selector that contains values, a key, and an operator that
6358 relates the key and values.
6359 type: object
6360 required:
6361 - key
6362 - operator
6363 properties:
6364 key:
6365 description: key is the label key that the selector applies to.
6366 type: string
6367 operator:
6368 description: |-
6369 operator represents a key's relationship to a set of values.
6370 Valid operators are In, NotIn, Exists and DoesNotExist.
6371 type: string
6372 values:
6373 description: |-
6374 values is an array of string values. If the operator is In or NotIn,
6375 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6376 the values array must be empty. This array is replaced during a strategic
6377 merge patch.
6378 type: array
6379 items:
6380 type: string
6381 matchLabels:
6382 description: |-
6383 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6384 map is equivalent to an element of matchExpressions, whose key field is "key", the
6385 operator is "In", and the values array contains only "value". The requirements are ANDed.
6386 type: object
6387 additionalProperties:
6388 type: string
6389 x-kubernetes-map-type: atomic
6390 matchLabelKeys:
6391 description: |-
6392 MatchLabelKeys is a set of pod label keys to select which pods will
6393 be taken into consideration. The keys are used to lookup values from the
6394 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
6395 to select the group of existing pods which pods will be taken into consideration
6396 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6397 pod labels will be ignored. The default value is empty.
6398 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
6399 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
6400 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6401 type: array
6402 items:
6403 type: string
6404 x-kubernetes-list-type: atomic
6405 mismatchLabelKeys:
6406 description: |-
6407 MismatchLabelKeys is a set of pod label keys to select which pods will
6408 be taken into consideration. The keys are used to lookup values from the
6409 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
6410 to select the group of existing pods which pods will be taken into consideration
6411 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6412 pod labels will be ignored. The default value is empty.
6413 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
6414 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
6415 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6416 type: array
6417 items:
6418 type: string
6419 x-kubernetes-list-type: atomic
6420 namespaceSelector:
6421 description: |-
6422 A label query over the set of namespaces that the term applies to.
6423 The term is applied to the union of the namespaces selected by this field
6424 and the ones listed in the namespaces field.
6425 null selector and null or empty namespaces list means "this pod's namespace".
6426 An empty selector ({}) matches all namespaces.
6427 type: object
6428 properties:
6429 matchExpressions:
6430 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6431 type: array
6432 items:
6433 description: |-
6434 A label selector requirement is a selector that contains values, a key, and an operator that
6435 relates the key and values.
6436 type: object
6437 required:
6438 - key
6439 - operator
6440 properties:
6441 key:
6442 description: key is the label key that the selector applies to.
6443 type: string
6444 operator:
6445 description: |-
6446 operator represents a key's relationship to a set of values.
6447 Valid operators are In, NotIn, Exists and DoesNotExist.
6448 type: string
6449 values:
6450 description: |-
6451 values is an array of string values. If the operator is In or NotIn,
6452 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6453 the values array must be empty. This array is replaced during a strategic
6454 merge patch.
6455 type: array
6456 items:
6457 type: string
6458 matchLabels:
6459 description: |-
6460 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6461 map is equivalent to an element of matchExpressions, whose key field is "key", the
6462 operator is "In", and the values array contains only "value". The requirements are ANDed.
6463 type: object
6464 additionalProperties:
6465 type: string
6466 x-kubernetes-map-type: atomic
6467 namespaces:
6468 description: |-
6469 namespaces specifies a static list of namespace names that the term applies to.
6470 The term is applied to the union of the namespaces listed in this field
6471 and the ones selected by namespaceSelector.
6472 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
6473 type: array
6474 items:
6475 type: string
6476 topologyKey:
6477 description: |-
6478 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
6479 the labelSelector in the specified namespaces, where co-located is defined as running on a node
6480 whose value of the label with key topologyKey matches that of any node on which any of the
6481 selected pods is running.
6482 Empty topologyKey is not allowed.
6483 type: string
6484 weight:
6485 description: |-
6486 weight associated with matching the corresponding podAffinityTerm,
6487 in the range 1-100.
6488 type: integer
6489 format: int32
6490 requiredDuringSchedulingIgnoredDuringExecution:
6491 description: |-
6492 If the anti-affinity requirements specified by this field are not met at
6493 scheduling time, the pod will not be scheduled onto the node.
6494 If the anti-affinity requirements specified by this field cease to be met
6495 at some point during pod execution (e.g. due to a pod label update), the
6496 system may or may not try to eventually evict the pod from its node.
6497 When there are multiple elements, the lists of nodes corresponding to each
6498 podAffinityTerm are intersected, i.e. all terms must be satisfied.
6499 type: array
6500 items:
6501 description: |-
6502 Defines a set of pods (namely those matching the labelSelector
6503 relative to the given namespace(s)) that this pod should be
6504 co-located (affinity) or not co-located (anti-affinity) with,
6505 where co-located is defined as running on a node whose value of
6506 the label with key <topologyKey> matches that of any node on which
6507 a pod of the set of pods is running
6508 type: object
6509 required:
6510 - topologyKey
6511 properties:
6512 labelSelector:
6513 description: |-
6514 A label query over a set of resources, in this case pods.
6515 If it's null, this PodAffinityTerm matches with no Pods.
6516 type: object
6517 properties:
6518 matchExpressions:
6519 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6520 type: array
6521 items:
6522 description: |-
6523 A label selector requirement is a selector that contains values, a key, and an operator that
6524 relates the key and values.
6525 type: object
6526 required:
6527 - key
6528 - operator
6529 properties:
6530 key:
6531 description: key is the label key that the selector applies to.
6532 type: string
6533 operator:
6534 description: |-
6535 operator represents a key's relationship to a set of values.
6536 Valid operators are In, NotIn, Exists and DoesNotExist.
6537 type: string
6538 values:
6539 description: |-
6540 values is an array of string values. If the operator is In or NotIn,
6541 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6542 the values array must be empty. This array is replaced during a strategic
6543 merge patch.
6544 type: array
6545 items:
6546 type: string
6547 matchLabels:
6548 description: |-
6549 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6550 map is equivalent to an element of matchExpressions, whose key field is "key", the
6551 operator is "In", and the values array contains only "value". The requirements are ANDed.
6552 type: object
6553 additionalProperties:
6554 type: string
6555 x-kubernetes-map-type: atomic
6556 matchLabelKeys:
6557 description: |-
6558 MatchLabelKeys is a set of pod label keys to select which pods will
6559 be taken into consideration. The keys are used to lookup values from the
6560 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)`
6561 to select the group of existing pods which pods will be taken into consideration
6562 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6563 pod labels will be ignored. The default value is empty.
6564 The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
6565 Also, MatchLabelKeys cannot be set when LabelSelector isn't set.
6566 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6567 type: array
6568 items:
6569 type: string
6570 x-kubernetes-list-type: atomic
6571 mismatchLabelKeys:
6572 description: |-
6573 MismatchLabelKeys is a set of pod label keys to select which pods will
6574 be taken into consideration. The keys are used to lookup values from the
6575 incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)`
6576 to select the group of existing pods which pods will be taken into consideration
6577 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
6578 pod labels will be ignored. The default value is empty.
6579 The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector.
6580 Also, MismatchLabelKeys cannot be set when LabelSelector isn't set.
6581 This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
6582 type: array
6583 items:
6584 type: string
6585 x-kubernetes-list-type: atomic
6586 namespaceSelector:
6587 description: |-
6588 A label query over the set of namespaces that the term applies to.
6589 The term is applied to the union of the namespaces selected by this field
6590 and the ones listed in the namespaces field.
6591 null selector and null or empty namespaces list means "this pod's namespace".
6592 An empty selector ({}) matches all namespaces.
6593 type: object
6594 properties:
6595 matchExpressions:
6596 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
6597 type: array
6598 items:
6599 description: |-
6600 A label selector requirement is a selector that contains values, a key, and an operator that
6601 relates the key and values.
6602 type: object
6603 required:
6604 - key
6605 - operator
6606 properties:
6607 key:
6608 description: key is the label key that the selector applies to.
6609 type: string
6610 operator:
6611 description: |-
6612 operator represents a key's relationship to a set of values.
6613 Valid operators are In, NotIn, Exists and DoesNotExist.
6614 type: string
6615 values:
6616 description: |-
6617 values is an array of string values. If the operator is In or NotIn,
6618 the values array must be non-empty. If the operator is Exists or DoesNotExist,
6619 the values array must be empty. This array is replaced during a strategic
6620 merge patch.
6621 type: array
6622 items:
6623 type: string
6624 matchLabels:
6625 description: |-
6626 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6627 map is equivalent to an element of matchExpressions, whose key field is "key", the
6628 operator is "In", and the values array contains only "value". The requirements are ANDed.
6629 type: object
6630 additionalProperties:
6631 type: string
6632 x-kubernetes-map-type: atomic
6633 namespaces:
6634 description: |-
6635 namespaces specifies a static list of namespace names that the term applies to.
6636 The term is applied to the union of the namespaces listed in this field
6637 and the ones selected by namespaceSelector.
6638 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
6639 type: array
6640 items:
6641 type: string
6642 topologyKey:
6643 description: |-
6644 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
6645 the labelSelector in the specified namespaces, where co-located is defined as running on a node
6646 whose value of the label with key topologyKey matches that of any node on which any of the
6647 selected pods is running.
6648 Empty topologyKey is not allowed.
6649 type: string
6650 imagePullSecrets:
6651 description: If specified, the pod's imagePullSecrets
6652 type: array
6653 items:
6654 description: |-
6655 LocalObjectReference contains enough information to let you locate the
6656 referenced object inside the same namespace.
6657 type: object
6658 properties:
6659 name:
6660 description: |-
6661 Name of the referent.
6662 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
6663 type: string
6664 x-kubernetes-map-type: atomic
6665 nodeSelector:
6666 description: |-
6667 NodeSelector is a selector which must be true for the pod to fit on a node.
6668 Selector which must match a node's labels for the pod to be scheduled on that node.
6669 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
6670 type: object
6671 additionalProperties:
6672 type: string
6673 priorityClassName:
6674 description: If specified, the pod's priorityClassName.
6675 type: string
6676 serviceAccountName:
6677 description: If specified, the pod's service account
6678 type: string
6679 tolerations:
6680 description: If specified, the pod's tolerations.
6681 type: array
6682 items:
6683 description: |-
6684 The pod this Toleration is attached to tolerates any taint that matches
6685 the triple <key,value,effect> using the matching operator <operator>.
6686 type: object
6687 properties:
6688 effect:
6689 description: |-
6690 Effect indicates the taint effect to match. Empty means match all taint effects.
6691 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
6692 type: string
6693 key:
6694 description: |-
6695 Key is the taint key that the toleration applies to. Empty means match all taint keys.
6696 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
6697 type: string
6698 operator:
6699 description: |-
6700 Operator represents a key's relationship to the value.
6701 Valid operators are Exists and Equal. Defaults to Equal.
6702 Exists is equivalent to wildcard for value, so that a pod can
6703 tolerate all taints of a particular category.
6704 type: string
6705 tolerationSeconds:
6706 description: |-
6707 TolerationSeconds represents the period of time the toleration (which must be
6708 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
6709 it is not set, which means tolerate the taint forever (do not evict). Zero and
6710 negative values will be treated as 0 (evict immediately) by the system.
6711 type: integer
6712 format: int64
6713 value:
6714 description: |-
6715 Value is the taint value the toleration matches to.
6716 If the operator is Exists, the value should be empty, otherwise just a regular string.
6717 type: string
6718 serviceType:
6719 description: |-
6720 Optional service type for Kubernetes solver service. Supported values
6721 are NodePort or ClusterIP. If unset, defaults to NodePort.
6722 type: string
6723 selector:
6724 description: |-
6725 Selector selects a set of DNSNames on the Certificate resource that
6726 should be solved using this challenge solver.
6727 If not specified, the solver will be treated as the 'default' solver
6728 with the lowest priority, i.e. if any other solver has a more specific
6729 match, it will be used instead.
6730 type: object
6731 properties:
6732 dnsNames:
6733 description: |-
6734 List of DNSNames that this solver will be used to solve.
6735 If specified and a match is found, a dnsNames selector will take
6736 precedence over a dnsZones selector.
6737 If multiple solvers match with the same dnsNames value, the solver
6738 with the most matching labels in matchLabels will be selected.
6739 If neither has more matches, the solver defined earlier in the list
6740 will be selected.
6741 type: array
6742 items:
6743 type: string
6744 dnsZones:
6745 description: |-
6746 List of DNSZones that this solver will be used to solve.
6747 The most specific DNS zone match specified here will take precedence
6748 over other DNS zone matches, so a solver specifying sys.example.com
6749 will be selected over one specifying example.com for the domain
6750 www.sys.example.com.
6751 If multiple solvers match with the same dnsZones value, the solver
6752 with the most matching labels in matchLabels will be selected.
6753 If neither has more matches, the solver defined earlier in the list
6754 will be selected.
6755 type: array
6756 items:
6757 type: string
6758 matchLabels:
6759 description: |-
6760 A label selector that is used to refine the set of certificate's that
6761 this challenge solver will apply to.
6762 type: object
6763 additionalProperties:
6764 type: string
6765 ca:
6766 description: |-
6767 CA configures this issuer to sign certificates using a signing CA keypair
6768 stored in a Secret resource.
6769 This is used to build internal PKIs that are managed by cert-manager.
6770 type: object
6771 required:
6772 - secretName
6773 properties:
6774 crlDistributionPoints:
6775 description: |-
6776 The CRL distribution points is an X.509 v3 certificate extension which identifies
6777 the location of the CRL from which the revocation of this certificate can be checked.
6778 If not set, certificates will be issued without distribution points set.
6779 type: array
6780 items:
6781 type: string
6782 ocspServers:
6783 description: |-
6784 The OCSP server list is an X.509 v3 extension that defines a list of
6785 URLs of OCSP responders. The OCSP responders can be queried for the
6786 revocation status of an issued certificate. If not set, the
6787 certificate will be issued with no OCSP servers set. For example, an
6788 OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
6789 type: array
6790 items:
6791 type: string
6792 secretName:
6793 description: |-
6794 SecretName is the name of the secret used to sign Certificates issued
6795 by this Issuer.
6796 type: string
6797 selfSigned:
6798 description: |-
6799 SelfSigned configures this issuer to 'self sign' certificates using the
6800 private key used to create the CertificateRequest object.
6801 type: object
6802 properties:
6803 crlDistributionPoints:
6804 description: |-
6805 The CRL distribution points is an X.509 v3 certificate extension which identifies
6806 the location of the CRL from which the revocation of this certificate can be checked.
6807 If not set certificate will be issued without CDP. Values are strings.
6808 type: array
6809 items:
6810 type: string
6811 vault:
6812 description: |-
6813 Vault configures this issuer to sign certificates using a HashiCorp Vault
6814 PKI backend.
6815 type: object
6816 required:
6817 - auth
6818 - path
6819 - server
6820 properties:
6821 auth:
6822 description: Auth configures how cert-manager authenticates with the Vault server.
6823 type: object
6824 properties:
6825 appRole:
6826 description: |-
6827 AppRole authenticates with Vault using the App Role auth mechanism,
6828 with the role and secret stored in a Kubernetes Secret resource.
6829 type: object
6830 required:
6831 - path
6832 - roleId
6833 - secretRef
6834 properties:
6835 path:
6836 description: |-
6837 Path where the App Role authentication backend is mounted in Vault, e.g:
6838 "approle"
6839 type: string
6840 roleId:
6841 description: |-
6842 RoleID configured in the App Role authentication backend when setting
6843 up the authentication backend in Vault.
6844 type: string
6845 secretRef:
6846 description: |-
6847 Reference to a key in a Secret that contains the App Role secret used
6848 to authenticate with Vault.
6849 The `key` field must be specified and denotes which entry within the Secret
6850 resource is used as the app role secret.
6851 type: object
6852 required:
6853 - name
6854 properties:
6855 key:
6856 description: |-
6857 The key of the entry in the Secret resource's `data` field to be used.
6858 Some instances of this field may be defaulted, in others it may be
6859 required.
6860 type: string
6861 name:
6862 description: |-
6863 Name of the resource being referred to.
6864 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
6865 type: string
6866 kubernetes:
6867 description: |-
6868 Kubernetes authenticates with Vault by passing the ServiceAccount
6869 token stored in the named Secret resource to the Vault server.
6870 type: object
6871 required:
6872 - role
6873 properties:
6874 mountPath:
6875 description: |-
6876 The Vault mountPath here is the mount path to use when authenticating with
6877 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
6878 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
6879 default value "/v1/auth/kubernetes" will be used.
6880 type: string
6881 role:
6882 description: |-
6883 A required field containing the Vault Role to assume. A Role binds a
6884 Kubernetes ServiceAccount with a set of Vault policies.
6885 type: string
6886 secretRef:
6887 description: |-
6888 The required Secret field containing a Kubernetes ServiceAccount JWT used
6889 for authenticating with Vault. Use of 'ambient credentials' is not
6890 supported.
6891 type: object
6892 required:
6893 - name
6894 properties:
6895 key:
6896 description: |-
6897 The key of the entry in the Secret resource's `data` field to be used.
6898 Some instances of this field may be defaulted, in others it may be
6899 required.
6900 type: string
6901 name:
6902 description: |-
6903 Name of the resource being referred to.
6904 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
6905 type: string
6906 serviceAccountRef:
6907 description: |-
6908 A reference to a service account that will be used to request a bound
6909 token (also known as "projected token"). Compared to using "secretRef",
6910 using this field means that you don't rely on statically bound tokens. To
6911 use this field, you must configure an RBAC rule to let cert-manager
6912 request a token.
6913 type: object
6914 required:
6915 - name
6916 properties:
6917 name:
6918 description: Name of the ServiceAccount used to request a token.
6919 type: string
6920 tokenSecretRef:
6921 description: TokenSecretRef authenticates with Vault by presenting a token.
6922 type: object
6923 required:
6924 - name
6925 properties:
6926 key:
6927 description: |-
6928 The key of the entry in the Secret resource's `data` field to be used.
6929 Some instances of this field may be defaulted, in others it may be
6930 required.
6931 type: string
6932 name:
6933 description: |-
6934 Name of the resource being referred to.
6935 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
6936 type: string
6937 caBundle:
6938 description: |-
6939 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
6940 chain presented by Vault. Only used if using HTTPS to connect to Vault and
6941 ignored for HTTP connections.
6942 Mutually exclusive with CABundleSecretRef.
6943 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
6944 the cert-manager controller container is used to validate the TLS connection.
6945 type: string
6946 format: byte
6947 caBundleSecretRef:
6948 description: |-
6949 Reference to a Secret containing a bundle of PEM-encoded CAs to use when
6950 verifying the certificate chain presented by Vault when using HTTPS.
6951 Mutually exclusive with CABundle.
6952 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
6953 the cert-manager controller container is used to validate the TLS connection.
6954 If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
6955 type: object
6956 required:
6957 - name
6958 properties:
6959 key:
6960 description: |-
6961 The key of the entry in the Secret resource's `data` field to be used.
6962 Some instances of this field may be defaulted, in others it may be
6963 required.
6964 type: string
6965 name:
6966 description: |-
6967 Name of the resource being referred to.
6968 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
6969 type: string
6970 namespace:
6971 description: |-
6972 Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
6973 More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
6974 type: string
6975 path:
6976 description: |-
6977 Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
6978 "my_pki_mount/sign/my-role-name".
6979 type: string
6980 server:
6981 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
6982 type: string
6983 venafi:
6984 description: |-
6985 Venafi configures this issuer to sign certificates using a Venafi TPP
6986 or Venafi Cloud policy zone.
6987 type: object
6988 required:
6989 - zone
6990 properties:
6991 cloud:
6992 description: |-
6993 Cloud specifies the Venafi cloud configuration settings.
6994 Only one of TPP or Cloud may be specified.
6995 type: object
6996 required:
6997 - apiTokenSecretRef
6998 properties:
6999 apiTokenSecretRef:
7000 description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
7001 type: object
7002 required:
7003 - name
7004 properties:
7005 key:
7006 description: |-
7007 The key of the entry in the Secret resource's `data` field to be used.
7008 Some instances of this field may be defaulted, in others it may be
7009 required.
7010 type: string
7011 name:
7012 description: |-
7013 Name of the resource being referred to.
7014 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
7015 type: string
7016 url:
7017 description: |-
7018 URL is the base URL for Venafi Cloud.
7019 Defaults to "https://api.venafi.cloud/v1".
7020 type: string
7021 tpp:
7022 description: |-
7023 TPP specifies Trust Protection Platform configuration settings.
7024 Only one of TPP or Cloud may be specified.
7025 type: object
7026 required:
7027 - credentialsRef
7028 - url
7029 properties:
7030 caBundle:
7031 description: |-
7032 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
7033 chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
7034 If undefined, the certificate bundle in the cert-manager controller container
7035 is used to validate the chain.
7036 type: string
7037 format: byte
7038 credentialsRef:
7039 description: |-
7040 CredentialsRef is a reference to a Secret containing the username and
7041 password for the TPP server.
7042 The secret must contain two keys, 'username' and 'password'.
7043 type: object
7044 required:
7045 - name
7046 properties:
7047 name:
7048 description: |-
7049 Name of the resource being referred to.
7050 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
7051 type: string
7052 url:
7053 description: |-
7054 URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
7055 for example: "https://tpp.example.com/vedsdk".
7056 type: string
7057 zone:
7058 description: |-
7059 Zone is the Venafi Policy Zone to use for this issuer.
7060 All requests made to the Venafi platform will be restricted by the named
7061 zone policy.
7062 This field is required.
7063 type: string
7064 status:
7065 description: Status of the Issuer. This is set and managed automatically.
7066 type: object
7067 properties:
7068 acme:
7069 description: |-
7070 ACME specific status options.
7071 This field should only be set if the Issuer is configured to use an ACME
7072 server to issue certificates.
7073 type: object
7074 properties:
7075 lastPrivateKeyHash:
7076 description: |-
7077 LastPrivateKeyHash is a hash of the private key associated with the latest
7078 registered ACME account, in order to track changes made to registered account
7079 associated with the Issuer
7080 type: string
7081 lastRegisteredEmail:
7082 description: |-
7083 LastRegisteredEmail is the email associated with the latest registered
7084 ACME account, in order to track changes made to registered account
7085 associated with the Issuer
7086 type: string
7087 uri:
7088 description: |-
7089 URI is the unique account identifier, which can also be used to retrieve
7090 account details from the CA
7091 type: string
7092 conditions:
7093 description: |-
7094 List of status conditions to indicate the status of a CertificateRequest.
7095 Known condition types are `Ready`.
7096 type: array
7097 items:
7098 description: IssuerCondition contains condition information for an Issuer.
7099 type: object
7100 required:
7101 - status
7102 - type
7103 properties:
7104 lastTransitionTime:
7105 description: |-
7106 LastTransitionTime is the timestamp corresponding to the last status
7107 change of this condition.
7108 type: string
7109 format: date-time
7110 message:
7111 description: |-
7112 Message is a human readable description of the details of the last
7113 transition, complementing reason.
7114 type: string
7115 observedGeneration:
7116 description: |-
7117 If set, this represents the .metadata.generation that the condition was
7118 set based upon.
7119 For instance, if .metadata.generation is currently 12, but the
7120 .status.condition[x].observedGeneration is 9, the condition is out of date
7121 with respect to the current state of the Issuer.
7122 type: integer
7123 format: int64
7124 reason:
7125 description: |-
7126 Reason is a brief machine readable explanation for the condition's last
7127 transition.
7128 type: string
7129 status:
7130 description: Status of the condition, one of (`True`, `False`, `Unknown`).
7131 type: string
7132 enum:
7133 - "True"
7134 - "False"
7135 - Unknown
7136 type:
7137 description: Type of the condition, known values are (`Ready`).
7138 type: string
7139 x-kubernetes-list-map-keys:
7140 - type
7141 x-kubernetes-list-type: map
7142 served: true
7143 storage: true
7144---
7145apiVersion: apiextensions.k8s.io/v1
7146kind: CustomResourceDefinition
7147metadata:
7148 name: orders.acme.cert-manager.io
7149 labels:
7150 app: '{{ template "cert-manager.name" . }}'
7151 app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
7152 app.kubernetes.io/instance: '{{ .Release.Name }}'
7153 # Generated labels {{- include "labels" . | nindent 4 }}
7154spec:
7155 group: acme.cert-manager.io
7156 names:
7157 kind: Order
7158 listKind: OrderList
7159 plural: orders
7160 singular: order
7161 categories:
7162 - cert-manager
7163 - cert-manager-acme
7164 scope: Namespaced
7165 versions:
7166 - name: v1
7167 subresources:
7168 status: {}
7169 additionalPrinterColumns:
7170 - jsonPath: .status.state
7171 name: State
7172 type: string
7173 - jsonPath: .spec.issuerRef.name
7174 name: Issuer
7175 priority: 1
7176 type: string
7177 - jsonPath: .status.reason
7178 name: Reason
7179 priority: 1
7180 type: string
7181 - jsonPath: .metadata.creationTimestamp
7182 description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
7183 name: Age
7184 type: date
7185 schema:
7186 openAPIV3Schema:
7187 description: Order is a type to represent an Order with an ACME server
7188 type: object
7189 required:
7190 - metadata
7191 - spec
7192 properties:
7193 apiVersion:
7194 description: |-
7195 APIVersion defines the versioned schema of this representation of an object.
7196 Servers should convert recognized schemas to the latest internal value, and
7197 may reject unrecognized values.
7198 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
7199 type: string
7200 kind:
7201 description: |-
7202 Kind is a string value representing the REST resource this object represents.
7203 Servers may infer this from the endpoint the client submits requests to.
7204 Cannot be updated.
7205 In CamelCase.
7206 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
7207 type: string
7208 metadata:
7209 type: object
7210 spec:
7211 type: object
7212 required:
7213 - issuerRef
7214 - request
7215 properties:
7216 commonName:
7217 description: |-
7218 CommonName is the common name as specified on the DER encoded CSR.
7219 If specified, this value must also be present in `dnsNames` or `ipAddresses`.
7220 This field must match the corresponding field on the DER encoded CSR.
7221 type: string
7222 dnsNames:
7223 description: |-
7224 DNSNames is a list of DNS names that should be included as part of the Order
7225 validation process.
7226 This field must match the corresponding field on the DER encoded CSR.
7227 type: array
7228 items:
7229 type: string
7230 duration:
7231 description: |-
7232 Duration is the duration for the not after date for the requested certificate.
7233 this is set on order creation as pe the ACME spec.
7234 type: string
7235 ipAddresses:
7236 description: |-
7237 IPAddresses is a list of IP addresses that should be included as part of the Order
7238 validation process.
7239 This field must match the corresponding field on the DER encoded CSR.
7240 type: array
7241 items:
7242 type: string
7243 issuerRef:
7244 description: |-
7245 IssuerRef references a properly configured ACME-type Issuer which should
7246 be used to create this Order.
7247 If the Issuer does not exist, processing will be retried.
7248 If the Issuer is not an 'ACME' Issuer, an error will be returned and the
7249 Order will be marked as failed.
7250 type: object
7251 required:
7252 - name
7253 properties:
7254 group:
7255 description: Group of the resource being referred to.
7256 type: string
7257 kind:
7258 description: Kind of the resource being referred to.
7259 type: string
7260 name:
7261 description: Name of the resource being referred to.
7262 type: string
7263 request:
7264 description: |-
7265 Certificate signing request bytes in DER encoding.
7266 This will be used when finalizing the order.
7267 This field must be set on the order.
7268 type: string
7269 format: byte
7270 status:
7271 type: object
7272 properties:
7273 authorizations:
7274 description: |-
7275 Authorizations contains data returned from the ACME server on what
7276 authorizations must be completed in order to validate the DNS names
7277 specified on the Order.
7278 type: array
7279 items:
7280 description: |-
7281 ACMEAuthorization contains data returned from the ACME server on an
7282 authorization that must be completed in order validate a DNS name on an ACME
7283 Order resource.
7284 type: object
7285 required:
7286 - url
7287 properties:
7288 challenges:
7289 description: |-
7290 Challenges specifies the challenge types offered by the ACME server.
7291 One of these challenge types will be selected when validating the DNS
7292 name and an appropriate Challenge resource will be created to perform
7293 the ACME challenge process.
7294 type: array
7295 items:
7296 description: |-
7297 Challenge specifies a challenge offered by the ACME server for an Order.
7298 An appropriate Challenge resource can be created to perform the ACME
7299 challenge process.
7300 type: object
7301 required:
7302 - token
7303 - type
7304 - url
7305 properties:
7306 token:
7307 description: |-
7308 Token is the token that must be presented for this challenge.
7309 This is used to compute the 'key' that must also be presented.
7310 type: string
7311 type:
7312 description: |-
7313 Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
7314 'tls-sni-01', etc.
7315 This is the raw value retrieved from the ACME server.
7316 Only 'http-01' and 'dns-01' are supported by cert-manager, other values
7317 will be ignored.
7318 type: string
7319 url:
7320 description: |-
7321 URL is the URL of this challenge. It can be used to retrieve additional
7322 metadata about the Challenge from the ACME server.
7323 type: string
7324 identifier:
7325 description: Identifier is the DNS name to be validated as part of this authorization
7326 type: string
7327 initialState:
7328 description: |-
7329 InitialState is the initial state of the ACME authorization when first
7330 fetched from the ACME server.
7331 If an Authorization is already 'valid', the Order controller will not
7332 create a Challenge resource for the authorization. This will occur when
7333 working with an ACME server that enables 'authz reuse' (such as Let's
7334 Encrypt's production endpoint).
7335 If not set and 'identifier' is set, the state is assumed to be pending
7336 and a Challenge will be created.
7337 type: string
7338 enum:
7339 - valid
7340 - ready
7341 - pending
7342 - processing
7343 - invalid
7344 - expired
7345 - errored
7346 url:
7347 description: URL is the URL of the Authorization that must be completed
7348 type: string
7349 wildcard:
7350 description: |-
7351 Wildcard will be true if this authorization is for a wildcard DNS name.
7352 If this is true, the identifier will be the *non-wildcard* version of
7353 the DNS name.
7354 For example, if '*.example.com' is the DNS name being validated, this
7355 field will be 'true' and the 'identifier' field will be 'example.com'.
7356 type: boolean
7357 certificate:
7358 description: |-
7359 Certificate is a copy of the PEM encoded certificate for this Order.
7360 This field will be populated after the order has been successfully
7361 finalized with the ACME server, and the order has transitioned to the
7362 'valid' state.
7363 type: string
7364 format: byte
7365 failureTime:
7366 description: |-
7367 FailureTime stores the time that this order failed.
7368 This is used to influence garbage collection and back-off.
7369 type: string
7370 format: date-time
7371 finalizeURL:
7372 description: |-
7373 FinalizeURL of the Order.
7374 This is used to obtain certificates for this order once it has been completed.
7375 type: string
7376 reason:
7377 description: |-
7378 Reason optionally provides more information about a why the order is in
7379 the current state.
7380 type: string
7381 state:
7382 description: |-
7383 State contains the current state of this Order resource.
7384 States 'success' and 'expired' are 'final'
7385 type: string
7386 enum:
7387 - valid
7388 - ready
7389 - pending
7390 - processing
7391 - invalid
7392 - expired
7393 - errored
7394 url:
7395 description: |-
7396 URL of the Order.
7397 This will initially be empty when the resource is first created.
7398 The Order controller will populate this field when the Order is first processed.
7399 This field will be immutable after it is initially set.
7400 type: string
7401 served: true
7402 storage: true
7403{{- end }}