cert-manager: 1.18.6 -> 1.19.6
Change-Id: I03ccd9378c24a6160b9949e90bfa467595a82b22
diff --git a/charts/cert-manager/templates/_helpers.tpl b/charts/cert-manager/templates/_helpers.tpl
index e15fa19..f85373f 100644
--- a/charts/cert-manager/templates/_helpers.tpl
+++ b/charts/cert-manager/templates/_helpers.tpl
@@ -188,6 +188,17 @@
{{- end }}
{{/*
+Labels for the CRD resources.
+*/}}
+{{- define "cert-manager.crd-labels" -}}
+app: "{{ template "cert-manager.name" . }}"
+app.kubernetes.io/name: "{{ template "cert-manager.name" . }}"
+app.kubernetes.io/instance: "{{ .Release.Name }}"
+app.kubernetes.io/component: "crds"
+{{ include "labels" . }}
+{{- end -}}
+
+{{/*
Check that the user has not set both .installCRDs and .crds.enabled or
set .installCRDs and disabled .crds.keep.
.installCRDs is deprecated and users should use .crds.enabled and .crds.keep instead.
diff --git a/charts/cert-manager/templates/cainjector-deployment.yaml b/charts/cert-manager/templates/cainjector-deployment.yaml
index 79ba857..b5434ca 100644
--- a/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -67,6 +67,9 @@
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
+ {{- if (hasKey .Values.global "hostUsers") }}
+ hostUsers: {{ .Values.global.hostUsers }}
+ {{- end }}
{{- with .Values.cainjector.securityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
@@ -136,7 +139,9 @@
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
- {{- with .Values.cainjector.nodeSelector }}
+ {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+ {{- $nodeSelector = merge $nodeSelector (.Values.cainjector.nodeSelector | default dict) }}
+ {{- with $nodeSelector }}
nodeSelector:
{{- range $key, $value := . }}
{{ $key }}: {{ $value | quote }}
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
new file mode 100644
index 0000000..39705f2
--- /dev/null
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -0,0 +1,3281 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ name: "challenges.acme.cert-manager.io"
+ {{- if .Values.crds.keep }}
+ annotations:
+ helm.sh/resource-policy: keep
+ {{- end }}
+ labels:
+ {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+ group: acme.cert-manager.io
+ names:
+ categories:
+ - cert-manager
+ - cert-manager-acme
+ kind: Challenge
+ listKind: ChallengeList
+ plural: challenges
+ singular: challenge
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .status.state
+ name: State
+ type: string
+ - jsonPath: .spec.dnsName
+ name: Domain
+ type: string
+ - jsonPath: .status.reason
+ name: Reason
+ priority: 1
+ type: string
+ - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: Challenge is a type to represent a Challenge request with an ACME server
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ authorizationURL:
+ description: |-
+ The URL to the ACME Authorization resource that this
+ challenge is a part of.
+ type: string
+ dnsName:
+ description: |-
+ dnsName is the identifier that this challenge is for, e.g., example.com.
+ If the requested DNSName is a 'wildcard', this field MUST be set to the
+ non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
+ type: string
+ issuerRef:
+ description: |-
+ References a properly configured ACME-type Issuer which should
+ be used to create this Challenge.
+ If the Issuer does not exist, processing will be retried.
+ If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+ Challenge will be marked as failed.
+ properties:
+ group:
+ description: |-
+ Group of the issuer being referred to.
+ Defaults to 'cert-manager.io'.
+ type: string
+ kind:
+ description: |-
+ Kind of the issuer being referred to.
+ Defaults to 'Issuer'.
+ type: string
+ name:
+ description: Name of the issuer being referred to.
+ type: string
+ required:
+ - name
+ type: object
+ key:
+ description: |-
+ The ACME challenge key for this challenge
+ For HTTP01 challenges, this is the value that must be responded with to
+ complete the HTTP01 challenge in the format:
+ `<private key JWK thumbprint>.<key from acme server for challenge>`.
+ For DNS01 challenges, this is the base64 encoded SHA256 sum of the
+ `<private key JWK thumbprint>.<key from acme server for challenge>`
+ text that must be set as the TXT record content.
+ type: string
+ solver:
+ description: |-
+ Contains the domain solving configuration that should be used to
+ solve this challenge resource.
+ properties:
+ dns01:
+ description: |-
+ Configures cert-manager to attempt to complete authorizations by
+ performing the DNS01 challenge flow.
+ properties:
+ acmeDNS:
+ description: |-
+ Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
+ DNS01 challenge records.
+ properties:
+ accountSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ host:
+ type: string
+ required:
+ - accountSecretRef
+ - host
+ type: object
+ akamai:
+ description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
+ properties:
+ accessTokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientTokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ serviceConsumerDomain:
+ type: string
+ required:
+ - accessTokenSecretRef
+ - clientSecretSecretRef
+ - clientTokenSecretRef
+ - serviceConsumerDomain
+ type: object
+ azureDNS:
+ description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
+ properties:
+ clientID:
+ description: |-
+ Auth: Azure Service Principal:
+ The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
+ If set, ClientSecret and TenantID must also be set.
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ Auth: Azure Service Principal:
+ A reference to a Secret containing the password associated with the Service Principal.
+ If set, ClientID and TenantID must also be set.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ environment:
+ description: name of the Azure environment (default AzurePublicCloud)
+ enum:
+ - AzurePublicCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureUSGovernmentCloud
+ type: string
+ hostedZoneName:
+ description: name of the DNS zone that should be used
+ type: string
+ managedIdentity:
+ description: |-
+ Auth: Azure Workload Identity or Azure Managed Service Identity:
+ Settings to enable Azure Workload Identity or Azure Managed Service Identity
+ If set, ClientID, ClientSecret and TenantID must not be set.
+ properties:
+ clientID:
+ description: client ID of the managed identity, cannot be used at the same time as resourceID
+ type: string
+ resourceID:
+ description: |-
+ resource ID of the managed identity, cannot be used at the same time as clientID
+ Cannot be used for Azure Managed Service Identity
+ type: string
+ tenantID:
+ description: tenant ID of the managed identity, cannot be used at the same time as resourceID
+ type: string
+ type: object
+ resourceGroupName:
+ description: resource group the DNS zone is located in
+ type: string
+ subscriptionID:
+ description: ID of the Azure subscription
+ type: string
+ tenantID:
+ description: |-
+ Auth: Azure Service Principal:
+ The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
+ If set, ClientID and ClientSecret must also be set.
+ type: string
+ required:
+ - resourceGroupName
+ - subscriptionID
+ type: object
+ cloudDNS:
+ description: Use the Google Cloud DNS API to manage DNS01 challenge records.
+ properties:
+ hostedZoneName:
+ description: |-
+ HostedZoneName is an optional field that tells cert-manager in which
+ Cloud DNS zone the challenge record has to be created.
+ If left empty cert-manager will automatically choose a zone.
+ type: string
+ project:
+ type: string
+ serviceAccountSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - project
+ type: object
+ cloudflare:
+ description: Use the Cloudflare API to manage DNS01 challenge records.
+ properties:
+ apiKeySecretRef:
+ description: |-
+ API key to use to authenticate with Cloudflare.
+ Note: using an API token to authenticate is now the recommended method
+ as it allows greater control of permissions.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ apiTokenSecretRef:
+ description: API token used to authenticate with Cloudflare.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ email:
+ description: Email of the account, only required when using API key based authentication.
+ type: string
+ type: object
+ cnameStrategy:
+ description: |-
+ CNAMEStrategy configures how the DNS01 provider should handle CNAME
+ records when found in DNS zones.
+ enum:
+ - None
+ - Follow
+ type: string
+ digitalocean:
+ description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
+ properties:
+ tokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - tokenSecretRef
+ type: object
+ rfc2136:
+ description: |-
+ Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
+ to manage DNS01 challenge records.
+ properties:
+ nameserver:
+ description: |-
+ The IP address or hostname of an authoritative DNS server supporting
+ RFC2136 in the form host:port. If the host is an IPv6 address it must be
+ enclosed in square brackets (e.g [2001:db8::1]); port is optional.
+ This field is required.
+ type: string
+ protocol:
+ description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
+ enum:
+ - TCP
+ - UDP
+ type: string
+ tsigAlgorithm:
+ description: |-
+ The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+ when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+ Supported values are (case-insensitive): ``HMACMD5`` (default),
+ ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+ type: string
+ tsigKeyName:
+ description: |-
+ The TSIG Key name configured in the DNS.
+ If ``tsigSecretSecretRef`` is defined, this field is required.
+ type: string
+ tsigSecretSecretRef:
+ description: |-
+ The name of the secret containing the TSIG value.
+ If ``tsigKeyName`` is defined, this field is required.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - nameserver
+ type: object
+ route53:
+ description: Use the AWS Route53 API to manage DNS01 challenge records.
+ properties:
+ accessKeyID:
+ description: |-
+ The AccessKeyID is used for authentication.
+ Cannot be set when SecretAccessKeyID is set.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ type: string
+ accessKeyIDSecretRef:
+ description: |-
+ The SecretAccessKey is used for authentication. If set, pull the AWS
+ access key ID from a key within a Kubernetes Secret.
+ Cannot be set when AccessKeyID is set.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ auth:
+ description: Auth configures how cert-manager authenticates.
+ properties:
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
+ by passing a bound ServiceAccount token.
+ properties:
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a bound
+ token (also known as "projected token"). To use this field, you must
+ configure an RBAC rule to let cert-manager request a token.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of audiences to include in the
+ token passed to AWS. The default token consisting of the issuer's namespace
+ and name is always included.
+ If unset the audience defaults to `sts.amazonaws.com`.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ required:
+ - kubernetes
+ type: object
+ hostedZoneID:
+ description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
+ type: string
+ region:
+ description: |-
+ Override the AWS region.
+
+ Route53 is a global service and does not have regional endpoints but the
+ region specified here (or via environment variables) is used as a hint to
+ help compute the correct AWS credential scope and partition when it
+ connects to Route53. See:
+ - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
+ - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
+
+ If you omit this region field, cert-manager will use the region from
+ AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
+ in the cert-manager controller Pod.
+
+ The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+ Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+ [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
+ In this case this `region` field value is ignored.
+
+ The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
+ Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+ [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
+ In this case this `region` field value is ignored.
+ type: string
+ role:
+ description: |-
+ Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+ or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+ type: string
+ secretAccessKeySecretRef:
+ description: |-
+ The SecretAccessKey is used for authentication.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ webhook:
+ description: |-
+ Configure an external webhook based DNS01 challenge solver to manage
+ DNS01 challenge records.
+ properties:
+ config:
+ description: |-
+ Additional configuration that should be passed to the webhook apiserver
+ when challenges are processed.
+ This can contain arbitrary JSON data.
+ Secret values should not be specified in this stanza.
+ If secret values are needed (e.g., credentials for a DNS service), you
+ should use a SecretKeySelector to reference a Secret resource.
+ For details on the schema of this field, consult the webhook provider
+ implementation's documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ groupName:
+ description: |-
+ The API group name that should be used when POSTing ChallengePayload
+ resources to the webhook apiserver.
+ This should be the same as the GroupName specified in the webhook
+ provider implementation.
+ type: string
+ solverName:
+ description: |-
+ The name of the solver to use, as defined in the webhook provider
+ implementation.
+ This will typically be the name of the provider, e.g., 'cloudflare'.
+ type: string
+ required:
+ - groupName
+ - solverName
+ type: object
+ type: object
+ http01:
+ description: |-
+ Configures cert-manager to attempt to complete authorizations by
+ performing the HTTP01 challenge flow.
+ It is not possible to obtain certificates for wildcard domain names
+ (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
+ properties:
+ gatewayHTTPRoute:
+ description: |-
+ The Gateway API is a sig-network community API that models service networking
+ in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
+ create HTTPRoutes with the specified labels in the same namespace as the challenge.
+ This solver is experimental, and fields / behaviour may change in the future.
+ properties:
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ Custom labels that will be applied to HTTPRoutes created by cert-manager
+ while solving HTTP-01 challenges.
+ type: object
+ parentRefs:
+ description: |-
+ When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
+ cert-manager needs to know which parentRefs should be used when creating
+ the HTTPRoute. Usually, the parentRef references a Gateway. See:
+ https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
+ items:
+ description: |-
+ ParentReference identifies an API object (usually a Gateway) that can be considered
+ a parent of this resource (usually a route). There are two kinds of parent resources
+ with "Core" support:
+
+ * Gateway (Gateway conformance profile)
+ * Service (Mesh conformance profile, ClusterIP Services only)
+
+ This API may be extended in the future to support additional kinds of parent
+ resources.
+
+ The API object must be valid in the cluster; the Group and Kind must
+ be registered in the cluster for this reference to be valid.
+ properties:
+ group:
+ default: gateway.networking.k8s.io
+ description: |-
+ Group is the group of the referent.
+ When unspecified, "gateway.networking.k8s.io" is inferred.
+ To set the core API group (such as for a "Service" kind referent),
+ Group must be explicitly set to "" (empty string).
+
+ Support: Core
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ kind:
+ default: Gateway
+ description: |-
+ Kind is kind of the referent.
+
+ There are two kinds of parent resources with "Core" support:
+
+ * Gateway (Gateway conformance profile)
+ * Service (Mesh conformance profile, ClusterIP Services only)
+
+ Support for other resources is Implementation-Specific.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+ type: string
+ name:
+ description: |-
+ Name is the name of the referent.
+
+ Support: Core
+ maxLength: 253
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ Namespace is the namespace of the referent. When unspecified, this refers
+ to the local namespace of the Route.
+
+ Note that there are specific rules for ParentRefs which cross namespace
+ boundaries. Cross-namespace references are only valid if they are explicitly
+ allowed by something in the namespace they are referring to. For example:
+ Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+ generic way to enable any other kind of cross-namespace reference.
+
+ <gateway:experimental:description>
+ ParentRefs from a Route to a Service in the same namespace are "producer"
+ routes, which apply default routing rules to inbound connections from
+ any namespace to the Service.
+
+ ParentRefs from a Route to a Service in a different namespace are
+ "consumer" routes, and these routing rules are only applied to outbound
+ connections originating from the same namespace as the Route, for which
+ the intended destination of the connections are a Service targeted as a
+ ParentRef of the Route.
+ </gateway:experimental:description>
+
+ Support: Core
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ port:
+ description: |-
+ Port is the network port this Route targets. It can be interpreted
+ differently based on the type of parent resource.
+
+ When the parent resource is a Gateway, this targets all listeners
+ listening on the specified port that also support this kind of Route(and
+ select this Route). It's not recommended to set `Port` unless the
+ networking behaviors specified in a Route must apply to a specific port
+ as opposed to a listener(s) whose port(s) may be changed. When both Port
+ and SectionName are specified, the name and port of the selected listener
+ must match both specified values.
+
+ <gateway:experimental:description>
+ When the parent resource is a Service, this targets a specific port in the
+ Service spec. When both Port (experimental) and SectionName are specified,
+ the name and port of the selected port must match both specified values.
+ </gateway:experimental:description>
+
+ Implementations MAY choose to support other parent resources.
+ Implementations supporting other types of parent resources MUST clearly
+ document how/if Port is interpreted.
+
+ For the purpose of status, an attachment is considered successful as
+ long as the parent resource accepts it partially. For example, Gateway
+ listeners can restrict which Routes can attach to them by Route kind,
+ namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+ from the referencing Route, the Route MUST be considered successfully
+ attached. If no Gateway listeners accept attachment from this Route,
+ the Route MUST be considered detached from the Gateway.
+
+ Support: Extended
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ sectionName:
+ description: |-
+ SectionName is the name of a section within the target resource. In the
+ following resources, SectionName is interpreted as the following:
+
+ * Gateway: Listener name. When both Port (experimental) and SectionName
+ are specified, the name and port of the selected listener must match
+ both specified values.
+ * Service: Port name. When both Port (experimental) and SectionName
+ are specified, the name and port of the selected listener must match
+ both specified values.
+
+ Implementations MAY choose to support attaching Routes to other resources.
+ If that is the case, they MUST clearly document how SectionName is
+ interpreted.
+
+ When unspecified (empty string), this will reference the entire resource.
+ For the purpose of status, an attachment is considered successful if at
+ least one section in the parent resource accepts it. For example, Gateway
+ listeners can restrict which Routes can attach to them by Route kind,
+ namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+ the referencing Route, the Route MUST be considered successfully
+ attached. If no Gateway listeners accept attachment from this Route, the
+ Route MUST be considered detached from the Gateway.
+
+ Support: Core
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ podTemplate:
+ description: |-
+ Optional pod template used to configure the ACME challenge solver pods
+ used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ type: object
+ spec:
+ description: |-
+ PodSpec defines overrides for the HTTP01 challenge solver pod.
+ Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+ All other fields will be ignored.
+ properties:
+ affinity:
+ description: If specified, the pod's scheduling constraints
+ properties:
+ nodeAffinity:
+ description: Describes node affinity scheduling rules for the pod.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ podAffinity:
+ description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ podAntiAffinity:
+ description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the anti-affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling anti-affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and subtracting
+ "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the anti-affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the anti-affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ imagePullSecrets:
+ description: If specified, the pod's imagePullSecrets
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ NodeSelector is a selector which must be true for the pod to fit on a node.
+ Selector which must match a node's labels for the pod to be scheduled on that node.
+ More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ priorityClassName:
+ description: If specified, the pod's priorityClassName.
+ type: string
+ resources:
+ description: |-
+ If specified, the pod's resource requirements.
+ These values override the global resource configuration flags.
+ Note that when only specifying resource limits, ensure they are greater than or equal
+ to the corresponding global resource requests configured via controller flags
+ (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+ Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+ properties:
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ securityContext:
+ description: If specified, the pod's security context
+ properties:
+ fsGroup:
+ description: |-
+ A special supplemental group that applies to all containers in a pod.
+ Some volume types allow the Kubelet to change the ownership of that volume
+ to be owned by the pod:
+
+ 1. The owning GID will be the FSGroup
+ 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+ 3. The permission bits are OR'd with rw-rw----
+
+ If unset, the Kubelet will not modify the ownership and permissions of any volume.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ fsGroupChangePolicy:
+ description: |-
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+ before being exposed inside Pod. This field will only apply to
+ volume types which support fsGroup based ownership(and permissions).
+ It will have no effect on ephemeral volume types such as: secret, configmaps
+ and emptydir.
+ Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to all containers.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in SecurityContext. If set in
+ both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+ takes precedence for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by the containers in this pod.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ supplementalGroups:
+ description: |-
+ A list of groups applied to the first process run in each container, in addition
+ to the container's primary GID, the fsGroup (if specified), and group memberships
+ defined in the container image for the uid of the container process. If unspecified,
+ no additional groups are added to any container. Note that group memberships
+ defined in the container image for the uid of the container process are still effective,
+ even if they are not included in this list.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ format: int64
+ type: integer
+ type: array
+ x-kubernetes-list-type: atomic
+ sysctls:
+ description: |-
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+ sysctls (by the container runtime) might fail to launch.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ description: Sysctl defines a kernel parameter to be set
+ properties:
+ name:
+ description: Name of a property to set
+ type: string
+ value:
+ description: Value of a property to set
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ serviceAccountName:
+ description: If specified, the pod's service account
+ type: string
+ tolerations:
+ description: If specified, the pod's tolerations.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple <key,value,effect> using the matching operator <operator>.
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ serviceType:
+ description: |-
+ Optional service type for Kubernetes solver service. Supported values
+ are NodePort or ClusterIP. If unset, defaults to NodePort.
+ type: string
+ type: object
+ ingress:
+ description: |-
+ The ingress based HTTP01 challenge solver will solve challenges by
+ creating or modifying Ingress resources in order to route requests for
+ '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+ provisioned by cert-manager for each Challenge to be completed.
+ properties:
+ class:
+ description: |-
+ This field configures the annotation `kubernetes.io/ingress.class` when
+ creating Ingress resources to solve ACME challenges that use this
+ challenge solver. Only one of `class`, `name` or `ingressClassName` may
+ be specified.
+ type: string
+ ingressClassName:
+ description: |-
+ This field configures the field `ingressClassName` on the created Ingress
+ resources used to solve ACME challenges that use this challenge solver.
+ This is the recommended way of configuring the ingress class. Only one of
+ `class`, `name` or `ingressClassName` may be specified.
+ type: string
+ ingressTemplate:
+ description: |-
+ Optional ingress template used to configure the ACME challenge solver
+ ingress used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver ingress.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver ingress.
+ type: object
+ type: object
+ type: object
+ name:
+ description: |-
+ The name of the ingress resource that should have ACME challenge solving
+ routes inserted into it in order to solve HTTP01 challenges.
+ This is typically used in conjunction with ingress controllers like
+ ingress-gce, which maintains a 1:1 mapping between external IPs and
+ ingress resources. Only one of `class`, `name` or `ingressClassName` may
+ be specified.
+ type: string
+ podTemplate:
+ description: |-
+ Optional pod template used to configure the ACME challenge solver pods
+ used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ type: object
+ spec:
+ description: |-
+ PodSpec defines overrides for the HTTP01 challenge solver pod.
+ Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+ All other fields will be ignored.
+ properties:
+ affinity:
+ description: If specified, the pod's scheduling constraints
+ properties:
+ nodeAffinity:
+ description: Describes node affinity scheduling rules for the pod.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ podAffinity:
+ description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ podAntiAffinity:
+ description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the anti-affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling anti-affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and subtracting
+ "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the anti-affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the anti-affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ imagePullSecrets:
+ description: If specified, the pod's imagePullSecrets
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ NodeSelector is a selector which must be true for the pod to fit on a node.
+ Selector which must match a node's labels for the pod to be scheduled on that node.
+ More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ priorityClassName:
+ description: If specified, the pod's priorityClassName.
+ type: string
+ resources:
+ description: |-
+ If specified, the pod's resource requirements.
+ These values override the global resource configuration flags.
+ Note that when only specifying resource limits, ensure they are greater than or equal
+ to the corresponding global resource requests configured via controller flags
+ (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+ Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+ properties:
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ securityContext:
+ description: If specified, the pod's security context
+ properties:
+ fsGroup:
+ description: |-
+ A special supplemental group that applies to all containers in a pod.
+ Some volume types allow the Kubelet to change the ownership of that volume
+ to be owned by the pod:
+
+ 1. The owning GID will be the FSGroup
+ 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+ 3. The permission bits are OR'd with rw-rw----
+
+ If unset, the Kubelet will not modify the ownership and permissions of any volume.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ fsGroupChangePolicy:
+ description: |-
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+ before being exposed inside Pod. This field will only apply to
+ volume types which support fsGroup based ownership(and permissions).
+ It will have no effect on ephemeral volume types such as: secret, configmaps
+ and emptydir.
+ Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to all containers.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in SecurityContext. If set in
+ both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+ takes precedence for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by the containers in this pod.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ supplementalGroups:
+ description: |-
+ A list of groups applied to the first process run in each container, in addition
+ to the container's primary GID, the fsGroup (if specified), and group memberships
+ defined in the container image for the uid of the container process. If unspecified,
+ no additional groups are added to any container. Note that group memberships
+ defined in the container image for the uid of the container process are still effective,
+ even if they are not included in this list.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ format: int64
+ type: integer
+ type: array
+ x-kubernetes-list-type: atomic
+ sysctls:
+ description: |-
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+ sysctls (by the container runtime) might fail to launch.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ description: Sysctl defines a kernel parameter to be set
+ properties:
+ name:
+ description: Name of a property to set
+ type: string
+ value:
+ description: Value of a property to set
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ serviceAccountName:
+ description: If specified, the pod's service account
+ type: string
+ tolerations:
+ description: If specified, the pod's tolerations.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple <key,value,effect> using the matching operator <operator>.
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ serviceType:
+ description: |-
+ Optional service type for Kubernetes solver service. Supported values
+ are NodePort or ClusterIP. If unset, defaults to NodePort.
+ type: string
+ type: object
+ type: object
+ selector:
+ description: |-
+ Selector selects a set of DNSNames on the Certificate resource that
+ should be solved using this challenge solver.
+ If not specified, the solver will be treated as the 'default' solver
+ with the lowest priority, i.e. if any other solver has a more specific
+ match, it will be used instead.
+ properties:
+ dnsNames:
+ description: |-
+ List of DNSNames that this solver will be used to solve.
+ If specified and a match is found, a dnsNames selector will take
+ precedence over a dnsZones selector.
+ If multiple solvers match with the same dnsNames value, the solver
+ with the most matching labels in matchLabels will be selected.
+ If neither has more matches, the solver defined earlier in the list
+ will be selected.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsZones:
+ description: |-
+ List of DNSZones that this solver will be used to solve.
+ The most specific DNS zone match specified here will take precedence
+ over other DNS zone matches, so a solver specifying sys.example.com
+ will be selected over one specifying example.com for the domain
+ www.sys.example.com.
+ If multiple solvers match with the same dnsZones value, the solver
+ with the most matching labels in matchLabels will be selected.
+ If neither has more matches, the solver defined earlier in the list
+ will be selected.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ A label selector that is used to refine the set of certificate's that
+ this challenge solver will apply to.
+ type: object
+ type: object
+ type: object
+ token:
+ description: |-
+ The ACME challenge token for this challenge.
+ This is the raw value returned from the ACME server.
+ type: string
+ type:
+ description: |-
+ The type of ACME challenge this resource represents.
+ One of "HTTP-01" or "DNS-01".
+ enum:
+ - HTTP-01
+ - DNS-01
+ type: string
+ url:
+ description: |-
+ The URL of the ACME Challenge resource for this challenge.
+ This can be used to lookup details about the status of this challenge.
+ type: string
+ wildcard:
+ description: |-
+ wildcard will be true if this challenge is for a wildcard identifier,
+ for example '*.example.com'.
+ type: boolean
+ required:
+ - authorizationURL
+ - dnsName
+ - issuerRef
+ - key
+ - solver
+ - token
+ - type
+ - url
+ type: object
+ status:
+ properties:
+ presented:
+ description: |-
+ presented will be set to true if the challenge values for this challenge
+ are currently 'presented'.
+ This *does not* imply the self check is passing. Only that the values
+ have been 'submitted' for the appropriate challenge mechanism (i.e. the
+ DNS01 TXT record has been presented, or the HTTP01 configuration has been
+ configured).
+ type: boolean
+ processing:
+ description: |-
+ Used to denote whether this challenge should be processed or not.
+ This field will only be set to true by the 'scheduling' component.
+ It will only be set to false by the 'challenges' controller, after the
+ challenge has reached a final state or timed out.
+ If this field is set to false, the challenge controller will not take
+ any more action.
+ type: boolean
+ reason:
+ description: |-
+ Contains human readable information on why the Challenge is in the
+ current state.
+ type: string
+ state:
+ description: |-
+ Contains the current 'state' of the challenge.
+ If not set, the state of the challenge is unknown.
+ enum:
+ - valid
+ - ready
+ - pending
+ - processing
+ - invalid
+ - expired
+ - errored
+ type: string
+ type: object
+ required:
+ - metadata
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
new file mode 100644
index 0000000..3242fc4
--- /dev/null
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
@@ -0,0 +1,274 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ name: "orders.acme.cert-manager.io"
+ {{- if .Values.crds.keep }}
+ annotations:
+ helm.sh/resource-policy: keep
+ {{- end }}
+ labels:
+ {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+ group: acme.cert-manager.io
+ names:
+ categories:
+ - cert-manager
+ - cert-manager-acme
+ kind: Order
+ listKind: OrderList
+ plural: orders
+ singular: order
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .status.state
+ name: State
+ type: string
+ - jsonPath: .spec.issuerRef.name
+ name: Issuer
+ priority: 1
+ type: string
+ - jsonPath: .status.reason
+ name: Reason
+ priority: 1
+ type: string
+ - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: Order is a type to represent an Order with an ACME server
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ commonName:
+ description: |-
+ CommonName is the common name as specified on the DER encoded CSR.
+ If specified, this value must also be present in `dnsNames` or `ipAddresses`.
+ This field must match the corresponding field on the DER encoded CSR.
+ type: string
+ dnsNames:
+ description: |-
+ DNSNames is a list of DNS names that should be included as part of the Order
+ validation process.
+ This field must match the corresponding field on the DER encoded CSR.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ duration:
+ description: |-
+ Duration is the duration for the not after date for the requested certificate.
+ this is set on order creation as pe the ACME spec.
+ type: string
+ ipAddresses:
+ description: |-
+ IPAddresses is a list of IP addresses that should be included as part of the Order
+ validation process.
+ This field must match the corresponding field on the DER encoded CSR.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ issuerRef:
+ description: |-
+ IssuerRef references a properly configured ACME-type Issuer which should
+ be used to create this Order.
+ If the Issuer does not exist, processing will be retried.
+ If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+ Order will be marked as failed.
+ properties:
+ group:
+ description: |-
+ Group of the issuer being referred to.
+ Defaults to 'cert-manager.io'.
+ type: string
+ kind:
+ description: |-
+ Kind of the issuer being referred to.
+ Defaults to 'Issuer'.
+ type: string
+ name:
+ description: Name of the issuer being referred to.
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ Profile allows requesting a certificate profile from the ACME server.
+ Supported profiles are listed by the server's ACME directory URL.
+ type: string
+ request:
+ description: |-
+ Certificate signing request bytes in DER encoding.
+ This will be used when finalizing the order.
+ This field must be set on the order.
+ format: byte
+ type: string
+ required:
+ - issuerRef
+ - request
+ type: object
+ status:
+ properties:
+ authorizations:
+ description: |-
+ Authorizations contains data returned from the ACME server on what
+ authorizations must be completed in order to validate the DNS names
+ specified on the Order.
+ items:
+ description: |-
+ ACMEAuthorization contains data returned from the ACME server on an
+ authorization that must be completed in order validate a DNS name on an ACME
+ Order resource.
+ properties:
+ challenges:
+ description: |-
+ Challenges specifies the challenge types offered by the ACME server.
+ One of these challenge types will be selected when validating the DNS
+ name and an appropriate Challenge resource will be created to perform
+ the ACME challenge process.
+ items:
+ description: |-
+ Challenge specifies a challenge offered by the ACME server for an Order.
+ An appropriate Challenge resource can be created to perform the ACME
+ challenge process.
+ properties:
+ token:
+ description: |-
+ Token is the token that must be presented for this challenge.
+ This is used to compute the 'key' that must also be presented.
+ type: string
+ type:
+ description: |-
+ Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
+ 'tls-sni-01', etc.
+ This is the raw value retrieved from the ACME server.
+ Only 'http-01' and 'dns-01' are supported by cert-manager, other values
+ will be ignored.
+ type: string
+ url:
+ description: |-
+ URL is the URL of this challenge. It can be used to retrieve additional
+ metadata about the Challenge from the ACME server.
+ type: string
+ required:
+ - token
+ - type
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ identifier:
+ description: Identifier is the DNS name to be validated as part of this authorization
+ type: string
+ initialState:
+ description: |-
+ InitialState is the initial state of the ACME authorization when first
+ fetched from the ACME server.
+ If an Authorization is already 'valid', the Order controller will not
+ create a Challenge resource for the authorization. This will occur when
+ working with an ACME server that enables 'authz reuse' (such as Let's
+ Encrypt's production endpoint).
+ If not set and 'identifier' is set, the state is assumed to be pending
+ and a Challenge will be created.
+ enum:
+ - valid
+ - ready
+ - pending
+ - processing
+ - invalid
+ - expired
+ - errored
+ type: string
+ url:
+ description: URL is the URL of the Authorization that must be completed
+ type: string
+ wildcard:
+ description: |-
+ Wildcard will be true if this authorization is for a wildcard DNS name.
+ If this is true, the identifier will be the *non-wildcard* version of
+ the DNS name.
+ For example, if '*.example.com' is the DNS name being validated, this
+ field will be 'true' and the 'identifier' field will be 'example.com'.
+ type: boolean
+ required:
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ certificate:
+ description: |-
+ Certificate is a copy of the PEM encoded certificate for this Order.
+ This field will be populated after the order has been successfully
+ finalized with the ACME server, and the order has transitioned to the
+ 'valid' state.
+ format: byte
+ type: string
+ failureTime:
+ description: |-
+ FailureTime stores the time that this order failed.
+ This is used to influence garbage collection and back-off.
+ format: date-time
+ type: string
+ finalizeURL:
+ description: |-
+ FinalizeURL of the Order.
+ This is used to obtain certificates for this order once it has been completed.
+ type: string
+ reason:
+ description: |-
+ Reason optionally provides more information about a why the order is in
+ the current state.
+ type: string
+ state:
+ description: |-
+ State contains the current state of this Order resource.
+ States 'success' and 'expired' are 'final'
+ enum:
+ - valid
+ - ready
+ - pending
+ - processing
+ - invalid
+ - expired
+ - errored
+ type: string
+ url:
+ description: |-
+ URL of the Order.
+ This will initially be empty when the resource is first created.
+ The Order controller will populate this field when the Order is first processed.
+ This field will be immutable after it is initially set.
+ type: string
+ type: object
+ required:
+ - metadata
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
new file mode 100644
index 0000000..e25ad1d
--- /dev/null
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
@@ -0,0 +1,319 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ name: "certificaterequests.cert-manager.io"
+ {{- if .Values.crds.keep }}
+ annotations:
+ helm.sh/resource-policy: keep
+ {{- end }}
+ labels:
+ {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+ group: cert-manager.io
+ names:
+ categories:
+ - cert-manager
+ kind: CertificateRequest
+ listKind: CertificateRequestList
+ plural: certificaterequests
+ shortNames:
+ - cr
+ - crs
+ singular: certificaterequest
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .status.conditions[?(@.type == "Approved")].status
+ name: Approved
+ type: string
+ - jsonPath: .status.conditions[?(@.type == "Denied")].status
+ name: Denied
+ type: string
+ - jsonPath: .status.conditions[?(@.type == "Ready")].status
+ name: Ready
+ type: string
+ - jsonPath: .spec.issuerRef.name
+ name: Issuer
+ type: string
+ - jsonPath: .spec.username
+ name: Requester
+ type: string
+ - jsonPath: .status.conditions[?(@.type == "Ready")].message
+ name: Status
+ priority: 1
+ type: string
+ - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ A CertificateRequest is used to request a signed certificate from one of the
+ configured issuers.
+
+ All fields within the CertificateRequest's `spec` are immutable after creation.
+ A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
+ condition and its `status.failureTime` field.
+
+ A CertificateRequest is a one-shot resource, meaning it represents a single
+ point in time request for a certificate and cannot be re-used.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ Specification of the desired state of the CertificateRequest resource.
+ https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+ properties:
+ duration:
+ description: |-
+ Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
+ issuer may choose to ignore the requested duration, just like any other
+ requested attribute.
+ type: string
+ extra:
+ additionalProperties:
+ items:
+ type: string
+ type: array
+ description: |-
+ Extra contains extra attributes of the user that created the CertificateRequest.
+ Populated by the cert-manager webhook on creation and immutable.
+ type: object
+ groups:
+ description: |-
+ Groups contains group membership of the user that created the CertificateRequest.
+ Populated by the cert-manager webhook on creation and immutable.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ isCA:
+ description: |-
+ Requested basic constraints isCA value. Note that the issuer may choose
+ to ignore the requested isCA value, just like any other requested attribute.
+
+ NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
+ it must have the same isCA value as specified here.
+
+ If true, this will automatically add the `cert sign` usage to the list
+ of requested `usages`.
+ type: boolean
+ issuerRef:
+ description: |-
+ Reference to the issuer responsible for issuing the certificate.
+ If the issuer is namespace-scoped, it must be in the same namespace
+ as the Certificate. If the issuer is cluster-scoped, it can be used
+ from any namespace.
+
+ The `name` field of the reference must always be specified.
+ properties:
+ group:
+ description: |-
+ Group of the issuer being referred to.
+ Defaults to 'cert-manager.io'.
+ type: string
+ kind:
+ description: |-
+ Kind of the issuer being referred to.
+ Defaults to 'Issuer'.
+ type: string
+ name:
+ description: Name of the issuer being referred to.
+ type: string
+ required:
+ - name
+ type: object
+ request:
+ description: |-
+ The PEM-encoded X.509 certificate signing request to be submitted to the
+ issuer for signing.
+
+ If the CSR has a BasicConstraints extension, its isCA attribute must
+ match the `isCA` value of this CertificateRequest.
+ If the CSR has a KeyUsage extension, its key usages must match the
+ key usages in the `usages` field of this CertificateRequest.
+ If the CSR has a ExtKeyUsage extension, its extended key usages
+ must match the extended key usages in the `usages` field of this
+ CertificateRequest.
+ format: byte
+ type: string
+ uid:
+ description: |-
+ UID contains the uid of the user that created the CertificateRequest.
+ Populated by the cert-manager webhook on creation and immutable.
+ type: string
+ usages:
+ description: |-
+ Requested key usages and extended key usages.
+
+ NOTE: If the CSR in the `Request` field has uses the KeyUsage or
+ ExtKeyUsage extension, these extensions must have the same values
+ as specified here without any additional values.
+
+ If unset, defaults to `digital signature` and `key encipherment`.
+ items:
+ description: |-
+ KeyUsage specifies valid usage contexts for keys.
+ See:
+ https://tools.ietf.org/html/rfc5280#section-4.2.1.3
+ https://tools.ietf.org/html/rfc5280#section-4.2.1.12
+
+ Valid KeyUsage values are as follows:
+ "signing",
+ "digital signature",
+ "content commitment",
+ "key encipherment",
+ "key agreement",
+ "data encipherment",
+ "cert sign",
+ "crl sign",
+ "encipher only",
+ "decipher only",
+ "any",
+ "server auth",
+ "client auth",
+ "code signing",
+ "email protection",
+ "s/mime",
+ "ipsec end system",
+ "ipsec tunnel",
+ "ipsec user",
+ "timestamping",
+ "ocsp signing",
+ "microsoft sgc",
+ "netscape sgc"
+ enum:
+ - signing
+ - digital signature
+ - content commitment
+ - key encipherment
+ - key agreement
+ - data encipherment
+ - cert sign
+ - crl sign
+ - encipher only
+ - decipher only
+ - any
+ - server auth
+ - client auth
+ - code signing
+ - email protection
+ - s/mime
+ - ipsec end system
+ - ipsec tunnel
+ - ipsec user
+ - timestamping
+ - ocsp signing
+ - microsoft sgc
+ - netscape sgc
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ username:
+ description: |-
+ Username contains the name of the user that created the CertificateRequest.
+ Populated by the cert-manager webhook on creation and immutable.
+ type: string
+ required:
+ - issuerRef
+ - request
+ type: object
+ status:
+ description: |-
+ Status of the CertificateRequest.
+ This is set and managed automatically.
+ Read-only.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+ properties:
+ ca:
+ description: |-
+ The PEM encoded X.509 certificate of the signer, also known as the CA
+ (Certificate Authority).
+ This is set on a best-effort basis by different issuers.
+ If not set, the CA is assumed to be unknown/not available.
+ format: byte
+ type: string
+ certificate:
+ description: |-
+ The PEM encoded X.509 certificate resulting from the certificate
+ signing request.
+ If not set, the CertificateRequest has either not been completed or has
+ failed. More information on failure can be found by checking the
+ `conditions` field.
+ format: byte
+ type: string
+ conditions:
+ description: |-
+ List of status conditions to indicate the status of a CertificateRequest.
+ Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
+ items:
+ description: CertificateRequestCondition contains condition information for a CertificateRequest.
+ properties:
+ lastTransitionTime:
+ description: |-
+ LastTransitionTime is the timestamp corresponding to the last status
+ change of this condition.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ Message is a human readable description of the details of the last
+ transition, complementing reason.
+ type: string
+ reason:
+ description: |-
+ Reason is a brief machine readable explanation for the condition's last
+ transition.
+ type: string
+ status:
+ description: Status of the condition, one of (`True`, `False`, `Unknown`).
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: |-
+ Type of the condition, known values are (`Ready`, `InvalidRequest`,
+ `Approved`, `Denied`).
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ failureTime:
+ description: |-
+ FailureTime stores the time that this CertificateRequest failed. This is
+ used to influence garbage collection and back-off.
+ format: date-time
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
new file mode 100644
index 0000000..6689de6
--- /dev/null
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
@@ -0,0 +1,816 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ name: "certificates.cert-manager.io"
+ {{- if .Values.crds.keep }}
+ annotations:
+ helm.sh/resource-policy: keep
+ {{- end }}
+ labels:
+ {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+ group: cert-manager.io
+ names:
+ categories:
+ - cert-manager
+ kind: Certificate
+ listKind: CertificateList
+ plural: certificates
+ shortNames:
+ - cert
+ - certs
+ singular: certificate
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .status.conditions[?(@.type == "Ready")].status
+ name: Ready
+ type: string
+ - jsonPath: .spec.secretName
+ name: Secret
+ type: string
+ - jsonPath: .spec.issuerRef.name
+ name: Issuer
+ priority: 1
+ type: string
+ - jsonPath: .status.conditions[?(@.type == "Ready")].message
+ name: Status
+ priority: 1
+ type: string
+ - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ A Certificate resource should be created to ensure an up to date and signed
+ X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
+
+ The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ Specification of the desired state of the Certificate resource.
+ https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+ properties:
+ additionalOutputFormats:
+ description: |-
+ Defines extra output formats of the private key and signed certificate chain
+ to be written to this Certificate's target Secret.
+ items:
+ description: |-
+ CertificateAdditionalOutputFormat defines an additional output format of a
+ Certificate resource. These contain supplementary data formats of the signed
+ certificate chain and paired private key.
+ properties:
+ type:
+ description: |-
+ Type is the name of the format type that should be written to the
+ Certificate's target Secret.
+ enum:
+ - DER
+ - CombinedPEM
+ type: string
+ required:
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ commonName:
+ description: |-
+ Requested common name X509 certificate subject attribute.
+ More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
+ NOTE: TLS clients will ignore this value when any subject alternative name is
+ set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
+
+ Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
+ Cannot be set if the `literalSubject` field is set.
+ type: string
+ dnsNames:
+ description: Requested DNS subject alternative names.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ duration:
+ description: |-
+ Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
+ issuer may choose to ignore the requested duration, just like any other
+ requested attribute.
+
+ If unset, this defaults to 90 days.
+ Minimum accepted duration is 1 hour.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+ type: string
+ emailAddresses:
+ description: Requested email subject alternative names.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ encodeUsagesInRequest:
+ description: |-
+ Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
+
+ This option defaults to true, and should only be disabled if the target
+ issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
+ type: boolean
+ ipAddresses:
+ description: Requested IP address subject alternative names.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ isCA:
+ description: |-
+ Requested basic constraints isCA value.
+ The isCA value is used to set the `isCA` field on the created CertificateRequest
+ resources. Note that the issuer may choose to ignore the requested isCA value, just
+ like any other requested attribute.
+
+ If true, this will automatically add the `cert sign` usage to the list
+ of requested `usages`.
+ type: boolean
+ issuerRef:
+ description: |-
+ Reference to the issuer responsible for issuing the certificate.
+ If the issuer is namespace-scoped, it must be in the same namespace
+ as the Certificate. If the issuer is cluster-scoped, it can be used
+ from any namespace.
+
+ The `name` field of the reference must always be specified.
+ properties:
+ group:
+ description: |-
+ Group of the issuer being referred to.
+ Defaults to 'cert-manager.io'.
+ type: string
+ kind:
+ description: |-
+ Kind of the issuer being referred to.
+ Defaults to 'Issuer'.
+ type: string
+ name:
+ description: Name of the issuer being referred to.
+ type: string
+ required:
+ - name
+ type: object
+ keystores:
+ description: Additional keystore output formats to be stored in the Certificate's Secret.
+ properties:
+ jks:
+ description: |-
+ JKS configures options for storing a JKS keystore in the
+ `spec.secretName` Secret resource.
+ properties:
+ alias:
+ description: |-
+ Alias specifies the alias of the key in the keystore, required by the JKS format.
+ If not provided, the default alias `certificate` will be used.
+ type: string
+ create:
+ description: |-
+ Create enables JKS keystore creation for the Certificate.
+ If true, a file named `keystore.jks` will be created in the target
+ Secret resource, encrypted using the password stored in
+ `passwordSecretRef` or `password`.
+ The keystore file will be updated immediately.
+ If the issuer provided a CA certificate, a file named `truststore.jks`
+ will also be created in the target Secret resource, encrypted using the
+ password stored in `passwordSecretRef`
+ containing the issuing Certificate Authority
+ type: boolean
+ password:
+ description: |-
+ Password provides a literal password used to encrypt the JKS keystore.
+ Mutually exclusive with passwordSecretRef.
+ One of password or passwordSecretRef must provide a password with a non-zero length.
+ type: string
+ passwordSecretRef:
+ description: |-
+ PasswordSecretRef is a reference to a non-empty key in a Secret resource
+ containing the password used to encrypt the JKS keystore.
+ Mutually exclusive with password.
+ One of password or passwordSecretRef must provide a password with a non-zero length.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - create
+ type: object
+ pkcs12:
+ description: |-
+ PKCS12 configures options for storing a PKCS12 keystore in the
+ `spec.secretName` Secret resource.
+ properties:
+ create:
+ description: |-
+ Create enables PKCS12 keystore creation for the Certificate.
+ If true, a file named `keystore.p12` will be created in the target
+ Secret resource, encrypted using the password stored in
+ `passwordSecretRef` or in `password`.
+ The keystore file will be updated immediately.
+ If the issuer provided a CA certificate, a file named `truststore.p12` will
+ also be created in the target Secret resource, encrypted using the
+ password stored in `passwordSecretRef` containing the issuing Certificate
+ Authority
+ type: boolean
+ password:
+ description: |-
+ Password provides a literal password used to encrypt the PKCS#12 keystore.
+ Mutually exclusive with passwordSecretRef.
+ One of password or passwordSecretRef must provide a password with a non-zero length.
+ type: string
+ passwordSecretRef:
+ description: |-
+ PasswordSecretRef is a reference to a non-empty key in a Secret resource
+ containing the password used to encrypt the PKCS#12 keystore.
+ Mutually exclusive with password.
+ One of password or passwordSecretRef must provide a password with a non-zero length.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
+ used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
+
+ If provided, allowed values are:
+ `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
+ `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
+ `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
+ (e.g., because of company policy). Please note that the security of the algorithm is not that important
+ in reality, because the unencrypted certificate and private key are also stored in the Secret.
+ enum:
+ - LegacyRC2
+ - LegacyDES
+ - Modern2023
+ type: string
+ required:
+ - create
+ type: object
+ type: object
+ literalSubject:
+ description: |-
+ Requested X.509 certificate subject, represented using the LDAP "String
+ Representation of a Distinguished Name" [1].
+ Important: the LDAP string format also specifies the order of the attributes
+ in the subject, this is important when issuing certs for LDAP authentication.
+ Example: `CN=foo,DC=corp,DC=example,DC=com`
+ More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
+ More info: https://github.com/cert-manager/cert-manager/issues/3203
+ More info: https://github.com/cert-manager/cert-manager/issues/4424
+
+ Cannot be set if the `subject` or `commonName` field is set.
+ type: string
+ nameConstraints:
+ description: |-
+ x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
+ More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
+
+ This is an Alpha Feature and is only enabled with the
+ `--feature-gates=NameConstraints=true` option set on both
+ the controller and webhook components.
+ properties:
+ critical:
+ description: if true then the name constraints are marked critical.
+ type: boolean
+ excluded:
+ description: |-
+ Excluded contains the constraints which must be disallowed. Any name matching a
+ restriction in the excluded field is invalid regardless
+ of information appearing in the permitted
+ properties:
+ dnsDomains:
+ description: DNSDomains is a list of DNS domains that are permitted or excluded.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ emailAddresses:
+ description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ ipRanges:
+ description: |-
+ IPRanges is a list of IP Ranges that are permitted or excluded.
+ This should be a valid CIDR notation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ uriDomains:
+ description: URIDomains is a list of URI domains that are permitted or excluded.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ permitted:
+ description: Permitted contains the constraints in which the names must be located.
+ properties:
+ dnsDomains:
+ description: DNSDomains is a list of DNS domains that are permitted or excluded.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ emailAddresses:
+ description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ ipRanges:
+ description: |-
+ IPRanges is a list of IP Ranges that are permitted or excluded.
+ This should be a valid CIDR notation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ uriDomains:
+ description: URIDomains is a list of URI domains that are permitted or excluded.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ otherNames:
+ description: |-
+ `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
+ Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
+ Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
+ You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
+ items:
+ properties:
+ oid:
+ description: |-
+ OID is the object identifier for the otherName SAN.
+ The object identifier must be expressed as a dotted string, for
+ example, "1.2.840.113556.1.4.221".
+ type: string
+ utf8Value:
+ description: |-
+ utf8Value is the string value of the otherName SAN.
+ The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ privateKey:
+ description: |-
+ Private key options. These include the key algorithm and size, the used
+ encoding and the rotation policy.
+ properties:
+ algorithm:
+ description: |-
+ Algorithm is the private key algorithm of the corresponding private key
+ for this certificate.
+
+ If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
+ If `algorithm` is specified and `size` is not provided,
+ key size of 2048 will be used for `RSA` key algorithm and
+ key size of 256 will be used for `ECDSA` key algorithm.
+ key size is ignored when using the `Ed25519` key algorithm.
+ enum:
+ - RSA
+ - ECDSA
+ - Ed25519
+ type: string
+ encoding:
+ description: |-
+ The private key cryptography standards (PKCS) encoding for this
+ certificate's private key to be encoded in.
+
+ If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
+ and PKCS#8, respectively.
+ Defaults to `PKCS1` if not specified.
+ enum:
+ - PKCS1
+ - PKCS8
+ type: string
+ rotationPolicy:
+ description: |-
+ RotationPolicy controls how private keys should be regenerated when a
+ re-issuance is being processed.
+
+ If set to `Never`, a private key will only be generated if one does not
+ already exist in the target `spec.secretName`. If one does exist but it
+ does not have the correct algorithm or size, a warning will be raised
+ to await user intervention.
+ If set to `Always`, a private key matching the specified requirements
+ will be generated whenever a re-issuance occurs.
+ Default is `Always`.
+ The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+ The new default can be disabled by setting the
+ `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+ the controller component.
+ enum:
+ - Never
+ - Always
+ type: string
+ size:
+ description: |-
+ Size is the key bit size of the corresponding private key for this certificate.
+
+ If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
+ and will default to `2048` if not specified.
+ If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
+ and will default to `256` if not specified.
+ If `algorithm` is set to `Ed25519`, Size is ignored.
+ No other values are allowed.
+ type: integer
+ type: object
+ renewBefore:
+ description: |-
+ How long before the currently issued certificate's expiry cert-manager should
+ renew the certificate. For example, if a certificate is valid for 60 minutes,
+ and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
+ 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
+ the certificate is no longer valid).
+
+ NOTE: The actual lifetime of the issued certificate is used to determine the
+ renewal time. If an issuer returns a certificate with a different lifetime than
+ the one requested, cert-manager will use the lifetime of the issued certificate.
+
+ If unset, this defaults to 1/3 of the issued certificate's lifetime.
+ Minimum accepted value is 5 minutes.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+ Cannot be set if the `renewBeforePercentage` field is set.
+ type: string
+ renewBeforePercentage:
+ description: |-
+ `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
+ rather than an absolute duration. For example, if a certificate is valid for 60
+ minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to
+ renew the certificate 45 minutes after it was issued (i.e. when there are 15
+ minutes (25%) remaining until the certificate is no longer valid).
+
+ NOTE: The actual lifetime of the issued certificate is used to determine the
+ renewal time. If an issuer returns a certificate with a different lifetime than
+ the one requested, cert-manager will use the lifetime of the issued certificate.
+
+ Value must be an integer in the range (0,100). The minimum effective
+ `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
+ minutes.
+ Cannot be set if the `renewBefore` field is set.
+ format: int32
+ type: integer
+ revisionHistoryLimit:
+ description: |-
+ The maximum number of CertificateRequest revisions that are maintained in
+ the Certificate's history. Each revision represents a single `CertificateRequest`
+ created by this Certificate, either when it was created, renewed, or Spec
+ was changed. Revisions will be removed by oldest first if the number of
+ revisions exceeds this number.
+
+ If set, revisionHistoryLimit must be a value of `1` or greater.
+ Default value is `1`.
+ format: int32
+ type: integer
+ secretName:
+ description: |-
+ Name of the Secret resource that will be automatically created and
+ managed by this Certificate resource. It will be populated with a
+ private key and certificate, signed by the denoted issuer. The Secret
+ resource lives in the same namespace as the Certificate resource.
+ type: string
+ secretTemplate:
+ description: |-
+ Defines annotations and labels to be copied to the Certificate's Secret.
+ Labels and annotations on the Secret will be changed as they appear on the
+ SecretTemplate when added or removed. SecretTemplate annotations are added
+ in conjunction with, and cannot overwrite, the base set of annotations
+ cert-manager sets on the Certificate's Secret.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations is a key value map to be copied to the target Kubernetes Secret.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels is a key value map to be copied to the target Kubernetes Secret.
+ type: object
+ type: object
+ signatureAlgorithm:
+ description: |-
+ Signature algorithm to use.
+ Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
+ Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
+ Allowed values for Ed25519 keys: PureEd25519.
+ enum:
+ - SHA256WithRSA
+ - SHA384WithRSA
+ - SHA512WithRSA
+ - ECDSAWithSHA256
+ - ECDSAWithSHA384
+ - ECDSAWithSHA512
+ - PureEd25519
+ type: string
+ subject:
+ description: |-
+ Requested set of X509 certificate subject attributes.
+ More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
+
+ The common name attribute is specified separately in the `commonName` field.
+ Cannot be set if the `literalSubject` field is set.
+ properties:
+ countries:
+ description: Countries to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ localities:
+ description: Cities to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ organizationalUnits:
+ description: Organizational Units to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ organizations:
+ description: Organizations to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ postalCodes:
+ description: Postal codes to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ provinces:
+ description: State/Provinces to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serialNumber:
+ description: Serial number to be used on the Certificate.
+ type: string
+ streetAddresses:
+ description: Street addresses to be used on the Certificate.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ uris:
+ description: Requested URI subject alternative names.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ usages:
+ description: |-
+ Requested key usages and extended key usages.
+ These usages are used to set the `usages` field on the created CertificateRequest
+ resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
+ will additionally be encoded in the `request` field which contains the CSR blob.
+
+ If unset, defaults to `digital signature` and `key encipherment`.
+ items:
+ description: |-
+ KeyUsage specifies valid usage contexts for keys.
+ See:
+ https://tools.ietf.org/html/rfc5280#section-4.2.1.3
+ https://tools.ietf.org/html/rfc5280#section-4.2.1.12
+
+ Valid KeyUsage values are as follows:
+ "signing",
+ "digital signature",
+ "content commitment",
+ "key encipherment",
+ "key agreement",
+ "data encipherment",
+ "cert sign",
+ "crl sign",
+ "encipher only",
+ "decipher only",
+ "any",
+ "server auth",
+ "client auth",
+ "code signing",
+ "email protection",
+ "s/mime",
+ "ipsec end system",
+ "ipsec tunnel",
+ "ipsec user",
+ "timestamping",
+ "ocsp signing",
+ "microsoft sgc",
+ "netscape sgc"
+ enum:
+ - signing
+ - digital signature
+ - content commitment
+ - key encipherment
+ - key agreement
+ - data encipherment
+ - cert sign
+ - crl sign
+ - encipher only
+ - decipher only
+ - any
+ - server auth
+ - client auth
+ - code signing
+ - email protection
+ - s/mime
+ - ipsec end system
+ - ipsec tunnel
+ - ipsec user
+ - timestamping
+ - ocsp signing
+ - microsoft sgc
+ - netscape sgc
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - issuerRef
+ - secretName
+ type: object
+ status:
+ description: |-
+ Status of the Certificate.
+ This is set and managed automatically.
+ Read-only.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+ properties:
+ conditions:
+ description: |-
+ List of status conditions to indicate the status of certificates.
+ Known condition types are `Ready` and `Issuing`.
+ items:
+ description: CertificateCondition contains condition information for a Certificate.
+ properties:
+ lastTransitionTime:
+ description: |-
+ LastTransitionTime is the timestamp corresponding to the last status
+ change of this condition.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ Message is a human readable description of the details of the last
+ transition, complementing reason.
+ type: string
+ observedGeneration:
+ description: |-
+ If set, this represents the .metadata.generation that the condition was
+ set based upon.
+ For instance, if .metadata.generation is currently 12, but the
+ .status.condition[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the Certificate.
+ format: int64
+ type: integer
+ reason:
+ description: |-
+ Reason is a brief machine readable explanation for the condition's last
+ transition.
+ type: string
+ status:
+ description: Status of the condition, one of (`True`, `False`, `Unknown`).
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: Type of the condition, known values are (`Ready`, `Issuing`).
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ failedIssuanceAttempts:
+ description: |-
+ The number of continuous failed issuance attempts up till now. This
+ field gets removed (if set) on a successful issuance and gets set to
+ 1 if unset and an issuance has failed. If an issuance has failed, the
+ delay till the next issuance will be calculated using formula
+ time.Hour * 2 ^ (failedIssuanceAttempts - 1).
+ type: integer
+ lastFailureTime:
+ description: |-
+ LastFailureTime is set only if the latest issuance for this
+ Certificate failed and contains the time of the failure. If an
+ issuance has failed, the delay till the next issuance will be
+ calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
+ 1). If the latest issuance has succeeded this field will be unset.
+ format: date-time
+ type: string
+ nextPrivateKeySecretName:
+ description: |-
+ The name of the Secret resource containing the private key to be used
+ for the next certificate iteration.
+ The keymanager controller will automatically set this field if the
+ `Issuing` condition is set to `True`.
+ It will automatically unset this field when the Issuing condition is
+ not set or False.
+ type: string
+ notAfter:
+ description: |-
+ The expiration time of the certificate stored in the secret named
+ by this resource in `spec.secretName`.
+ format: date-time
+ type: string
+ notBefore:
+ description: |-
+ The time after which the certificate stored in the secret named
+ by this resource in `spec.secretName` is valid.
+ format: date-time
+ type: string
+ renewalTime:
+ description: |-
+ RenewalTime is the time at which the certificate will be next
+ renewed.
+ If not set, no upcoming renewal is scheduled.
+ format: date-time
+ type: string
+ revision:
+ description: |-
+ The current 'revision' of the certificate as issued.
+
+ When a CertificateRequest resource is created, it will have the
+ `cert-manager.io/certificate-revision` set to one greater than the
+ current value of this field.
+
+ Upon issuance, this field will be set to the value of the annotation
+ on the CertificateRequest resource used to issue the certificate.
+
+ Persisting the value on the CertificateRequest resource allows the
+ certificates controller to know whether a request is part of an old
+ issuance or if it is part of the ongoing revision's issuance by
+ checking if the revision value in the annotation is greater than this
+ field.
+ type: integer
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
new file mode 100644
index 0000000..a9ecd4f
--- /dev/null
+++ b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -0,0 +1,3815 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ name: "clusterissuers.cert-manager.io"
+ {{- if .Values.crds.keep }}
+ annotations:
+ helm.sh/resource-policy: keep
+ {{- end }}
+ labels:
+ {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+ group: cert-manager.io
+ names:
+ categories:
+ - cert-manager
+ kind: ClusterIssuer
+ listKind: ClusterIssuerList
+ plural: clusterissuers
+ shortNames:
+ - ciss
+ singular: clusterissuer
+ scope: Cluster
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .status.conditions[?(@.type == "Ready")].status
+ name: Ready
+ type: string
+ - jsonPath: .status.conditions[?(@.type == "Ready")].message
+ name: Status
+ priority: 1
+ type: string
+ - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ A ClusterIssuer represents a certificate issuing authority which can be
+ referenced as part of `issuerRef` fields.
+ It is similar to an Issuer, however it is cluster-scoped and therefore can
+ be referenced by resources that exist in *any* namespace, not just the same
+ namespace as the referent.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: Desired state of the ClusterIssuer resource.
+ properties:
+ acme:
+ description: |-
+ ACME configures this issuer to communicate with a RFC8555 (ACME) server
+ to obtain signed x509 certificates.
+ properties:
+ caBundle:
+ description: |-
+ Base64-encoded bundle of PEM CAs which can be used to validate the certificate
+ chain presented by the ACME server.
+ Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
+ kinds of security vulnerabilities.
+ If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+ the container is used to validate the TLS connection.
+ format: byte
+ type: string
+ disableAccountKeyGeneration:
+ description: |-
+ Enables or disables generating a new ACME account key.
+ If true, the Issuer resource will *not* request a new account but will expect
+ the account key to be supplied via an existing secret.
+ If false, the cert-manager system will generate a new ACME account key
+ for the Issuer.
+ Defaults to false.
+ type: boolean
+ email:
+ description: |-
+ Email is the email address to be associated with the ACME account.
+ This field is optional, but it is strongly recommended to be set.
+ It will be used to contact you in case of issues with your account or
+ certificates, including expiry notification emails.
+ This field may be updated after the account is initially registered.
+ type: string
+ enableDurationFeature:
+ description: |-
+ Enables requesting a Not After date on certificates that matches the
+ duration of the certificate. This is not supported by all ACME servers
+ like Let's Encrypt. If set to true when the ACME server does not support
+ it, it will create an error on the Order.
+ Defaults to false.
+ type: boolean
+ externalAccountBinding:
+ description: |-
+ ExternalAccountBinding is a reference to a CA external account of the ACME
+ server.
+ If set, upon registration cert-manager will attempt to associate the given
+ external account credentials with the registered ACME account.
+ properties:
+ keyAlgorithm:
+ description: |-
+ Deprecated: keyAlgorithm field exists for historical compatibility
+ reasons and should not be used. The algorithm is now hardcoded to HS256
+ in golang/x/crypto/acme.
+ enum:
+ - HS256
+ - HS384
+ - HS512
+ type: string
+ keyID:
+ description: keyID is the ID of the CA key that the External Account is bound to.
+ type: string
+ keySecretRef:
+ description: |-
+ keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
+ Secret which holds the symmetric MAC key of the External Account Binding.
+ The `key` is the index string that is paired with the key data in the
+ Secret and should not be confused with the key data itself, or indeed with
+ the External Account Binding keyID above.
+ The secret key stored in the Secret **must** be un-padded, base64 URL
+ encoded data.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - keyID
+ - keySecretRef
+ type: object
+ preferredChain:
+ description: |-
+ PreferredChain is the chain to use if the ACME server outputs multiple.
+ PreferredChain is no guarantee that this one gets delivered by the ACME
+ endpoint.
+ For example, for Let's Encrypt's DST cross-sign you would use:
+ "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
+ This value picks the first certificate bundle in the combined set of
+ ACME default and alternative chains that has a root-most certificate with
+ this value as its issuer's commonname.
+ maxLength: 64
+ type: string
+ privateKeySecretRef:
+ description: |-
+ PrivateKey is the name of a Kubernetes Secret resource that will be used to
+ store the automatically generated ACME account private key.
+ Optionally, a `key` may be specified to select a specific entry within
+ the named Secret resource.
+ If `key` is not specified, a default of `tls.key` will be used.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ Profile allows requesting a certificate profile from the ACME server.
+ Supported profiles are listed by the server's ACME directory URL.
+ type: string
+ server:
+ description: |-
+ Server is the URL used to access the ACME server's 'directory' endpoint.
+ For example, for Let's Encrypt's staging endpoint, you would use:
+ "https://acme-staging-v02.api.letsencrypt.org/directory".
+ Only ACME v2 endpoints (i.e. RFC 8555) are supported.
+ type: string
+ skipTLSVerify:
+ description: |-
+ INSECURE: Enables or disables validation of the ACME server TLS certificate.
+ If true, requests to the ACME server will not have the TLS certificate chain
+ validated.
+ Mutually exclusive with CABundle; prefer using CABundle to prevent various
+ kinds of security vulnerabilities.
+ Only enable this option in development environments.
+ If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+ the container is used to validate the TLS connection.
+ Defaults to false.
+ type: boolean
+ solvers:
+ description: |-
+ Solvers is a list of challenge solvers that will be used to solve
+ ACME challenges for the matching domains.
+ Solver configurations must be provided in order to obtain certificates
+ from an ACME server.
+ For more information, see: https://cert-manager.io/docs/configuration/acme/
+ items:
+ description: |-
+ An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
+ A selector may be provided to use different solving strategies for different DNS names.
+ Only one of HTTP01 or DNS01 must be provided.
+ properties:
+ dns01:
+ description: |-
+ Configures cert-manager to attempt to complete authorizations by
+ performing the DNS01 challenge flow.
+ properties:
+ acmeDNS:
+ description: |-
+ Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
+ DNS01 challenge records.
+ properties:
+ accountSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ host:
+ type: string
+ required:
+ - accountSecretRef
+ - host
+ type: object
+ akamai:
+ description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
+ properties:
+ accessTokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientTokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ serviceConsumerDomain:
+ type: string
+ required:
+ - accessTokenSecretRef
+ - clientSecretSecretRef
+ - clientTokenSecretRef
+ - serviceConsumerDomain
+ type: object
+ azureDNS:
+ description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
+ properties:
+ clientID:
+ description: |-
+ Auth: Azure Service Principal:
+ The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
+ If set, ClientSecret and TenantID must also be set.
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ Auth: Azure Service Principal:
+ A reference to a Secret containing the password associated with the Service Principal.
+ If set, ClientID and TenantID must also be set.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ environment:
+ description: name of the Azure environment (default AzurePublicCloud)
+ enum:
+ - AzurePublicCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureUSGovernmentCloud
+ type: string
+ hostedZoneName:
+ description: name of the DNS zone that should be used
+ type: string
+ managedIdentity:
+ description: |-
+ Auth: Azure Workload Identity or Azure Managed Service Identity:
+ Settings to enable Azure Workload Identity or Azure Managed Service Identity
+ If set, ClientID, ClientSecret and TenantID must not be set.
+ properties:
+ clientID:
+ description: client ID of the managed identity, cannot be used at the same time as resourceID
+ type: string
+ resourceID:
+ description: |-
+ resource ID of the managed identity, cannot be used at the same time as clientID
+ Cannot be used for Azure Managed Service Identity
+ type: string
+ tenantID:
+ description: tenant ID of the managed identity, cannot be used at the same time as resourceID
+ type: string
+ type: object
+ resourceGroupName:
+ description: resource group the DNS zone is located in
+ type: string
+ subscriptionID:
+ description: ID of the Azure subscription
+ type: string
+ tenantID:
+ description: |-
+ Auth: Azure Service Principal:
+ The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
+ If set, ClientID and ClientSecret must also be set.
+ type: string
+ required:
+ - resourceGroupName
+ - subscriptionID
+ type: object
+ cloudDNS:
+ description: Use the Google Cloud DNS API to manage DNS01 challenge records.
+ properties:
+ hostedZoneName:
+ description: |-
+ HostedZoneName is an optional field that tells cert-manager in which
+ Cloud DNS zone the challenge record has to be created.
+ If left empty cert-manager will automatically choose a zone.
+ type: string
+ project:
+ type: string
+ serviceAccountSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - project
+ type: object
+ cloudflare:
+ description: Use the Cloudflare API to manage DNS01 challenge records.
+ properties:
+ apiKeySecretRef:
+ description: |-
+ API key to use to authenticate with Cloudflare.
+ Note: using an API token to authenticate is now the recommended method
+ as it allows greater control of permissions.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ apiTokenSecretRef:
+ description: API token used to authenticate with Cloudflare.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ email:
+ description: Email of the account, only required when using API key based authentication.
+ type: string
+ type: object
+ cnameStrategy:
+ description: |-
+ CNAMEStrategy configures how the DNS01 provider should handle CNAME
+ records when found in DNS zones.
+ enum:
+ - None
+ - Follow
+ type: string
+ digitalocean:
+ description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
+ properties:
+ tokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - tokenSecretRef
+ type: object
+ rfc2136:
+ description: |-
+ Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
+ to manage DNS01 challenge records.
+ properties:
+ nameserver:
+ description: |-
+ The IP address or hostname of an authoritative DNS server supporting
+ RFC2136 in the form host:port. If the host is an IPv6 address it must be
+ enclosed in square brackets (e.g [2001:db8::1]); port is optional.
+ This field is required.
+ type: string
+ protocol:
+ description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
+ enum:
+ - TCP
+ - UDP
+ type: string
+ tsigAlgorithm:
+ description: |-
+ The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+ when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+ Supported values are (case-insensitive): ``HMACMD5`` (default),
+ ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+ type: string
+ tsigKeyName:
+ description: |-
+ The TSIG Key name configured in the DNS.
+ If ``tsigSecretSecretRef`` is defined, this field is required.
+ type: string
+ tsigSecretSecretRef:
+ description: |-
+ The name of the secret containing the TSIG value.
+ If ``tsigKeyName`` is defined, this field is required.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - nameserver
+ type: object
+ route53:
+ description: Use the AWS Route53 API to manage DNS01 challenge records.
+ properties:
+ accessKeyID:
+ description: |-
+ The AccessKeyID is used for authentication.
+ Cannot be set when SecretAccessKeyID is set.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ type: string
+ accessKeyIDSecretRef:
+ description: |-
+ The SecretAccessKey is used for authentication. If set, pull the AWS
+ access key ID from a key within a Kubernetes Secret.
+ Cannot be set when AccessKeyID is set.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ auth:
+ description: Auth configures how cert-manager authenticates.
+ properties:
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
+ by passing a bound ServiceAccount token.
+ properties:
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a bound
+ token (also known as "projected token"). To use this field, you must
+ configure an RBAC rule to let cert-manager request a token.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of audiences to include in the
+ token passed to AWS. The default token consisting of the issuer's namespace
+ and name is always included.
+ If unset the audience defaults to `sts.amazonaws.com`.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ required:
+ - kubernetes
+ type: object
+ hostedZoneID:
+ description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
+ type: string
+ region:
+ description: |-
+ Override the AWS region.
+
+ Route53 is a global service and does not have regional endpoints but the
+ region specified here (or via environment variables) is used as a hint to
+ help compute the correct AWS credential scope and partition when it
+ connects to Route53. See:
+ - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
+ - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
+
+ If you omit this region field, cert-manager will use the region from
+ AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
+ in the cert-manager controller Pod.
+
+ The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+ Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+ [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
+ In this case this `region` field value is ignored.
+
+ The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
+ Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+ [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
+ In this case this `region` field value is ignored.
+ type: string
+ role:
+ description: |-
+ Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+ or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+ type: string
+ secretAccessKeySecretRef:
+ description: |-
+ The SecretAccessKey is used for authentication.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ webhook:
+ description: |-
+ Configure an external webhook based DNS01 challenge solver to manage
+ DNS01 challenge records.
+ properties:
+ config:
+ description: |-
+ Additional configuration that should be passed to the webhook apiserver
+ when challenges are processed.
+ This can contain arbitrary JSON data.
+ Secret values should not be specified in this stanza.
+ If secret values are needed (e.g., credentials for a DNS service), you
+ should use a SecretKeySelector to reference a Secret resource.
+ For details on the schema of this field, consult the webhook provider
+ implementation's documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ groupName:
+ description: |-
+ The API group name that should be used when POSTing ChallengePayload
+ resources to the webhook apiserver.
+ This should be the same as the GroupName specified in the webhook
+ provider implementation.
+ type: string
+ solverName:
+ description: |-
+ The name of the solver to use, as defined in the webhook provider
+ implementation.
+ This will typically be the name of the provider, e.g., 'cloudflare'.
+ type: string
+ required:
+ - groupName
+ - solverName
+ type: object
+ type: object
+ http01:
+ description: |-
+ Configures cert-manager to attempt to complete authorizations by
+ performing the HTTP01 challenge flow.
+ It is not possible to obtain certificates for wildcard domain names
+ (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
+ properties:
+ gatewayHTTPRoute:
+ description: |-
+ The Gateway API is a sig-network community API that models service networking
+ in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
+ create HTTPRoutes with the specified labels in the same namespace as the challenge.
+ This solver is experimental, and fields / behaviour may change in the future.
+ properties:
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ Custom labels that will be applied to HTTPRoutes created by cert-manager
+ while solving HTTP-01 challenges.
+ type: object
+ parentRefs:
+ description: |-
+ When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
+ cert-manager needs to know which parentRefs should be used when creating
+ the HTTPRoute. Usually, the parentRef references a Gateway. See:
+ https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
+ items:
+ description: |-
+ ParentReference identifies an API object (usually a Gateway) that can be considered
+ a parent of this resource (usually a route). There are two kinds of parent resources
+ with "Core" support:
+
+ * Gateway (Gateway conformance profile)
+ * Service (Mesh conformance profile, ClusterIP Services only)
+
+ This API may be extended in the future to support additional kinds of parent
+ resources.
+
+ The API object must be valid in the cluster; the Group and Kind must
+ be registered in the cluster for this reference to be valid.
+ properties:
+ group:
+ default: gateway.networking.k8s.io
+ description: |-
+ Group is the group of the referent.
+ When unspecified, "gateway.networking.k8s.io" is inferred.
+ To set the core API group (such as for a "Service" kind referent),
+ Group must be explicitly set to "" (empty string).
+
+ Support: Core
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ kind:
+ default: Gateway
+ description: |-
+ Kind is kind of the referent.
+
+ There are two kinds of parent resources with "Core" support:
+
+ * Gateway (Gateway conformance profile)
+ * Service (Mesh conformance profile, ClusterIP Services only)
+
+ Support for other resources is Implementation-Specific.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+ type: string
+ name:
+ description: |-
+ Name is the name of the referent.
+
+ Support: Core
+ maxLength: 253
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ Namespace is the namespace of the referent. When unspecified, this refers
+ to the local namespace of the Route.
+
+ Note that there are specific rules for ParentRefs which cross namespace
+ boundaries. Cross-namespace references are only valid if they are explicitly
+ allowed by something in the namespace they are referring to. For example:
+ Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+ generic way to enable any other kind of cross-namespace reference.
+
+ <gateway:experimental:description>
+ ParentRefs from a Route to a Service in the same namespace are "producer"
+ routes, which apply default routing rules to inbound connections from
+ any namespace to the Service.
+
+ ParentRefs from a Route to a Service in a different namespace are
+ "consumer" routes, and these routing rules are only applied to outbound
+ connections originating from the same namespace as the Route, for which
+ the intended destination of the connections are a Service targeted as a
+ ParentRef of the Route.
+ </gateway:experimental:description>
+
+ Support: Core
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ port:
+ description: |-
+ Port is the network port this Route targets. It can be interpreted
+ differently based on the type of parent resource.
+
+ When the parent resource is a Gateway, this targets all listeners
+ listening on the specified port that also support this kind of Route(and
+ select this Route). It's not recommended to set `Port` unless the
+ networking behaviors specified in a Route must apply to a specific port
+ as opposed to a listener(s) whose port(s) may be changed. When both Port
+ and SectionName are specified, the name and port of the selected listener
+ must match both specified values.
+
+ <gateway:experimental:description>
+ When the parent resource is a Service, this targets a specific port in the
+ Service spec. When both Port (experimental) and SectionName are specified,
+ the name and port of the selected port must match both specified values.
+ </gateway:experimental:description>
+
+ Implementations MAY choose to support other parent resources.
+ Implementations supporting other types of parent resources MUST clearly
+ document how/if Port is interpreted.
+
+ For the purpose of status, an attachment is considered successful as
+ long as the parent resource accepts it partially. For example, Gateway
+ listeners can restrict which Routes can attach to them by Route kind,
+ namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+ from the referencing Route, the Route MUST be considered successfully
+ attached. If no Gateway listeners accept attachment from this Route,
+ the Route MUST be considered detached from the Gateway.
+
+ Support: Extended
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ sectionName:
+ description: |-
+ SectionName is the name of a section within the target resource. In the
+ following resources, SectionName is interpreted as the following:
+
+ * Gateway: Listener name. When both Port (experimental) and SectionName
+ are specified, the name and port of the selected listener must match
+ both specified values.
+ * Service: Port name. When both Port (experimental) and SectionName
+ are specified, the name and port of the selected listener must match
+ both specified values.
+
+ Implementations MAY choose to support attaching Routes to other resources.
+ If that is the case, they MUST clearly document how SectionName is
+ interpreted.
+
+ When unspecified (empty string), this will reference the entire resource.
+ For the purpose of status, an attachment is considered successful if at
+ least one section in the parent resource accepts it. For example, Gateway
+ listeners can restrict which Routes can attach to them by Route kind,
+ namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+ the referencing Route, the Route MUST be considered successfully
+ attached. If no Gateway listeners accept attachment from this Route, the
+ Route MUST be considered detached from the Gateway.
+
+ Support: Core
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ podTemplate:
+ description: |-
+ Optional pod template used to configure the ACME challenge solver pods
+ used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ type: object
+ spec:
+ description: |-
+ PodSpec defines overrides for the HTTP01 challenge solver pod.
+ Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+ All other fields will be ignored.
+ properties:
+ affinity:
+ description: If specified, the pod's scheduling constraints
+ properties:
+ nodeAffinity:
+ description: Describes node affinity scheduling rules for the pod.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ podAffinity:
+ description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ podAntiAffinity:
+ description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the anti-affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling anti-affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and subtracting
+ "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the anti-affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the anti-affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ imagePullSecrets:
+ description: If specified, the pod's imagePullSecrets
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ NodeSelector is a selector which must be true for the pod to fit on a node.
+ Selector which must match a node's labels for the pod to be scheduled on that node.
+ More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ priorityClassName:
+ description: If specified, the pod's priorityClassName.
+ type: string
+ resources:
+ description: |-
+ If specified, the pod's resource requirements.
+ These values override the global resource configuration flags.
+ Note that when only specifying resource limits, ensure they are greater than or equal
+ to the corresponding global resource requests configured via controller flags
+ (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+ Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+ properties:
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ securityContext:
+ description: If specified, the pod's security context
+ properties:
+ fsGroup:
+ description: |-
+ A special supplemental group that applies to all containers in a pod.
+ Some volume types allow the Kubelet to change the ownership of that volume
+ to be owned by the pod:
+
+ 1. The owning GID will be the FSGroup
+ 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+ 3. The permission bits are OR'd with rw-rw----
+
+ If unset, the Kubelet will not modify the ownership and permissions of any volume.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ fsGroupChangePolicy:
+ description: |-
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+ before being exposed inside Pod. This field will only apply to
+ volume types which support fsGroup based ownership(and permissions).
+ It will have no effect on ephemeral volume types such as: secret, configmaps
+ and emptydir.
+ Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to all containers.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in SecurityContext. If set in
+ both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+ takes precedence for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by the containers in this pod.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ supplementalGroups:
+ description: |-
+ A list of groups applied to the first process run in each container, in addition
+ to the container's primary GID, the fsGroup (if specified), and group memberships
+ defined in the container image for the uid of the container process. If unspecified,
+ no additional groups are added to any container. Note that group memberships
+ defined in the container image for the uid of the container process are still effective,
+ even if they are not included in this list.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ format: int64
+ type: integer
+ type: array
+ x-kubernetes-list-type: atomic
+ sysctls:
+ description: |-
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+ sysctls (by the container runtime) might fail to launch.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ description: Sysctl defines a kernel parameter to be set
+ properties:
+ name:
+ description: Name of a property to set
+ type: string
+ value:
+ description: Value of a property to set
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ serviceAccountName:
+ description: If specified, the pod's service account
+ type: string
+ tolerations:
+ description: If specified, the pod's tolerations.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple <key,value,effect> using the matching operator <operator>.
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ serviceType:
+ description: |-
+ Optional service type for Kubernetes solver service. Supported values
+ are NodePort or ClusterIP. If unset, defaults to NodePort.
+ type: string
+ type: object
+ ingress:
+ description: |-
+ The ingress based HTTP01 challenge solver will solve challenges by
+ creating or modifying Ingress resources in order to route requests for
+ '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+ provisioned by cert-manager for each Challenge to be completed.
+ properties:
+ class:
+ description: |-
+ This field configures the annotation `kubernetes.io/ingress.class` when
+ creating Ingress resources to solve ACME challenges that use this
+ challenge solver. Only one of `class`, `name` or `ingressClassName` may
+ be specified.
+ type: string
+ ingressClassName:
+ description: |-
+ This field configures the field `ingressClassName` on the created Ingress
+ resources used to solve ACME challenges that use this challenge solver.
+ This is the recommended way of configuring the ingress class. Only one of
+ `class`, `name` or `ingressClassName` may be specified.
+ type: string
+ ingressTemplate:
+ description: |-
+ Optional ingress template used to configure the ACME challenge solver
+ ingress used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver ingress.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver ingress.
+ type: object
+ type: object
+ type: object
+ name:
+ description: |-
+ The name of the ingress resource that should have ACME challenge solving
+ routes inserted into it in order to solve HTTP01 challenges.
+ This is typically used in conjunction with ingress controllers like
+ ingress-gce, which maintains a 1:1 mapping between external IPs and
+ ingress resources. Only one of `class`, `name` or `ingressClassName` may
+ be specified.
+ type: string
+ podTemplate:
+ description: |-
+ Optional pod template used to configure the ACME challenge solver pods
+ used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ type: object
+ spec:
+ description: |-
+ PodSpec defines overrides for the HTTP01 challenge solver pod.
+ Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+ All other fields will be ignored.
+ properties:
+ affinity:
+ description: If specified, the pod's scheduling constraints
+ properties:
+ nodeAffinity:
+ description: Describes node affinity scheduling rules for the pod.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ podAffinity:
+ description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ podAntiAffinity:
+ description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the anti-affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling anti-affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and subtracting
+ "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the anti-affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the anti-affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ imagePullSecrets:
+ description: If specified, the pod's imagePullSecrets
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ NodeSelector is a selector which must be true for the pod to fit on a node.
+ Selector which must match a node's labels for the pod to be scheduled on that node.
+ More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ priorityClassName:
+ description: If specified, the pod's priorityClassName.
+ type: string
+ resources:
+ description: |-
+ If specified, the pod's resource requirements.
+ These values override the global resource configuration flags.
+ Note that when only specifying resource limits, ensure they are greater than or equal
+ to the corresponding global resource requests configured via controller flags
+ (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+ Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+ properties:
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ securityContext:
+ description: If specified, the pod's security context
+ properties:
+ fsGroup:
+ description: |-
+ A special supplemental group that applies to all containers in a pod.
+ Some volume types allow the Kubelet to change the ownership of that volume
+ to be owned by the pod:
+
+ 1. The owning GID will be the FSGroup
+ 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+ 3. The permission bits are OR'd with rw-rw----
+
+ If unset, the Kubelet will not modify the ownership and permissions of any volume.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ fsGroupChangePolicy:
+ description: |-
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+ before being exposed inside Pod. This field will only apply to
+ volume types which support fsGroup based ownership(and permissions).
+ It will have no effect on ephemeral volume types such as: secret, configmaps
+ and emptydir.
+ Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to all containers.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in SecurityContext. If set in
+ both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+ takes precedence for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by the containers in this pod.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ supplementalGroups:
+ description: |-
+ A list of groups applied to the first process run in each container, in addition
+ to the container's primary GID, the fsGroup (if specified), and group memberships
+ defined in the container image for the uid of the container process. If unspecified,
+ no additional groups are added to any container. Note that group memberships
+ defined in the container image for the uid of the container process are still effective,
+ even if they are not included in this list.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ format: int64
+ type: integer
+ type: array
+ x-kubernetes-list-type: atomic
+ sysctls:
+ description: |-
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+ sysctls (by the container runtime) might fail to launch.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ description: Sysctl defines a kernel parameter to be set
+ properties:
+ name:
+ description: Name of a property to set
+ type: string
+ value:
+ description: Value of a property to set
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ serviceAccountName:
+ description: If specified, the pod's service account
+ type: string
+ tolerations:
+ description: If specified, the pod's tolerations.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple <key,value,effect> using the matching operator <operator>.
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ serviceType:
+ description: |-
+ Optional service type for Kubernetes solver service. Supported values
+ are NodePort or ClusterIP. If unset, defaults to NodePort.
+ type: string
+ type: object
+ type: object
+ selector:
+ description: |-
+ Selector selects a set of DNSNames on the Certificate resource that
+ should be solved using this challenge solver.
+ If not specified, the solver will be treated as the 'default' solver
+ with the lowest priority, i.e. if any other solver has a more specific
+ match, it will be used instead.
+ properties:
+ dnsNames:
+ description: |-
+ List of DNSNames that this solver will be used to solve.
+ If specified and a match is found, a dnsNames selector will take
+ precedence over a dnsZones selector.
+ If multiple solvers match with the same dnsNames value, the solver
+ with the most matching labels in matchLabels will be selected.
+ If neither has more matches, the solver defined earlier in the list
+ will be selected.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsZones:
+ description: |-
+ List of DNSZones that this solver will be used to solve.
+ The most specific DNS zone match specified here will take precedence
+ over other DNS zone matches, so a solver specifying sys.example.com
+ will be selected over one specifying example.com for the domain
+ www.sys.example.com.
+ If multiple solvers match with the same dnsZones value, the solver
+ with the most matching labels in matchLabels will be selected.
+ If neither has more matches, the solver defined earlier in the list
+ will be selected.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ A label selector that is used to refine the set of certificate's that
+ this challenge solver will apply to.
+ type: object
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - privateKeySecretRef
+ - server
+ type: object
+ ca:
+ description: |-
+ CA configures this issuer to sign certificates using a signing CA keypair
+ stored in a Secret resource.
+ This is used to build internal PKIs that are managed by cert-manager.
+ properties:
+ crlDistributionPoints:
+ description: |-
+ The CRL distribution points is an X.509 v3 certificate extension which identifies
+ the location of the CRL from which the revocation of this certificate can be checked.
+ If not set, certificates will be issued without distribution points set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ issuingCertificateURLs:
+ description: |-
+ IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
+ it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
+ As an example, such a URL might be "http://ca.domain.com/ca.crt".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ ocspServers:
+ description: |-
+ The OCSP server list is an X.509 v3 extension that defines a list of
+ URLs of OCSP responders. The OCSP responders can be queried for the
+ revocation status of an issued certificate. If not set, the
+ certificate will be issued with no OCSP servers set. For example, an
+ OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ secretName:
+ description: |-
+ SecretName is the name of the secret used to sign Certificates issued
+ by this Issuer.
+ type: string
+ required:
+ - secretName
+ type: object
+ selfSigned:
+ description: |-
+ SelfSigned configures this issuer to 'self sign' certificates using the
+ private key used to create the CertificateRequest object.
+ properties:
+ crlDistributionPoints:
+ description: |-
+ The CRL distribution points is an X.509 v3 certificate extension which identifies
+ the location of the CRL from which the revocation of this certificate can be checked.
+ If not set certificate will be issued without CDP. Values are strings.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ vault:
+ description: |-
+ Vault configures this issuer to sign certificates using a HashiCorp Vault
+ PKI backend.
+ properties:
+ auth:
+ description: Auth configures how cert-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ description: |-
+ Path where the App Role authentication backend is mounted in Vault, e.g:
+ "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - path
+ - roleId
+ - secretRef
+ type: object
+ clientCertificate:
+ description: |-
+ ClientCertificate authenticates with Vault by presenting a client
+ certificate during the request's TLS handshake.
+ Works only when using HTTPS protocol.
+ properties:
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/cert" will be used.
+ type: string
+ name:
+ description: |-
+ Name of the certificate role to authenticate against.
+ If not set, matching any certificate role, if available.
+ type: string
+ secretName:
+ description: |-
+ Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
+ tls.crt and tls.key) used to authenticate to Vault using TLS client
+ authentication.
+ type: string
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/kubernetes" will be used.
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ The required Secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. Use of 'ambient credentials' is not
+ supported.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a bound
+ token (also known as "projected token"). Compared to using "secretRef",
+ using this field means that you don't rely on statically bound tokens. To
+ use this field, you must configure an RBAC rule to let cert-manager
+ request a token.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
+ consisting of the issuer's namespace and name is always included.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - role
+ type: object
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+ chain presented by Vault. Only used if using HTTPS to connect to Vault and
+ ignored for HTTP connections.
+ Mutually exclusive with CABundleSecretRef.
+ If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+ the cert-manager controller container is used to validate the TLS connection.
+ format: byte
+ type: string
+ caBundleSecretRef:
+ description: |-
+ Reference to a Secret containing a bundle of PEM-encoded CAs to use when
+ verifying the certificate chain presented by Vault when using HTTPS.
+ Mutually exclusive with CABundle.
+ If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+ the cert-manager controller container is used to validate the TLS connection.
+ If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientCertSecretRef:
+ description: |-
+ Reference to a Secret containing a PEM-encoded Client Certificate to use when the
+ Vault server requires mTLS.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientKeySecretRef:
+ description: |-
+ Reference to a Secret containing a PEM-encoded Client Private Key to use when the
+ Vault server requires mTLS.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
+ "my_pki_mount/sign/my-role-name".
+ type: string
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ serverName:
+ description: |-
+ ServerName is used to verify the hostname on the returned certificates
+ by the Vault server.
+ type: string
+ required:
+ - auth
+ - path
+ - server
+ type: object
+ venafi:
+ description: |-
+ Venafi configures this issuer to sign certificates using a Venafi TPP
+ or Venafi Cloud policy zone.
+ properties:
+ cloud:
+ description: |-
+ Cloud specifies the Venafi cloud configuration settings.
+ Only one of TPP or Cloud may be specified.
+ properties:
+ apiTokenSecretRef:
+ description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: |-
+ URL is the base URL for Venafi Cloud.
+ Defaults to "https://api.venafi.cloud/".
+ type: string
+ required:
+ - apiTokenSecretRef
+ type: object
+ tpp:
+ description: |-
+ TPP specifies Trust Protection Platform configuration settings.
+ Only one of TPP or Cloud may be specified.
+ properties:
+ caBundle:
+ description: |-
+ Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+ chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+ If undefined, the certificate bundle in the cert-manager controller container
+ is used to validate the chain.
+ format: byte
+ type: string
+ caBundleSecretRef:
+ description: |-
+ Reference to a Secret containing a base64-encoded bundle of PEM CAs
+ which will be used to validate the certificate chain presented by the TPP server.
+ Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
+ If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
+ the cert-manager controller container is used to validate the TLS connection.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+ The secret must contain the key 'access-token' for the Access Token Authentication,
+ or two keys, 'username' and 'password' for the API Keys Authentication.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: |-
+ URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+ for example: "https://tpp.example.com/vedsdk".
+ type: string
+ required:
+ - credentialsRef
+ - url
+ type: object
+ zone:
+ description: |-
+ Zone is the Venafi Policy Zone to use for this issuer.
+ All requests made to the Venafi platform will be restricted by the named
+ zone policy.
+ This field is required.
+ type: string
+ required:
+ - zone
+ type: object
+ type: object
+ status:
+ description: Status of the ClusterIssuer. This is set and managed automatically.
+ properties:
+ acme:
+ description: |-
+ ACME specific status options.
+ This field should only be set if the Issuer is configured to use an ACME
+ server to issue certificates.
+ properties:
+ lastPrivateKeyHash:
+ description: |-
+ LastPrivateKeyHash is a hash of the private key associated with the latest
+ registered ACME account, in order to track changes made to registered account
+ associated with the Issuer
+ type: string
+ lastRegisteredEmail:
+ description: |-
+ LastRegisteredEmail is the email associated with the latest registered
+ ACME account, in order to track changes made to registered account
+ associated with the Issuer
+ type: string
+ uri:
+ description: |-
+ URI is the unique account identifier, which can also be used to retrieve
+ account details from the CA
+ type: string
+ type: object
+ conditions:
+ description: |-
+ List of status conditions to indicate the status of a CertificateRequest.
+ Known condition types are `Ready`.
+ items:
+ description: IssuerCondition contains condition information for an Issuer.
+ properties:
+ lastTransitionTime:
+ description: |-
+ LastTransitionTime is the timestamp corresponding to the last status
+ change of this condition.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ Message is a human readable description of the details of the last
+ transition, complementing reason.
+ type: string
+ observedGeneration:
+ description: |-
+ If set, this represents the .metadata.generation that the condition was
+ set based upon.
+ For instance, if .metadata.generation is currently 12, but the
+ .status.condition[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the Issuer.
+ format: int64
+ type: integer
+ reason:
+ description: |-
+ Reason is a brief machine readable explanation for the condition's last
+ transition.
+ type: string
+ status:
+ description: Status of the condition, one of (`True`, `False`, `Unknown`).
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: Type of the condition, known values are (`Ready`).
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
new file mode 100644
index 0000000..c88b318
--- /dev/null
+++ b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
@@ -0,0 +1,3814 @@
+{{- if or .Values.crds.enabled .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ name: "issuers.cert-manager.io"
+ {{- if .Values.crds.keep }}
+ annotations:
+ helm.sh/resource-policy: keep
+ {{- end }}
+ labels:
+ {{- include "cert-manager.crd-labels" . | nindent 4 }}
+spec:
+ group: cert-manager.io
+ names:
+ categories:
+ - cert-manager
+ kind: Issuer
+ listKind: IssuerList
+ plural: issuers
+ shortNames:
+ - iss
+ singular: issuer
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .status.conditions[?(@.type == "Ready")].status
+ name: Ready
+ type: string
+ - jsonPath: .status.conditions[?(@.type == "Ready")].message
+ name: Status
+ priority: 1
+ type: string
+ - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ An Issuer represents a certificate issuing authority which can be
+ referenced as part of `issuerRef` fields.
+ It is scoped to a single namespace and can therefore only be referenced by
+ resources within the same namespace.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: Desired state of the Issuer resource.
+ properties:
+ acme:
+ description: |-
+ ACME configures this issuer to communicate with a RFC8555 (ACME) server
+ to obtain signed x509 certificates.
+ properties:
+ caBundle:
+ description: |-
+ Base64-encoded bundle of PEM CAs which can be used to validate the certificate
+ chain presented by the ACME server.
+ Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
+ kinds of security vulnerabilities.
+ If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+ the container is used to validate the TLS connection.
+ format: byte
+ type: string
+ disableAccountKeyGeneration:
+ description: |-
+ Enables or disables generating a new ACME account key.
+ If true, the Issuer resource will *not* request a new account but will expect
+ the account key to be supplied via an existing secret.
+ If false, the cert-manager system will generate a new ACME account key
+ for the Issuer.
+ Defaults to false.
+ type: boolean
+ email:
+ description: |-
+ Email is the email address to be associated with the ACME account.
+ This field is optional, but it is strongly recommended to be set.
+ It will be used to contact you in case of issues with your account or
+ certificates, including expiry notification emails.
+ This field may be updated after the account is initially registered.
+ type: string
+ enableDurationFeature:
+ description: |-
+ Enables requesting a Not After date on certificates that matches the
+ duration of the certificate. This is not supported by all ACME servers
+ like Let's Encrypt. If set to true when the ACME server does not support
+ it, it will create an error on the Order.
+ Defaults to false.
+ type: boolean
+ externalAccountBinding:
+ description: |-
+ ExternalAccountBinding is a reference to a CA external account of the ACME
+ server.
+ If set, upon registration cert-manager will attempt to associate the given
+ external account credentials with the registered ACME account.
+ properties:
+ keyAlgorithm:
+ description: |-
+ Deprecated: keyAlgorithm field exists for historical compatibility
+ reasons and should not be used. The algorithm is now hardcoded to HS256
+ in golang/x/crypto/acme.
+ enum:
+ - HS256
+ - HS384
+ - HS512
+ type: string
+ keyID:
+ description: keyID is the ID of the CA key that the External Account is bound to.
+ type: string
+ keySecretRef:
+ description: |-
+ keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
+ Secret which holds the symmetric MAC key of the External Account Binding.
+ The `key` is the index string that is paired with the key data in the
+ Secret and should not be confused with the key data itself, or indeed with
+ the External Account Binding keyID above.
+ The secret key stored in the Secret **must** be un-padded, base64 URL
+ encoded data.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - keyID
+ - keySecretRef
+ type: object
+ preferredChain:
+ description: |-
+ PreferredChain is the chain to use if the ACME server outputs multiple.
+ PreferredChain is no guarantee that this one gets delivered by the ACME
+ endpoint.
+ For example, for Let's Encrypt's DST cross-sign you would use:
+ "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
+ This value picks the first certificate bundle in the combined set of
+ ACME default and alternative chains that has a root-most certificate with
+ this value as its issuer's commonname.
+ maxLength: 64
+ type: string
+ privateKeySecretRef:
+ description: |-
+ PrivateKey is the name of a Kubernetes Secret resource that will be used to
+ store the automatically generated ACME account private key.
+ Optionally, a `key` may be specified to select a specific entry within
+ the named Secret resource.
+ If `key` is not specified, a default of `tls.key` will be used.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ Profile allows requesting a certificate profile from the ACME server.
+ Supported profiles are listed by the server's ACME directory URL.
+ type: string
+ server:
+ description: |-
+ Server is the URL used to access the ACME server's 'directory' endpoint.
+ For example, for Let's Encrypt's staging endpoint, you would use:
+ "https://acme-staging-v02.api.letsencrypt.org/directory".
+ Only ACME v2 endpoints (i.e. RFC 8555) are supported.
+ type: string
+ skipTLSVerify:
+ description: |-
+ INSECURE: Enables or disables validation of the ACME server TLS certificate.
+ If true, requests to the ACME server will not have the TLS certificate chain
+ validated.
+ Mutually exclusive with CABundle; prefer using CABundle to prevent various
+ kinds of security vulnerabilities.
+ Only enable this option in development environments.
+ If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
+ the container is used to validate the TLS connection.
+ Defaults to false.
+ type: boolean
+ solvers:
+ description: |-
+ Solvers is a list of challenge solvers that will be used to solve
+ ACME challenges for the matching domains.
+ Solver configurations must be provided in order to obtain certificates
+ from an ACME server.
+ For more information, see: https://cert-manager.io/docs/configuration/acme/
+ items:
+ description: |-
+ An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
+ A selector may be provided to use different solving strategies for different DNS names.
+ Only one of HTTP01 or DNS01 must be provided.
+ properties:
+ dns01:
+ description: |-
+ Configures cert-manager to attempt to complete authorizations by
+ performing the DNS01 challenge flow.
+ properties:
+ acmeDNS:
+ description: |-
+ Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
+ DNS01 challenge records.
+ properties:
+ accountSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ host:
+ type: string
+ required:
+ - accountSecretRef
+ - host
+ type: object
+ akamai:
+ description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
+ properties:
+ accessTokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientTokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ serviceConsumerDomain:
+ type: string
+ required:
+ - accessTokenSecretRef
+ - clientSecretSecretRef
+ - clientTokenSecretRef
+ - serviceConsumerDomain
+ type: object
+ azureDNS:
+ description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
+ properties:
+ clientID:
+ description: |-
+ Auth: Azure Service Principal:
+ The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
+ If set, ClientSecret and TenantID must also be set.
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ Auth: Azure Service Principal:
+ A reference to a Secret containing the password associated with the Service Principal.
+ If set, ClientID and TenantID must also be set.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ environment:
+ description: name of the Azure environment (default AzurePublicCloud)
+ enum:
+ - AzurePublicCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureUSGovernmentCloud
+ type: string
+ hostedZoneName:
+ description: name of the DNS zone that should be used
+ type: string
+ managedIdentity:
+ description: |-
+ Auth: Azure Workload Identity or Azure Managed Service Identity:
+ Settings to enable Azure Workload Identity or Azure Managed Service Identity
+ If set, ClientID, ClientSecret and TenantID must not be set.
+ properties:
+ clientID:
+ description: client ID of the managed identity, cannot be used at the same time as resourceID
+ type: string
+ resourceID:
+ description: |-
+ resource ID of the managed identity, cannot be used at the same time as clientID
+ Cannot be used for Azure Managed Service Identity
+ type: string
+ tenantID:
+ description: tenant ID of the managed identity, cannot be used at the same time as resourceID
+ type: string
+ type: object
+ resourceGroupName:
+ description: resource group the DNS zone is located in
+ type: string
+ subscriptionID:
+ description: ID of the Azure subscription
+ type: string
+ tenantID:
+ description: |-
+ Auth: Azure Service Principal:
+ The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
+ If set, ClientID and ClientSecret must also be set.
+ type: string
+ required:
+ - resourceGroupName
+ - subscriptionID
+ type: object
+ cloudDNS:
+ description: Use the Google Cloud DNS API to manage DNS01 challenge records.
+ properties:
+ hostedZoneName:
+ description: |-
+ HostedZoneName is an optional field that tells cert-manager in which
+ Cloud DNS zone the challenge record has to be created.
+ If left empty cert-manager will automatically choose a zone.
+ type: string
+ project:
+ type: string
+ serviceAccountSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - project
+ type: object
+ cloudflare:
+ description: Use the Cloudflare API to manage DNS01 challenge records.
+ properties:
+ apiKeySecretRef:
+ description: |-
+ API key to use to authenticate with Cloudflare.
+ Note: using an API token to authenticate is now the recommended method
+ as it allows greater control of permissions.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ apiTokenSecretRef:
+ description: API token used to authenticate with Cloudflare.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ email:
+ description: Email of the account, only required when using API key based authentication.
+ type: string
+ type: object
+ cnameStrategy:
+ description: |-
+ CNAMEStrategy configures how the DNS01 provider should handle CNAME
+ records when found in DNS zones.
+ enum:
+ - None
+ - Follow
+ type: string
+ digitalocean:
+ description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
+ properties:
+ tokenSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - tokenSecretRef
+ type: object
+ rfc2136:
+ description: |-
+ Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
+ to manage DNS01 challenge records.
+ properties:
+ nameserver:
+ description: |-
+ The IP address or hostname of an authoritative DNS server supporting
+ RFC2136 in the form host:port. If the host is an IPv6 address it must be
+ enclosed in square brackets (e.g [2001:db8::1]); port is optional.
+ This field is required.
+ type: string
+ protocol:
+ description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
+ enum:
+ - TCP
+ - UDP
+ type: string
+ tsigAlgorithm:
+ description: |-
+ The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+ when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+ Supported values are (case-insensitive): ``HMACMD5`` (default),
+ ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+ type: string
+ tsigKeyName:
+ description: |-
+ The TSIG Key name configured in the DNS.
+ If ``tsigSecretSecretRef`` is defined, this field is required.
+ type: string
+ tsigSecretSecretRef:
+ description: |-
+ The name of the secret containing the TSIG value.
+ If ``tsigKeyName`` is defined, this field is required.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - nameserver
+ type: object
+ route53:
+ description: Use the AWS Route53 API to manage DNS01 challenge records.
+ properties:
+ accessKeyID:
+ description: |-
+ The AccessKeyID is used for authentication.
+ Cannot be set when SecretAccessKeyID is set.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ type: string
+ accessKeyIDSecretRef:
+ description: |-
+ The SecretAccessKey is used for authentication. If set, pull the AWS
+ access key ID from a key within a Kubernetes Secret.
+ Cannot be set when AccessKeyID is set.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ auth:
+ description: Auth configures how cert-manager authenticates.
+ properties:
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
+ by passing a bound ServiceAccount token.
+ properties:
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a bound
+ token (also known as "projected token"). To use this field, you must
+ configure an RBAC rule to let cert-manager request a token.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of audiences to include in the
+ token passed to AWS. The default token consisting of the issuer's namespace
+ and name is always included.
+ If unset the audience defaults to `sts.amazonaws.com`.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ required:
+ - kubernetes
+ type: object
+ hostedZoneID:
+ description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
+ type: string
+ region:
+ description: |-
+ Override the AWS region.
+
+ Route53 is a global service and does not have regional endpoints but the
+ region specified here (or via environment variables) is used as a hint to
+ help compute the correct AWS credential scope and partition when it
+ connects to Route53. See:
+ - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
+ - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
+
+ If you omit this region field, cert-manager will use the region from
+ AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
+ in the cert-manager controller Pod.
+
+ The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+ Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+ [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
+ In this case this `region` field value is ignored.
+
+ The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
+ Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
+ [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
+ In this case this `region` field value is ignored.
+ type: string
+ role:
+ description: |-
+ Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+ or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+ type: string
+ secretAccessKeySecretRef:
+ description: |-
+ The SecretAccessKey is used for authentication.
+ If neither the Access Key nor Key ID are set, we fall-back to using env
+ vars, shared credentials file or AWS Instance metadata,
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ webhook:
+ description: |-
+ Configure an external webhook based DNS01 challenge solver to manage
+ DNS01 challenge records.
+ properties:
+ config:
+ description: |-
+ Additional configuration that should be passed to the webhook apiserver
+ when challenges are processed.
+ This can contain arbitrary JSON data.
+ Secret values should not be specified in this stanza.
+ If secret values are needed (e.g., credentials for a DNS service), you
+ should use a SecretKeySelector to reference a Secret resource.
+ For details on the schema of this field, consult the webhook provider
+ implementation's documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ groupName:
+ description: |-
+ The API group name that should be used when POSTing ChallengePayload
+ resources to the webhook apiserver.
+ This should be the same as the GroupName specified in the webhook
+ provider implementation.
+ type: string
+ solverName:
+ description: |-
+ The name of the solver to use, as defined in the webhook provider
+ implementation.
+ This will typically be the name of the provider, e.g., 'cloudflare'.
+ type: string
+ required:
+ - groupName
+ - solverName
+ type: object
+ type: object
+ http01:
+ description: |-
+ Configures cert-manager to attempt to complete authorizations by
+ performing the HTTP01 challenge flow.
+ It is not possible to obtain certificates for wildcard domain names
+ (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
+ properties:
+ gatewayHTTPRoute:
+ description: |-
+ The Gateway API is a sig-network community API that models service networking
+ in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
+ create HTTPRoutes with the specified labels in the same namespace as the challenge.
+ This solver is experimental, and fields / behaviour may change in the future.
+ properties:
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ Custom labels that will be applied to HTTPRoutes created by cert-manager
+ while solving HTTP-01 challenges.
+ type: object
+ parentRefs:
+ description: |-
+ When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
+ cert-manager needs to know which parentRefs should be used when creating
+ the HTTPRoute. Usually, the parentRef references a Gateway. See:
+ https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
+ items:
+ description: |-
+ ParentReference identifies an API object (usually a Gateway) that can be considered
+ a parent of this resource (usually a route). There are two kinds of parent resources
+ with "Core" support:
+
+ * Gateway (Gateway conformance profile)
+ * Service (Mesh conformance profile, ClusterIP Services only)
+
+ This API may be extended in the future to support additional kinds of parent
+ resources.
+
+ The API object must be valid in the cluster; the Group and Kind must
+ be registered in the cluster for this reference to be valid.
+ properties:
+ group:
+ default: gateway.networking.k8s.io
+ description: |-
+ Group is the group of the referent.
+ When unspecified, "gateway.networking.k8s.io" is inferred.
+ To set the core API group (such as for a "Service" kind referent),
+ Group must be explicitly set to "" (empty string).
+
+ Support: Core
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ kind:
+ default: Gateway
+ description: |-
+ Kind is kind of the referent.
+
+ There are two kinds of parent resources with "Core" support:
+
+ * Gateway (Gateway conformance profile)
+ * Service (Mesh conformance profile, ClusterIP Services only)
+
+ Support for other resources is Implementation-Specific.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+ type: string
+ name:
+ description: |-
+ Name is the name of the referent.
+
+ Support: Core
+ maxLength: 253
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ Namespace is the namespace of the referent. When unspecified, this refers
+ to the local namespace of the Route.
+
+ Note that there are specific rules for ParentRefs which cross namespace
+ boundaries. Cross-namespace references are only valid if they are explicitly
+ allowed by something in the namespace they are referring to. For example:
+ Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+ generic way to enable any other kind of cross-namespace reference.
+
+ <gateway:experimental:description>
+ ParentRefs from a Route to a Service in the same namespace are "producer"
+ routes, which apply default routing rules to inbound connections from
+ any namespace to the Service.
+
+ ParentRefs from a Route to a Service in a different namespace are
+ "consumer" routes, and these routing rules are only applied to outbound
+ connections originating from the same namespace as the Route, for which
+ the intended destination of the connections are a Service targeted as a
+ ParentRef of the Route.
+ </gateway:experimental:description>
+
+ Support: Core
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ port:
+ description: |-
+ Port is the network port this Route targets. It can be interpreted
+ differently based on the type of parent resource.
+
+ When the parent resource is a Gateway, this targets all listeners
+ listening on the specified port that also support this kind of Route(and
+ select this Route). It's not recommended to set `Port` unless the
+ networking behaviors specified in a Route must apply to a specific port
+ as opposed to a listener(s) whose port(s) may be changed. When both Port
+ and SectionName are specified, the name and port of the selected listener
+ must match both specified values.
+
+ <gateway:experimental:description>
+ When the parent resource is a Service, this targets a specific port in the
+ Service spec. When both Port (experimental) and SectionName are specified,
+ the name and port of the selected port must match both specified values.
+ </gateway:experimental:description>
+
+ Implementations MAY choose to support other parent resources.
+ Implementations supporting other types of parent resources MUST clearly
+ document how/if Port is interpreted.
+
+ For the purpose of status, an attachment is considered successful as
+ long as the parent resource accepts it partially. For example, Gateway
+ listeners can restrict which Routes can attach to them by Route kind,
+ namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+ from the referencing Route, the Route MUST be considered successfully
+ attached. If no Gateway listeners accept attachment from this Route,
+ the Route MUST be considered detached from the Gateway.
+
+ Support: Extended
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ sectionName:
+ description: |-
+ SectionName is the name of a section within the target resource. In the
+ following resources, SectionName is interpreted as the following:
+
+ * Gateway: Listener name. When both Port (experimental) and SectionName
+ are specified, the name and port of the selected listener must match
+ both specified values.
+ * Service: Port name. When both Port (experimental) and SectionName
+ are specified, the name and port of the selected listener must match
+ both specified values.
+
+ Implementations MAY choose to support attaching Routes to other resources.
+ If that is the case, they MUST clearly document how SectionName is
+ interpreted.
+
+ When unspecified (empty string), this will reference the entire resource.
+ For the purpose of status, an attachment is considered successful if at
+ least one section in the parent resource accepts it. For example, Gateway
+ listeners can restrict which Routes can attach to them by Route kind,
+ namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+ the referencing Route, the Route MUST be considered successfully
+ attached. If no Gateway listeners accept attachment from this Route, the
+ Route MUST be considered detached from the Gateway.
+
+ Support: Core
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ podTemplate:
+ description: |-
+ Optional pod template used to configure the ACME challenge solver pods
+ used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ type: object
+ spec:
+ description: |-
+ PodSpec defines overrides for the HTTP01 challenge solver pod.
+ Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+ All other fields will be ignored.
+ properties:
+ affinity:
+ description: If specified, the pod's scheduling constraints
+ properties:
+ nodeAffinity:
+ description: Describes node affinity scheduling rules for the pod.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ podAffinity:
+ description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ podAntiAffinity:
+ description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the anti-affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling anti-affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and subtracting
+ "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the anti-affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the anti-affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ imagePullSecrets:
+ description: If specified, the pod's imagePullSecrets
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ NodeSelector is a selector which must be true for the pod to fit on a node.
+ Selector which must match a node's labels for the pod to be scheduled on that node.
+ More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ priorityClassName:
+ description: If specified, the pod's priorityClassName.
+ type: string
+ resources:
+ description: |-
+ If specified, the pod's resource requirements.
+ These values override the global resource configuration flags.
+ Note that when only specifying resource limits, ensure they are greater than or equal
+ to the corresponding global resource requests configured via controller flags
+ (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+ Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+ properties:
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ securityContext:
+ description: If specified, the pod's security context
+ properties:
+ fsGroup:
+ description: |-
+ A special supplemental group that applies to all containers in a pod.
+ Some volume types allow the Kubelet to change the ownership of that volume
+ to be owned by the pod:
+
+ 1. The owning GID will be the FSGroup
+ 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+ 3. The permission bits are OR'd with rw-rw----
+
+ If unset, the Kubelet will not modify the ownership and permissions of any volume.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ fsGroupChangePolicy:
+ description: |-
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+ before being exposed inside Pod. This field will only apply to
+ volume types which support fsGroup based ownership(and permissions).
+ It will have no effect on ephemeral volume types such as: secret, configmaps
+ and emptydir.
+ Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to all containers.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in SecurityContext. If set in
+ both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+ takes precedence for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by the containers in this pod.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ supplementalGroups:
+ description: |-
+ A list of groups applied to the first process run in each container, in addition
+ to the container's primary GID, the fsGroup (if specified), and group memberships
+ defined in the container image for the uid of the container process. If unspecified,
+ no additional groups are added to any container. Note that group memberships
+ defined in the container image for the uid of the container process are still effective,
+ even if they are not included in this list.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ format: int64
+ type: integer
+ type: array
+ x-kubernetes-list-type: atomic
+ sysctls:
+ description: |-
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+ sysctls (by the container runtime) might fail to launch.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ description: Sysctl defines a kernel parameter to be set
+ properties:
+ name:
+ description: Name of a property to set
+ type: string
+ value:
+ description: Value of a property to set
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ serviceAccountName:
+ description: If specified, the pod's service account
+ type: string
+ tolerations:
+ description: If specified, the pod's tolerations.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple <key,value,effect> using the matching operator <operator>.
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ serviceType:
+ description: |-
+ Optional service type for Kubernetes solver service. Supported values
+ are NodePort or ClusterIP. If unset, defaults to NodePort.
+ type: string
+ type: object
+ ingress:
+ description: |-
+ The ingress based HTTP01 challenge solver will solve challenges by
+ creating or modifying Ingress resources in order to route requests for
+ '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+ provisioned by cert-manager for each Challenge to be completed.
+ properties:
+ class:
+ description: |-
+ This field configures the annotation `kubernetes.io/ingress.class` when
+ creating Ingress resources to solve ACME challenges that use this
+ challenge solver. Only one of `class`, `name` or `ingressClassName` may
+ be specified.
+ type: string
+ ingressClassName:
+ description: |-
+ This field configures the field `ingressClassName` on the created Ingress
+ resources used to solve ACME challenges that use this challenge solver.
+ This is the recommended way of configuring the ingress class. Only one of
+ `class`, `name` or `ingressClassName` may be specified.
+ type: string
+ ingressTemplate:
+ description: |-
+ Optional ingress template used to configure the ACME challenge solver
+ ingress used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver ingress.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver ingress.
+ type: object
+ type: object
+ type: object
+ name:
+ description: |-
+ The name of the ingress resource that should have ACME challenge solving
+ routes inserted into it in order to solve HTTP01 challenges.
+ This is typically used in conjunction with ingress controllers like
+ ingress-gce, which maintains a 1:1 mapping between external IPs and
+ ingress resources. Only one of `class`, `name` or `ingressClassName` may
+ be specified.
+ type: string
+ podTemplate:
+ description: |-
+ Optional pod template used to configure the ACME challenge solver pods
+ used for HTTP01 challenges.
+ properties:
+ metadata:
+ description: |-
+ ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+ Only the 'labels' and 'annotations' fields may be set.
+ If labels or annotations overlap with in-built values, the values here
+ will override the in-built values.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ description: Annotations that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: Labels that should be added to the created ACME HTTP01 solver pods.
+ type: object
+ type: object
+ spec:
+ description: |-
+ PodSpec defines overrides for the HTTP01 challenge solver pod.
+ Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
+ All other fields will be ignored.
+ properties:
+ affinity:
+ description: If specified, the pod's scheduling constraints
+ properties:
+ nodeAffinity:
+ description: Describes node affinity scheduling rules for the pod.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ podAffinity:
+ description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ podAntiAffinity:
+ description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the anti-affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling anti-affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and subtracting
+ "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+ properties:
+ podAffinityTerm:
+ description: Required. A pod affinity term, associated with the corresponding weight.
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ weight:
+ description: |-
+ weight associated with matching the corresponding podAffinityTerm,
+ in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - podAffinityTerm
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the anti-affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the anti-affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to a pod label update), the
+ system may or may not try to eventually evict the pod from its node.
+ When there are multiple elements, the lists of nodes corresponding to each
+ podAffinityTerm are intersected, i.e. all terms must be satisfied.
+ items:
+ description: |-
+ Defines a set of pods (namely those matching the labelSelector
+ relative to the given namespace(s)) that this pod should be
+ co-located (affinity) or not co-located (anti-affinity) with,
+ where co-located is defined as running on a node whose value of
+ the label with key <topologyKey> matches that of any node on which
+ a pod of the set of pods is running
+ properties:
+ labelSelector:
+ description: |-
+ A label query over a set of resources, in this case pods.
+ If it's null, this PodAffinityTerm matches with no Pods.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+ Also, matchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ mismatchLabelKeys:
+ description: |-
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+ be taken into consideration. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+ to select the group of existing pods which pods will be taken into consideration
+ for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+ pod labels will be ignored. The default value is empty.
+ The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+ Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ namespaceSelector:
+ description: |-
+ A label query over the set of namespaces that the term applies to.
+ The term is applied to the union of the namespaces selected by this field
+ and the ones listed in the namespaces field.
+ null selector and null or empty namespaces list means "this pod's namespace".
+ An empty selector ({}) matches all namespaces.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: |-
+ namespaces specifies a static list of namespace names that the term applies to.
+ The term is applied to the union of the namespaces listed in this field
+ and the ones selected by namespaceSelector.
+ null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ topologyKey:
+ description: |-
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+ the labelSelector in the specified namespaces, where co-located is defined as running on a node
+ whose value of the label with key topologyKey matches that of any node on which any of the
+ selected pods is running.
+ Empty topologyKey is not allowed.
+ type: string
+ required:
+ - topologyKey
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ imagePullSecrets:
+ description: If specified, the pod's imagePullSecrets
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ NodeSelector is a selector which must be true for the pod to fit on a node.
+ Selector which must match a node's labels for the pod to be scheduled on that node.
+ More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ priorityClassName:
+ description: If specified, the pod's priorityClassName.
+ type: string
+ resources:
+ description: |-
+ If specified, the pod's resource requirements.
+ These values override the global resource configuration flags.
+ Note that when only specifying resource limits, ensure they are greater than or equal
+ to the corresponding global resource requests configured via controller flags
+ (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
+ Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
+ properties:
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ securityContext:
+ description: If specified, the pod's security context
+ properties:
+ fsGroup:
+ description: |-
+ A special supplemental group that applies to all containers in a pod.
+ Some volume types allow the Kubelet to change the ownership of that volume
+ to be owned by the pod:
+
+ 1. The owning GID will be the FSGroup
+ 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+ 3. The permission bits are OR'd with rw-rw----
+
+ If unset, the Kubelet will not modify the ownership and permissions of any volume.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ fsGroupChangePolicy:
+ description: |-
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+ before being exposed inside Pod. This field will only apply to
+ volume types which support fsGroup based ownership(and permissions).
+ It will have no effect on ephemeral volume types such as: secret, configmaps
+ and emptydir.
+ Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in SecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence
+ for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to all containers.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in SecurityContext. If set in
+ both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+ takes precedence for that container.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by the containers in this pod.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ supplementalGroups:
+ description: |-
+ A list of groups applied to the first process run in each container, in addition
+ to the container's primary GID, the fsGroup (if specified), and group memberships
+ defined in the container image for the uid of the container process. If unspecified,
+ no additional groups are added to any container. Note that group memberships
+ defined in the container image for the uid of the container process are still effective,
+ even if they are not included in this list.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ format: int64
+ type: integer
+ type: array
+ x-kubernetes-list-type: atomic
+ sysctls:
+ description: |-
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+ sysctls (by the container runtime) might fail to launch.
+ Note that this field cannot be set when spec.os.name is windows.
+ items:
+ description: Sysctl defines a kernel parameter to be set
+ properties:
+ name:
+ description: Name of a property to set
+ type: string
+ value:
+ description: Value of a property to set
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ serviceAccountName:
+ description: If specified, the pod's service account
+ type: string
+ tolerations:
+ description: If specified, the pod's tolerations.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple <key,value,effect> using the matching operator <operator>.
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ serviceType:
+ description: |-
+ Optional service type for Kubernetes solver service. Supported values
+ are NodePort or ClusterIP. If unset, defaults to NodePort.
+ type: string
+ type: object
+ type: object
+ selector:
+ description: |-
+ Selector selects a set of DNSNames on the Certificate resource that
+ should be solved using this challenge solver.
+ If not specified, the solver will be treated as the 'default' solver
+ with the lowest priority, i.e. if any other solver has a more specific
+ match, it will be used instead.
+ properties:
+ dnsNames:
+ description: |-
+ List of DNSNames that this solver will be used to solve.
+ If specified and a match is found, a dnsNames selector will take
+ precedence over a dnsZones selector.
+ If multiple solvers match with the same dnsNames value, the solver
+ with the most matching labels in matchLabels will be selected.
+ If neither has more matches, the solver defined earlier in the list
+ will be selected.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsZones:
+ description: |-
+ List of DNSZones that this solver will be used to solve.
+ The most specific DNS zone match specified here will take precedence
+ over other DNS zone matches, so a solver specifying sys.example.com
+ will be selected over one specifying example.com for the domain
+ www.sys.example.com.
+ If multiple solvers match with the same dnsZones value, the solver
+ with the most matching labels in matchLabels will be selected.
+ If neither has more matches, the solver defined earlier in the list
+ will be selected.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ A label selector that is used to refine the set of certificate's that
+ this challenge solver will apply to.
+ type: object
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - privateKeySecretRef
+ - server
+ type: object
+ ca:
+ description: |-
+ CA configures this issuer to sign certificates using a signing CA keypair
+ stored in a Secret resource.
+ This is used to build internal PKIs that are managed by cert-manager.
+ properties:
+ crlDistributionPoints:
+ description: |-
+ The CRL distribution points is an X.509 v3 certificate extension which identifies
+ the location of the CRL from which the revocation of this certificate can be checked.
+ If not set, certificates will be issued without distribution points set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ issuingCertificateURLs:
+ description: |-
+ IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
+ it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
+ As an example, such a URL might be "http://ca.domain.com/ca.crt".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ ocspServers:
+ description: |-
+ The OCSP server list is an X.509 v3 extension that defines a list of
+ URLs of OCSP responders. The OCSP responders can be queried for the
+ revocation status of an issued certificate. If not set, the
+ certificate will be issued with no OCSP servers set. For example, an
+ OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ secretName:
+ description: |-
+ SecretName is the name of the secret used to sign Certificates issued
+ by this Issuer.
+ type: string
+ required:
+ - secretName
+ type: object
+ selfSigned:
+ description: |-
+ SelfSigned configures this issuer to 'self sign' certificates using the
+ private key used to create the CertificateRequest object.
+ properties:
+ crlDistributionPoints:
+ description: |-
+ The CRL distribution points is an X.509 v3 certificate extension which identifies
+ the location of the CRL from which the revocation of this certificate can be checked.
+ If not set certificate will be issued without CDP. Values are strings.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ vault:
+ description: |-
+ Vault configures this issuer to sign certificates using a HashiCorp Vault
+ PKI backend.
+ properties:
+ auth:
+ description: Auth configures how cert-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ description: |-
+ Path where the App Role authentication backend is mounted in Vault, e.g:
+ "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - path
+ - roleId
+ - secretRef
+ type: object
+ clientCertificate:
+ description: |-
+ ClientCertificate authenticates with Vault by presenting a client
+ certificate during the request's TLS handshake.
+ Works only when using HTTPS protocol.
+ properties:
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/cert" will be used.
+ type: string
+ name:
+ description: |-
+ Name of the certificate role to authenticate against.
+ If not set, matching any certificate role, if available.
+ type: string
+ secretName:
+ description: |-
+ Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
+ tls.crt and tls.key) used to authenticate to Vault using TLS client
+ authentication.
+ type: string
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/kubernetes" will be used.
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ The required Secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. Use of 'ambient credentials' is not
+ supported.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a bound
+ token (also known as "projected token"). Compared to using "secretRef",
+ using this field means that you don't rely on statically bound tokens. To
+ use this field, you must configure an RBAC rule to let cert-manager
+ request a token.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
+ consisting of the issuer's namespace and name is always included.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - role
+ type: object
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+ chain presented by Vault. Only used if using HTTPS to connect to Vault and
+ ignored for HTTP connections.
+ Mutually exclusive with CABundleSecretRef.
+ If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+ the cert-manager controller container is used to validate the TLS connection.
+ format: byte
+ type: string
+ caBundleSecretRef:
+ description: |-
+ Reference to a Secret containing a bundle of PEM-encoded CAs to use when
+ verifying the certificate chain presented by Vault when using HTTPS.
+ Mutually exclusive with CABundle.
+ If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
+ the cert-manager controller container is used to validate the TLS connection.
+ If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientCertSecretRef:
+ description: |-
+ Reference to a Secret containing a PEM-encoded Client Certificate to use when the
+ Vault server requires mTLS.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ clientKeySecretRef:
+ description: |-
+ Reference to a Secret containing a PEM-encoded Client Private Key to use when the
+ Vault server requires mTLS.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
+ "my_pki_mount/sign/my-role-name".
+ type: string
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ serverName:
+ description: |-
+ ServerName is used to verify the hostname on the returned certificates
+ by the Vault server.
+ type: string
+ required:
+ - auth
+ - path
+ - server
+ type: object
+ venafi:
+ description: |-
+ Venafi configures this issuer to sign certificates using a Venafi TPP
+ or Venafi Cloud policy zone.
+ properties:
+ cloud:
+ description: |-
+ Cloud specifies the Venafi cloud configuration settings.
+ Only one of TPP or Cloud may be specified.
+ properties:
+ apiTokenSecretRef:
+ description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: |-
+ URL is the base URL for Venafi Cloud.
+ Defaults to "https://api.venafi.cloud/".
+ type: string
+ required:
+ - apiTokenSecretRef
+ type: object
+ tpp:
+ description: |-
+ TPP specifies Trust Protection Platform configuration settings.
+ Only one of TPP or Cloud may be specified.
+ properties:
+ caBundle:
+ description: |-
+ Base64-encoded bundle of PEM CAs which will be used to validate the certificate
+ chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+ If undefined, the certificate bundle in the cert-manager controller container
+ is used to validate the chain.
+ format: byte
+ type: string
+ caBundleSecretRef:
+ description: |-
+ Reference to a Secret containing a base64-encoded bundle of PEM CAs
+ which will be used to validate the certificate chain presented by the TPP server.
+ Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
+ If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
+ the cert-manager controller container is used to validate the TLS connection.
+ properties:
+ key:
+ description: |-
+ The key of the entry in the Secret resource's `data` field to be used.
+ Some instances of this field may be defaulted, in others it may be
+ required.
+ type: string
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+ The secret must contain the key 'access-token' for the Access Token Authentication,
+ or two keys, 'username' and 'password' for the API Keys Authentication.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: |-
+ URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+ for example: "https://tpp.example.com/vedsdk".
+ type: string
+ required:
+ - credentialsRef
+ - url
+ type: object
+ zone:
+ description: |-
+ Zone is the Venafi Policy Zone to use for this issuer.
+ All requests made to the Venafi platform will be restricted by the named
+ zone policy.
+ This field is required.
+ type: string
+ required:
+ - zone
+ type: object
+ type: object
+ status:
+ description: Status of the Issuer. This is set and managed automatically.
+ properties:
+ acme:
+ description: |-
+ ACME specific status options.
+ This field should only be set if the Issuer is configured to use an ACME
+ server to issue certificates.
+ properties:
+ lastPrivateKeyHash:
+ description: |-
+ LastPrivateKeyHash is a hash of the private key associated with the latest
+ registered ACME account, in order to track changes made to registered account
+ associated with the Issuer
+ type: string
+ lastRegisteredEmail:
+ description: |-
+ LastRegisteredEmail is the email associated with the latest registered
+ ACME account, in order to track changes made to registered account
+ associated with the Issuer
+ type: string
+ uri:
+ description: |-
+ URI is the unique account identifier, which can also be used to retrieve
+ account details from the CA
+ type: string
+ type: object
+ conditions:
+ description: |-
+ List of status conditions to indicate the status of a CertificateRequest.
+ Known condition types are `Ready`.
+ items:
+ description: IssuerCondition contains condition information for an Issuer.
+ properties:
+ lastTransitionTime:
+ description: |-
+ LastTransitionTime is the timestamp corresponding to the last status
+ change of this condition.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ Message is a human readable description of the details of the last
+ transition, complementing reason.
+ type: string
+ observedGeneration:
+ description: |-
+ If set, this represents the .metadata.generation that the condition was
+ set based upon.
+ For instance, if .metadata.generation is currently 12, but the
+ .status.condition[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the Issuer.
+ format: int64
+ type: integer
+ reason:
+ description: |-
+ Reason is a brief machine readable explanation for the condition's last
+ transition.
+ type: string
+ status:
+ description: Status of the condition, one of (`True`, `False`, `Unknown`).
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: Type of the condition, known values are (`Ready`).
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/cert-manager/templates/crds.yaml b/charts/cert-manager/templates/crds.yaml
deleted file mode 100644
index 7979a58..0000000
--- a/charts/cert-manager/templates/crds.yaml
+++ /dev/null
@@ -1,12079 +0,0 @@
-# {{- include "cert-manager.crd-check" . }}
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- name: certificaterequests.cert-manager.io
- # START annotations {{- if .Values.crds.keep }}
- annotations:
- helm.sh/resource-policy: keep
- # END annotations {{- end }}
- labels:
- app: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/instance: '{{ .Release.Name }}'
- # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
- group: cert-manager.io
- names:
- kind: CertificateRequest
- listKind: CertificateRequestList
- plural: certificaterequests
- shortNames:
- - cr
- - crs
- singular: certificaterequest
- categories:
- - cert-manager
- scope: Namespaced
- versions:
- - name: v1
- subresources:
- status: {}
- additionalPrinterColumns:
- - jsonPath: .status.conditions[?(@.type=="Approved")].status
- name: Approved
- type: string
- - jsonPath: .status.conditions[?(@.type=="Denied")].status
- name: Denied
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .spec.issuerRef.name
- name: Issuer
- type: string
- - jsonPath: .spec.username
- name: Requester
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- priority: 1
- type: string
- - jsonPath: .metadata.creationTimestamp
- description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
- name: Age
- type: date
- schema:
- openAPIV3Schema:
- description: |-
- A CertificateRequest is used to request a signed certificate from one of the
- configured issuers.
-
- All fields within the CertificateRequest's `spec` are immutable after creation.
- A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
- condition and its `status.failureTime` field.
-
- A CertificateRequest is a one-shot resource, meaning it represents a single
- point in time request for a certificate and cannot be re-used.
- type: object
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: |-
- Specification of the desired state of the CertificateRequest resource.
- https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
- type: object
- required:
- - issuerRef
- - request
- properties:
- duration:
- description: |-
- Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
- issuer may choose to ignore the requested duration, just like any other
- requested attribute.
- type: string
- extra:
- description: |-
- Extra contains extra attributes of the user that created the CertificateRequest.
- Populated by the cert-manager webhook on creation and immutable.
- type: object
- additionalProperties:
- type: array
- items:
- type: string
- groups:
- description: |-
- Groups contains group membership of the user that created the CertificateRequest.
- Populated by the cert-manager webhook on creation and immutable.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- isCA:
- description: |-
- Requested basic constraints isCA value. Note that the issuer may choose
- to ignore the requested isCA value, just like any other requested attribute.
-
- NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
- it must have the same isCA value as specified here.
-
- If true, this will automatically add the `cert sign` usage to the list
- of requested `usages`.
- type: boolean
- issuerRef:
- description: |-
- Reference to the issuer responsible for issuing the certificate.
- If the issuer is namespace-scoped, it must be in the same namespace
- as the Certificate. If the issuer is cluster-scoped, it can be used
- from any namespace.
-
- The `name` field of the reference must always be specified.
- type: object
- required:
- - name
- properties:
- group:
- description: Group of the resource being referred to.
- type: string
- kind:
- description: Kind of the resource being referred to.
- type: string
- name:
- description: Name of the resource being referred to.
- type: string
- request:
- description: |-
- The PEM-encoded X.509 certificate signing request to be submitted to the
- issuer for signing.
-
- If the CSR has a BasicConstraints extension, its isCA attribute must
- match the `isCA` value of this CertificateRequest.
- If the CSR has a KeyUsage extension, its key usages must match the
- key usages in the `usages` field of this CertificateRequest.
- If the CSR has a ExtKeyUsage extension, its extended key usages
- must match the extended key usages in the `usages` field of this
- CertificateRequest.
- type: string
- format: byte
- uid:
- description: |-
- UID contains the uid of the user that created the CertificateRequest.
- Populated by the cert-manager webhook on creation and immutable.
- type: string
- usages:
- description: |-
- Requested key usages and extended key usages.
-
- NOTE: If the CSR in the `Request` field has uses the KeyUsage or
- ExtKeyUsage extension, these extensions must have the same values
- as specified here without any additional values.
-
- If unset, defaults to `digital signature` and `key encipherment`.
- type: array
- items:
- description: |-
- KeyUsage specifies valid usage contexts for keys.
- See:
- https://tools.ietf.org/html/rfc5280#section-4.2.1.3
- https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
- Valid KeyUsage values are as follows:
- "signing",
- "digital signature",
- "content commitment",
- "key encipherment",
- "key agreement",
- "data encipherment",
- "cert sign",
- "crl sign",
- "encipher only",
- "decipher only",
- "any",
- "server auth",
- "client auth",
- "code signing",
- "email protection",
- "s/mime",
- "ipsec end system",
- "ipsec tunnel",
- "ipsec user",
- "timestamping",
- "ocsp signing",
- "microsoft sgc",
- "netscape sgc"
- type: string
- enum:
- - signing
- - digital signature
- - content commitment
- - key encipherment
- - key agreement
- - data encipherment
- - cert sign
- - crl sign
- - encipher only
- - decipher only
- - any
- - server auth
- - client auth
- - code signing
- - email protection
- - s/mime
- - ipsec end system
- - ipsec tunnel
- - ipsec user
- - timestamping
- - ocsp signing
- - microsoft sgc
- - netscape sgc
- username:
- description: |-
- Username contains the name of the user that created the CertificateRequest.
- Populated by the cert-manager webhook on creation and immutable.
- type: string
- status:
- description: |-
- Status of the CertificateRequest.
- This is set and managed automatically.
- Read-only.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
- type: object
- properties:
- ca:
- description: |-
- The PEM encoded X.509 certificate of the signer, also known as the CA
- (Certificate Authority).
- This is set on a best-effort basis by different issuers.
- If not set, the CA is assumed to be unknown/not available.
- type: string
- format: byte
- certificate:
- description: |-
- The PEM encoded X.509 certificate resulting from the certificate
- signing request.
- If not set, the CertificateRequest has either not been completed or has
- failed. More information on failure can be found by checking the
- `conditions` field.
- type: string
- format: byte
- conditions:
- description: |-
- List of status conditions to indicate the status of a CertificateRequest.
- Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
- type: array
- items:
- description: CertificateRequestCondition contains condition information for a CertificateRequest.
- type: object
- required:
- - status
- - type
- properties:
- lastTransitionTime:
- description: |-
- LastTransitionTime is the timestamp corresponding to the last status
- change of this condition.
- type: string
- format: date-time
- message:
- description: |-
- Message is a human readable description of the details of the last
- transition, complementing reason.
- type: string
- reason:
- description: |-
- Reason is a brief machine readable explanation for the condition's last
- transition.
- type: string
- status:
- description: Status of the condition, one of (`True`, `False`, `Unknown`).
- type: string
- enum:
- - "True"
- - "False"
- - Unknown
- type:
- description: |-
- Type of the condition, known values are (`Ready`, `InvalidRequest`,
- `Approved`, `Denied`).
- type: string
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- failureTime:
- description: |-
- FailureTime stores the time that this CertificateRequest failed. This is
- used to influence garbage collection and back-off.
- type: string
- format: date-time
- served: true
- storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- name: certificates.cert-manager.io
- # START annotations {{- if .Values.crds.keep }}
- annotations:
- helm.sh/resource-policy: keep
- # END annotations {{- end }}
- labels:
- app: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/instance: '{{ .Release.Name }}'
- # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
- group: cert-manager.io
- names:
- kind: Certificate
- listKind: CertificateList
- plural: certificates
- shortNames:
- - cert
- - certs
- singular: certificate
- categories:
- - cert-manager
- scope: Namespaced
- versions:
- - name: v1
- subresources:
- status: {}
- additionalPrinterColumns:
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .spec.secretName
- name: Secret
- type: string
- - jsonPath: .spec.issuerRef.name
- name: Issuer
- priority: 1
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- priority: 1
- type: string
- - jsonPath: .metadata.creationTimestamp
- description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
- name: Age
- type: date
- schema:
- openAPIV3Schema:
- description: |-
- A Certificate resource should be created to ensure an up to date and signed
- X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
-
- The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
- type: object
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: |-
- Specification of the desired state of the Certificate resource.
- https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
- type: object
- required:
- - issuerRef
- - secretName
- properties:
- additionalOutputFormats:
- description: |-
- Defines extra output formats of the private key and signed certificate chain
- to be written to this Certificate's target Secret.
- type: array
- items:
- description: |-
- CertificateAdditionalOutputFormat defines an additional output format of a
- Certificate resource. These contain supplementary data formats of the signed
- certificate chain and paired private key.
- type: object
- required:
- - type
- properties:
- type:
- description: |-
- Type is the name of the format type that should be written to the
- Certificate's target Secret.
- type: string
- enum:
- - DER
- - CombinedPEM
- commonName:
- description: |-
- Requested common name X509 certificate subject attribute.
- More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
- NOTE: TLS clients will ignore this value when any subject alternative name is
- set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
-
- Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
- Cannot be set if the `literalSubject` field is set.
- type: string
- dnsNames:
- description: Requested DNS subject alternative names.
- type: array
- items:
- type: string
- duration:
- description: |-
- Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
- issuer may choose to ignore the requested duration, just like any other
- requested attribute.
-
- If unset, this defaults to 90 days.
- Minimum accepted duration is 1 hour.
- Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
- type: string
- emailAddresses:
- description: Requested email subject alternative names.
- type: array
- items:
- type: string
- encodeUsagesInRequest:
- description: |-
- Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
-
- This option defaults to true, and should only be disabled if the target
- issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
- type: boolean
- ipAddresses:
- description: Requested IP address subject alternative names.
- type: array
- items:
- type: string
- isCA:
- description: |-
- Requested basic constraints isCA value.
- The isCA value is used to set the `isCA` field on the created CertificateRequest
- resources. Note that the issuer may choose to ignore the requested isCA value, just
- like any other requested attribute.
-
- If true, this will automatically add the `cert sign` usage to the list
- of requested `usages`.
- type: boolean
- issuerRef:
- description: |-
- Reference to the issuer responsible for issuing the certificate.
- If the issuer is namespace-scoped, it must be in the same namespace
- as the Certificate. If the issuer is cluster-scoped, it can be used
- from any namespace.
-
- The `name` field of the reference must always be specified.
- type: object
- required:
- - name
- properties:
- group:
- description: Group of the resource being referred to.
- type: string
- kind:
- description: Kind of the resource being referred to.
- type: string
- name:
- description: Name of the resource being referred to.
- type: string
- keystores:
- description: Additional keystore output formats to be stored in the Certificate's Secret.
- type: object
- properties:
- jks:
- description: |-
- JKS configures options for storing a JKS keystore in the
- `spec.secretName` Secret resource.
- type: object
- required:
- - create
- properties:
- alias:
- description: |-
- Alias specifies the alias of the key in the keystore, required by the JKS format.
- If not provided, the default alias `certificate` will be used.
- type: string
- create:
- description: |-
- Create enables JKS keystore creation for the Certificate.
- If true, a file named `keystore.jks` will be created in the target
- Secret resource, encrypted using the password stored in
- `passwordSecretRef` or `password`.
- The keystore file will be updated immediately.
- If the issuer provided a CA certificate, a file named `truststore.jks`
- will also be created in the target Secret resource, encrypted using the
- password stored in `passwordSecretRef`
- containing the issuing Certificate Authority
- type: boolean
- password:
- description: |-
- Password provides a literal password used to encrypt the JKS keystore.
- Mutually exclusive with passwordSecretRef.
- One of password or passwordSecretRef must provide a password with a non-zero length.
- type: string
- passwordSecretRef:
- description: |-
- PasswordSecretRef is a reference to a non-empty key in a Secret resource
- containing the password used to encrypt the JKS keystore.
- Mutually exclusive with password.
- One of password or passwordSecretRef must provide a password with a non-zero length.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- pkcs12:
- description: |-
- PKCS12 configures options for storing a PKCS12 keystore in the
- `spec.secretName` Secret resource.
- type: object
- required:
- - create
- properties:
- create:
- description: |-
- Create enables PKCS12 keystore creation for the Certificate.
- If true, a file named `keystore.p12` will be created in the target
- Secret resource, encrypted using the password stored in
- `passwordSecretRef` or in `password`.
- The keystore file will be updated immediately.
- If the issuer provided a CA certificate, a file named `truststore.p12` will
- also be created in the target Secret resource, encrypted using the
- password stored in `passwordSecretRef` containing the issuing Certificate
- Authority
- type: boolean
- password:
- description: |-
- Password provides a literal password used to encrypt the PKCS#12 keystore.
- Mutually exclusive with passwordSecretRef.
- One of password or passwordSecretRef must provide a password with a non-zero length.
- type: string
- passwordSecretRef:
- description: |-
- PasswordSecretRef is a reference to a non-empty key in a Secret resource
- containing the password used to encrypt the PKCS#12 keystore.
- Mutually exclusive with password.
- One of password or passwordSecretRef must provide a password with a non-zero length.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- profile:
- description: |-
- Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
- used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
-
- If provided, allowed values are:
- `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
- `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
- `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
- (e.g., because of company policy). Please note that the security of the algorithm is not that important
- in reality, because the unencrypted certificate and private key are also stored in the Secret.
- type: string
- enum:
- - LegacyRC2
- - LegacyDES
- - Modern2023
- literalSubject:
- description: |-
- Requested X.509 certificate subject, represented using the LDAP "String
- Representation of a Distinguished Name" [1].
- Important: the LDAP string format also specifies the order of the attributes
- in the subject, this is important when issuing certs for LDAP authentication.
- Example: `CN=foo,DC=corp,DC=example,DC=com`
- More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
- More info: https://github.com/cert-manager/cert-manager/issues/3203
- More info: https://github.com/cert-manager/cert-manager/issues/4424
-
- Cannot be set if the `subject` or `commonName` field is set.
- type: string
- nameConstraints:
- description: |-
- x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
- More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
-
- This is an Alpha Feature and is only enabled with the
- `--feature-gates=NameConstraints=true` option set on both
- the controller and webhook components.
- type: object
- properties:
- critical:
- description: if true then the name constraints are marked critical.
- type: boolean
- excluded:
- description: |-
- Excluded contains the constraints which must be disallowed. Any name matching a
- restriction in the excluded field is invalid regardless
- of information appearing in the permitted
- type: object
- properties:
- dnsDomains:
- description: DNSDomains is a list of DNS domains that are permitted or excluded.
- type: array
- items:
- type: string
- emailAddresses:
- description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
- type: array
- items:
- type: string
- ipRanges:
- description: |-
- IPRanges is a list of IP Ranges that are permitted or excluded.
- This should be a valid CIDR notation.
- type: array
- items:
- type: string
- uriDomains:
- description: URIDomains is a list of URI domains that are permitted or excluded.
- type: array
- items:
- type: string
- permitted:
- description: Permitted contains the constraints in which the names must be located.
- type: object
- properties:
- dnsDomains:
- description: DNSDomains is a list of DNS domains that are permitted or excluded.
- type: array
- items:
- type: string
- emailAddresses:
- description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
- type: array
- items:
- type: string
- ipRanges:
- description: |-
- IPRanges is a list of IP Ranges that are permitted or excluded.
- This should be a valid CIDR notation.
- type: array
- items:
- type: string
- uriDomains:
- description: URIDomains is a list of URI domains that are permitted or excluded.
- type: array
- items:
- type: string
- otherNames:
- description: |-
- `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
- Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
- Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
- You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
- type: array
- items:
- type: object
- properties:
- oid:
- description: |-
- OID is the object identifier for the otherName SAN.
- The object identifier must be expressed as a dotted string, for
- example, "1.2.840.113556.1.4.221".
- type: string
- utf8Value:
- description: |-
- utf8Value is the string value of the otherName SAN.
- The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
- type: string
- privateKey:
- description: |-
- Private key options. These include the key algorithm and size, the used
- encoding and the rotation policy.
- type: object
- properties:
- algorithm:
- description: |-
- Algorithm is the private key algorithm of the corresponding private key
- for this certificate.
-
- If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
- If `algorithm` is specified and `size` is not provided,
- key size of 2048 will be used for `RSA` key algorithm and
- key size of 256 will be used for `ECDSA` key algorithm.
- key size is ignored when using the `Ed25519` key algorithm.
- type: string
- enum:
- - RSA
- - ECDSA
- - Ed25519
- encoding:
- description: |-
- The private key cryptography standards (PKCS) encoding for this
- certificate's private key to be encoded in.
-
- If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
- and PKCS#8, respectively.
- Defaults to `PKCS1` if not specified.
- type: string
- enum:
- - PKCS1
- - PKCS8
- rotationPolicy:
- description: |-
- RotationPolicy controls how private keys should be regenerated when a
- re-issuance is being processed.
-
- If set to `Never`, a private key will only be generated if one does not
- already exist in the target `spec.secretName`. If one does exist but it
- does not have the correct algorithm or size, a warning will be raised
- to await user intervention.
- If set to `Always`, a private key matching the specified requirements
- will be generated whenever a re-issuance occurs.
- Default is `Always`.
- The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
- The new default can be disabled by setting the
- `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
- the controller component.
- type: string
- enum:
- - Never
- - Always
- size:
- description: |-
- Size is the key bit size of the corresponding private key for this certificate.
-
- If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
- and will default to `2048` if not specified.
- If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
- and will default to `256` if not specified.
- If `algorithm` is set to `Ed25519`, Size is ignored.
- No other values are allowed.
- type: integer
- renewBefore:
- description: |-
- How long before the currently issued certificate's expiry cert-manager should
- renew the certificate. For example, if a certificate is valid for 60 minutes,
- and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
- 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
- the certificate is no longer valid).
-
- NOTE: The actual lifetime of the issued certificate is used to determine the
- renewal time. If an issuer returns a certificate with a different lifetime than
- the one requested, cert-manager will use the lifetime of the issued certificate.
-
- If unset, this defaults to 1/3 of the issued certificate's lifetime.
- Minimum accepted value is 5 minutes.
- Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
- Cannot be set if the `renewBeforePercentage` field is set.
- type: string
- renewBeforePercentage:
- description: |-
- `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
- rather than an absolute duration. For example, if a certificate is valid for 60
- minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to
- renew the certificate 45 minutes after it was issued (i.e. when there are 15
- minutes (25%) remaining until the certificate is no longer valid).
-
- NOTE: The actual lifetime of the issued certificate is used to determine the
- renewal time. If an issuer returns a certificate with a different lifetime than
- the one requested, cert-manager will use the lifetime of the issued certificate.
-
- Value must be an integer in the range (0,100). The minimum effective
- `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
- minutes.
- Cannot be set if the `renewBefore` field is set.
- type: integer
- format: int32
- revisionHistoryLimit:
- description: |-
- The maximum number of CertificateRequest revisions that are maintained in
- the Certificate's history. Each revision represents a single `CertificateRequest`
- created by this Certificate, either when it was created, renewed, or Spec
- was changed. Revisions will be removed by oldest first if the number of
- revisions exceeds this number.
-
- If set, revisionHistoryLimit must be a value of `1` or greater.
- Default value is `1`.
- type: integer
- format: int32
- secretName:
- description: |-
- Name of the Secret resource that will be automatically created and
- managed by this Certificate resource. It will be populated with a
- private key and certificate, signed by the denoted issuer. The Secret
- resource lives in the same namespace as the Certificate resource.
- type: string
- secretTemplate:
- description: |-
- Defines annotations and labels to be copied to the Certificate's Secret.
- Labels and annotations on the Secret will be changed as they appear on the
- SecretTemplate when added or removed. SecretTemplate annotations are added
- in conjunction with, and cannot overwrite, the base set of annotations
- cert-manager sets on the Certificate's Secret.
- type: object
- properties:
- annotations:
- description: Annotations is a key value map to be copied to the target Kubernetes Secret.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels is a key value map to be copied to the target Kubernetes Secret.
- type: object
- additionalProperties:
- type: string
- signatureAlgorithm:
- description: |-
- Signature algorithm to use.
- Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
- Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
- Allowed values for Ed25519 keys: PureEd25519.
- type: string
- enum:
- - SHA256WithRSA
- - SHA384WithRSA
- - SHA512WithRSA
- - ECDSAWithSHA256
- - ECDSAWithSHA384
- - ECDSAWithSHA512
- - PureEd25519
- subject:
- description: |-
- Requested set of X509 certificate subject attributes.
- More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
-
- The common name attribute is specified separately in the `commonName` field.
- Cannot be set if the `literalSubject` field is set.
- type: object
- properties:
- countries:
- description: Countries to be used on the Certificate.
- type: array
- items:
- type: string
- localities:
- description: Cities to be used on the Certificate.
- type: array
- items:
- type: string
- organizationalUnits:
- description: Organizational Units to be used on the Certificate.
- type: array
- items:
- type: string
- organizations:
- description: Organizations to be used on the Certificate.
- type: array
- items:
- type: string
- postalCodes:
- description: Postal codes to be used on the Certificate.
- type: array
- items:
- type: string
- provinces:
- description: State/Provinces to be used on the Certificate.
- type: array
- items:
- type: string
- serialNumber:
- description: Serial number to be used on the Certificate.
- type: string
- streetAddresses:
- description: Street addresses to be used on the Certificate.
- type: array
- items:
- type: string
- uris:
- description: Requested URI subject alternative names.
- type: array
- items:
- type: string
- usages:
- description: |-
- Requested key usages and extended key usages.
- These usages are used to set the `usages` field on the created CertificateRequest
- resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
- will additionally be encoded in the `request` field which contains the CSR blob.
-
- If unset, defaults to `digital signature` and `key encipherment`.
- type: array
- items:
- description: |-
- KeyUsage specifies valid usage contexts for keys.
- See:
- https://tools.ietf.org/html/rfc5280#section-4.2.1.3
- https://tools.ietf.org/html/rfc5280#section-4.2.1.12
-
- Valid KeyUsage values are as follows:
- "signing",
- "digital signature",
- "content commitment",
- "key encipherment",
- "key agreement",
- "data encipherment",
- "cert sign",
- "crl sign",
- "encipher only",
- "decipher only",
- "any",
- "server auth",
- "client auth",
- "code signing",
- "email protection",
- "s/mime",
- "ipsec end system",
- "ipsec tunnel",
- "ipsec user",
- "timestamping",
- "ocsp signing",
- "microsoft sgc",
- "netscape sgc"
- type: string
- enum:
- - signing
- - digital signature
- - content commitment
- - key encipherment
- - key agreement
- - data encipherment
- - cert sign
- - crl sign
- - encipher only
- - decipher only
- - any
- - server auth
- - client auth
- - code signing
- - email protection
- - s/mime
- - ipsec end system
- - ipsec tunnel
- - ipsec user
- - timestamping
- - ocsp signing
- - microsoft sgc
- - netscape sgc
- status:
- description: |-
- Status of the Certificate.
- This is set and managed automatically.
- Read-only.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
- type: object
- properties:
- conditions:
- description: |-
- List of status conditions to indicate the status of certificates.
- Known condition types are `Ready` and `Issuing`.
- type: array
- items:
- description: CertificateCondition contains condition information for a Certificate.
- type: object
- required:
- - status
- - type
- properties:
- lastTransitionTime:
- description: |-
- LastTransitionTime is the timestamp corresponding to the last status
- change of this condition.
- type: string
- format: date-time
- message:
- description: |-
- Message is a human readable description of the details of the last
- transition, complementing reason.
- type: string
- observedGeneration:
- description: |-
- If set, this represents the .metadata.generation that the condition was
- set based upon.
- For instance, if .metadata.generation is currently 12, but the
- .status.condition[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the Certificate.
- type: integer
- format: int64
- reason:
- description: |-
- Reason is a brief machine readable explanation for the condition's last
- transition.
- type: string
- status:
- description: Status of the condition, one of (`True`, `False`, `Unknown`).
- type: string
- enum:
- - "True"
- - "False"
- - Unknown
- type:
- description: Type of the condition, known values are (`Ready`, `Issuing`).
- type: string
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- failedIssuanceAttempts:
- description: |-
- The number of continuous failed issuance attempts up till now. This
- field gets removed (if set) on a successful issuance and gets set to
- 1 if unset and an issuance has failed. If an issuance has failed, the
- delay till the next issuance will be calculated using formula
- time.Hour * 2 ^ (failedIssuanceAttempts - 1).
- type: integer
- lastFailureTime:
- description: |-
- LastFailureTime is set only if the latest issuance for this
- Certificate failed and contains the time of the failure. If an
- issuance has failed, the delay till the next issuance will be
- calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
- 1). If the latest issuance has succeeded this field will be unset.
- type: string
- format: date-time
- nextPrivateKeySecretName:
- description: |-
- The name of the Secret resource containing the private key to be used
- for the next certificate iteration.
- The keymanager controller will automatically set this field if the
- `Issuing` condition is set to `True`.
- It will automatically unset this field when the Issuing condition is
- not set or False.
- type: string
- notAfter:
- description: |-
- The expiration time of the certificate stored in the secret named
- by this resource in `spec.secretName`.
- type: string
- format: date-time
- notBefore:
- description: |-
- The time after which the certificate stored in the secret named
- by this resource in `spec.secretName` is valid.
- type: string
- format: date-time
- renewalTime:
- description: |-
- RenewalTime is the time at which the certificate will be next
- renewed.
- If not set, no upcoming renewal is scheduled.
- type: string
- format: date-time
- revision:
- description: |-
- The current 'revision' of the certificate as issued.
-
- When a CertificateRequest resource is created, it will have the
- `cert-manager.io/certificate-revision` set to one greater than the
- current value of this field.
-
- Upon issuance, this field will be set to the value of the annotation
- on the CertificateRequest resource used to issue the certificate.
-
- Persisting the value on the CertificateRequest resource allows the
- certificates controller to know whether a request is part of an old
- issuance or if it is part of the ongoing revision's issuance by
- checking if the revision value in the annotation is greater than this
- field.
- type: integer
- served: true
- storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- name: challenges.acme.cert-manager.io
- # START annotations {{- if .Values.crds.keep }}
- annotations:
- helm.sh/resource-policy: keep
- # END annotations {{- end }}
- labels:
- app: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/instance: '{{ .Release.Name }}'
- # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
- group: acme.cert-manager.io
- names:
- kind: Challenge
- listKind: ChallengeList
- plural: challenges
- singular: challenge
- categories:
- - cert-manager
- - cert-manager-acme
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .status.state
- name: State
- type: string
- - jsonPath: .spec.dnsName
- name: Domain
- type: string
- - jsonPath: .status.reason
- name: Reason
- priority: 1
- type: string
- - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: Challenge is a type to represent a Challenge request with an ACME server
- type: object
- required:
- - metadata
- - spec
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- type: object
- required:
- - authorizationURL
- - dnsName
- - issuerRef
- - key
- - solver
- - token
- - type
- - url
- properties:
- authorizationURL:
- description: |-
- The URL to the ACME Authorization resource that this
- challenge is a part of.
- type: string
- dnsName:
- description: |-
- dnsName is the identifier that this challenge is for, e.g., example.com.
- If the requested DNSName is a 'wildcard', this field MUST be set to the
- non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
- type: string
- issuerRef:
- description: |-
- References a properly configured ACME-type Issuer which should
- be used to create this Challenge.
- If the Issuer does not exist, processing will be retried.
- If the Issuer is not an 'ACME' Issuer, an error will be returned and the
- Challenge will be marked as failed.
- type: object
- required:
- - name
- properties:
- group:
- description: Group of the resource being referred to.
- type: string
- kind:
- description: Kind of the resource being referred to.
- type: string
- name:
- description: Name of the resource being referred to.
- type: string
- key:
- description: |-
- The ACME challenge key for this challenge
- For HTTP01 challenges, this is the value that must be responded with to
- complete the HTTP01 challenge in the format:
- `<private key JWK thumbprint>.<key from acme server for challenge>`.
- For DNS01 challenges, this is the base64 encoded SHA256 sum of the
- `<private key JWK thumbprint>.<key from acme server for challenge>`
- text that must be set as the TXT record content.
- type: string
- solver:
- description: |-
- Contains the domain solving configuration that should be used to
- solve this challenge resource.
- type: object
- properties:
- dns01:
- description: |-
- Configures cert-manager to attempt to complete authorizations by
- performing the DNS01 challenge flow.
- type: object
- properties:
- acmeDNS:
- description: |-
- Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
- DNS01 challenge records.
- type: object
- required:
- - accountSecretRef
- - host
- properties:
- accountSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- host:
- type: string
- akamai:
- description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
- type: object
- required:
- - accessTokenSecretRef
- - clientSecretSecretRef
- - clientTokenSecretRef
- - serviceConsumerDomain
- properties:
- accessTokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientSecretSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientTokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- serviceConsumerDomain:
- type: string
- azureDNS:
- description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
- type: object
- required:
- - resourceGroupName
- - subscriptionID
- properties:
- clientID:
- description: |-
- Auth: Azure Service Principal:
- The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
- If set, ClientSecret and TenantID must also be set.
- type: string
- clientSecretSecretRef:
- description: |-
- Auth: Azure Service Principal:
- A reference to a Secret containing the password associated with the Service Principal.
- If set, ClientID and TenantID must also be set.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- environment:
- description: name of the Azure environment (default AzurePublicCloud)
- type: string
- enum:
- - AzurePublicCloud
- - AzureChinaCloud
- - AzureGermanCloud
- - AzureUSGovernmentCloud
- hostedZoneName:
- description: name of the DNS zone that should be used
- type: string
- managedIdentity:
- description: |-
- Auth: Azure Workload Identity or Azure Managed Service Identity:
- Settings to enable Azure Workload Identity or Azure Managed Service Identity
- If set, ClientID, ClientSecret and TenantID must not be set.
- type: object
- properties:
- clientID:
- description: client ID of the managed identity, cannot be used at the same time as resourceID
- type: string
- resourceID:
- description: |-
- resource ID of the managed identity, cannot be used at the same time as clientID
- Cannot be used for Azure Managed Service Identity
- type: string
- tenantID:
- description: tenant ID of the managed identity, cannot be used at the same time as resourceID
- type: string
- resourceGroupName:
- description: resource group the DNS zone is located in
- type: string
- subscriptionID:
- description: ID of the Azure subscription
- type: string
- tenantID:
- description: |-
- Auth: Azure Service Principal:
- The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
- If set, ClientID and ClientSecret must also be set.
- type: string
- cloudDNS:
- description: Use the Google Cloud DNS API to manage DNS01 challenge records.
- type: object
- required:
- - project
- properties:
- hostedZoneName:
- description: |-
- HostedZoneName is an optional field that tells cert-manager in which
- Cloud DNS zone the challenge record has to be created.
- If left empty cert-manager will automatically choose a zone.
- type: string
- project:
- type: string
- serviceAccountSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- cloudflare:
- description: Use the Cloudflare API to manage DNS01 challenge records.
- type: object
- properties:
- apiKeySecretRef:
- description: |-
- API key to use to authenticate with Cloudflare.
- Note: using an API token to authenticate is now the recommended method
- as it allows greater control of permissions.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- apiTokenSecretRef:
- description: API token used to authenticate with Cloudflare.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- email:
- description: Email of the account, only required when using API key based authentication.
- type: string
- cnameStrategy:
- description: |-
- CNAMEStrategy configures how the DNS01 provider should handle CNAME
- records when found in DNS zones.
- type: string
- enum:
- - None
- - Follow
- digitalocean:
- description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
- type: object
- required:
- - tokenSecretRef
- properties:
- tokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- rfc2136:
- description: |-
- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
- to manage DNS01 challenge records.
- type: object
- required:
- - nameserver
- properties:
- nameserver:
- description: |-
- The IP address or hostname of an authoritative DNS server supporting
- RFC2136 in the form host:port. If the host is an IPv6 address it must be
- enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
- This field is required.
- type: string
- tsigAlgorithm:
- description: |-
- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
- when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
- Supported values are (case-insensitive): ``HMACMD5`` (default),
- ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
- type: string
- tsigKeyName:
- description: |-
- The TSIG Key name configured in the DNS.
- If ``tsigSecretSecretRef`` is defined, this field is required.
- type: string
- tsigSecretSecretRef:
- description: |-
- The name of the secret containing the TSIG value.
- If ``tsigKeyName`` is defined, this field is required.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- route53:
- description: Use the AWS Route53 API to manage DNS01 challenge records.
- type: object
- properties:
- accessKeyID:
- description: |-
- The AccessKeyID is used for authentication.
- Cannot be set when SecretAccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: string
- accessKeyIDSecretRef:
- description: |-
- The SecretAccessKey is used for authentication. If set, pull the AWS
- access key ID from a key within a Kubernetes Secret.
- Cannot be set when AccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- auth:
- description: Auth configures how cert-manager authenticates.
- type: object
- required:
- - kubernetes
- properties:
- kubernetes:
- description: |-
- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
- by passing a bound ServiceAccount token.
- type: object
- required:
- - serviceAccountRef
- properties:
- serviceAccountRef:
- description: |-
- A reference to a service account that will be used to request a bound
- token (also known as "projected token"). To use this field, you must
- configure an RBAC rule to let cert-manager request a token.
- type: object
- required:
- - name
- properties:
- audiences:
- description: |-
- TokenAudiences is an optional list of audiences to include in the
- token passed to AWS. The default token consisting of the issuer's namespace
- and name is always included.
- If unset the audience defaults to `sts.amazonaws.com`.
- type: array
- items:
- type: string
- name:
- description: Name of the ServiceAccount used to request a token.
- type: string
- hostedZoneID:
- description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
- type: string
- region:
- description: |-
- Override the AWS region.
-
- Route53 is a global service and does not have regional endpoints but the
- region specified here (or via environment variables) is used as a hint to
- help compute the correct AWS credential scope and partition when it
- connects to Route53. See:
- - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
- - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
- If you omit this region field, cert-manager will use the region from
- AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
- in the cert-manager controller Pod.
-
- The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
- Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
- [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
- In this case this `region` field value is ignored.
-
- The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
- Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
- [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
- In this case this `region` field value is ignored.
- type: string
- role:
- description: |-
- Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
- or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
- type: string
- secretAccessKeySecretRef:
- description: |-
- The SecretAccessKey is used for authentication.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- webhook:
- description: |-
- Configure an external webhook based DNS01 challenge solver to manage
- DNS01 challenge records.
- type: object
- required:
- - groupName
- - solverName
- properties:
- config:
- description: |-
- Additional configuration that should be passed to the webhook apiserver
- when challenges are processed.
- This can contain arbitrary JSON data.
- Secret values should not be specified in this stanza.
- If secret values are needed (e.g., credentials for a DNS service), you
- should use a SecretKeySelector to reference a Secret resource.
- For details on the schema of this field, consult the webhook provider
- implementation's documentation.
- x-kubernetes-preserve-unknown-fields: true
- groupName:
- description: |-
- The API group name that should be used when POSTing ChallengePayload
- resources to the webhook apiserver.
- This should be the same as the GroupName specified in the webhook
- provider implementation.
- type: string
- solverName:
- description: |-
- The name of the solver to use, as defined in the webhook provider
- implementation.
- This will typically be the name of the provider, e.g., 'cloudflare'.
- type: string
- http01:
- description: |-
- Configures cert-manager to attempt to complete authorizations by
- performing the HTTP01 challenge flow.
- It is not possible to obtain certificates for wildcard domain names
- (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
- type: object
- properties:
- gatewayHTTPRoute:
- description: |-
- The Gateway API is a sig-network community API that models service networking
- in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
- create HTTPRoutes with the specified labels in the same namespace as the challenge.
- This solver is experimental, and fields / behaviour may change in the future.
- type: object
- properties:
- labels:
- description: |-
- Custom labels that will be applied to HTTPRoutes created by cert-manager
- while solving HTTP-01 challenges.
- type: object
- additionalProperties:
- type: string
- parentRefs:
- description: |-
- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
- cert-manager needs to know which parentRefs should be used when creating
- the HTTPRoute. Usually, the parentRef references a Gateway. See:
- https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
- type: array
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- type: object
- required:
- - name
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- type: string
- default: gateway.networking.k8s.io
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- kind:
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- type: string
- default: Gateway
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- type: string
- maxLength: 253
- minLength: 1
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
- <gateway:experimental:description>
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
- </gateway:experimental:description>
-
- Support: Core
- type: string
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
- <gateway:experimental:description>
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
- </gateway:experimental:description>
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- type: integer
- format: int32
- maximum: 65535
- minimum: 1
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- type: string
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- podTemplate:
- description: |-
- Optional pod template used to configure the ACME challenge solver pods
- used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the pod used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- spec:
- description: |-
- PodSpec defines overrides for the HTTP01 challenge solver pod.
- Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
- All other fields will be ignored.
- type: object
- properties:
- affinity:
- description: If specified, the pod's scheduling constraints
- type: object
- properties:
- nodeAffinity:
- description: Describes node affinity scheduling rules for the pod.
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node matches the corresponding matchExpressions; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: |-
- An empty preferred scheduling term matches all objects with implicit weight 0
- (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
- type: object
- required:
- - preference
- - weight
- properties:
- preference:
- description: A node selector term, associated with the corresponding weight.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- weight:
- description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to an update), the system
- may or may not try to eventually evict the pod from its node.
- type: object
- required:
- - nodeSelectorTerms
- properties:
- nodeSelectorTerms:
- description: Required. A list of node selector terms. The terms are ORed.
- type: array
- items:
- description: |-
- A null or empty node selector term matches no objects. The requirements of
- them are ANDed.
- The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- podAffinity:
- description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- podAntiAffinity:
- description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the anti-affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling anti-affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the anti-affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the anti-affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- imagePullSecrets:
- description: If specified, the pod's imagePullSecrets
- type: array
- items:
- description: |-
- LocalObjectReference contains enough information to let you locate the
- referenced object inside the same namespace.
- type: object
- properties:
- name:
- description: |-
- Name of the referent.
- This field is effectively required, but due to backwards compatibility is
- allowed to be empty. Instances of this type with an empty value here are
- almost certainly wrong.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- default: ""
- x-kubernetes-map-type: atomic
- nodeSelector:
- description: |-
- NodeSelector is a selector which must be true for the pod to fit on a node.
- Selector which must match a node's labels for the pod to be scheduled on that node.
- More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
- type: object
- additionalProperties:
- type: string
- priorityClassName:
- description: If specified, the pod's priorityClassName.
- type: string
- securityContext:
- description: If specified, the pod's security context
- type: object
- properties:
- fsGroup:
- description: |-
- A special supplemental group that applies to all containers in a pod.
- Some volume types allow the Kubelet to change the ownership of that volume
- to be owned by the pod:
-
- 1. The owning GID will be the FSGroup
- 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
- 3. The permission bits are OR'd with rw-rw----
-
- If unset, the Kubelet will not modify the ownership and permissions of any volume.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- fsGroupChangePolicy:
- description: |-
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
- before being exposed inside Pod. This field will only apply to
- volume types which support fsGroup based ownership(and permissions).
- It will have no effect on ephemeral volume types such as: secret, configmaps
- and emptydir.
- Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
- Note that this field cannot be set when spec.os.name is windows.
- type: string
- runAsGroup:
- description: |-
- The GID to run the entrypoint of the container process.
- Uses runtime default if unset.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- runAsNonRoot:
- description: |-
- Indicates that the container must run as a non-root user.
- If true, the Kubelet will validate the image at runtime to ensure that it
- does not run as UID 0 (root) and fail to start the container if it does.
- If unset or false, no such validation will be performed.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence.
- type: boolean
- runAsUser:
- description: |-
- The UID to run the entrypoint of the container process.
- Defaults to user specified in image metadata if unspecified.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- seLinuxOptions:
- description: |-
- The SELinux context to be applied to all containers.
- If unspecified, the container runtime will allocate a random SELinux context for each
- container. May also be set in SecurityContext. If set in
- both SecurityContext and PodSecurityContext, the value specified in SecurityContext
- takes precedence for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- properties:
- level:
- description: Level is SELinux level label that applies to the container.
- type: string
- role:
- description: Role is a SELinux role label that applies to the container.
- type: string
- type:
- description: Type is a SELinux type label that applies to the container.
- type: string
- user:
- description: User is a SELinux user label that applies to the container.
- type: string
- seccompProfile:
- description: |-
- The seccomp options to use by the containers in this pod.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- required:
- - type
- properties:
- localhostProfile:
- description: |-
- localhostProfile indicates a profile defined in a file on the node should be used.
- The profile must be preconfigured on the node to work.
- Must be a descending path, relative to the kubelet's configured seccomp profile location.
- Must be set if type is "Localhost". Must NOT be set for any other type.
- type: string
- type:
- description: |-
- type indicates which kind of seccomp profile will be applied.
- Valid options are:
-
- Localhost - a profile defined in a file on the node should be used.
- RuntimeDefault - the container runtime default profile should be used.
- Unconfined - no profile should be applied.
- type: string
- supplementalGroups:
- description: |-
- A list of groups applied to the first process run in each container, in addition
- to the container's primary GID, the fsGroup (if specified), and group memberships
- defined in the container image for the uid of the container process. If unspecified,
- no additional groups are added to any container. Note that group memberships
- defined in the container image for the uid of the container process are still effective,
- even if they are not included in this list.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- type: integer
- format: int64
- sysctls:
- description: |-
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
- sysctls (by the container runtime) might fail to launch.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- description: Sysctl defines a kernel parameter to be set
- type: object
- required:
- - name
- - value
- properties:
- name:
- description: Name of a property to set
- type: string
- value:
- description: Value of a property to set
- type: string
- serviceAccountName:
- description: If specified, the pod's service account
- type: string
- tolerations:
- description: If specified, the pod's tolerations.
- type: array
- items:
- description: |-
- The pod this Toleration is attached to tolerates any taint that matches
- the triple <key,value,effect> using the matching operator <operator>.
- type: object
- properties:
- effect:
- description: |-
- Effect indicates the taint effect to match. Empty means match all taint effects.
- When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
- type: string
- key:
- description: |-
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
- If the key is empty, operator must be Exists; this combination means to match all values and all keys.
- type: string
- operator:
- description: |-
- Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
- Exists is equivalent to wildcard for value, so that a pod can
- tolerate all taints of a particular category.
- type: string
- tolerationSeconds:
- description: |-
- TolerationSeconds represents the period of time the toleration (which must be
- of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
- it is not set, which means tolerate the taint forever (do not evict). Zero and
- negative values will be treated as 0 (evict immediately) by the system.
- type: integer
- format: int64
- value:
- description: |-
- Value is the taint value the toleration matches to.
- If the operator is Exists, the value should be empty, otherwise just a regular string.
- type: string
- serviceType:
- description: |-
- Optional service type for Kubernetes solver service. Supported values
- are NodePort or ClusterIP. If unset, defaults to NodePort.
- type: string
- ingress:
- description: |-
- The ingress based HTTP01 challenge solver will solve challenges by
- creating or modifying Ingress resources in order to route requests for
- '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
- provisioned by cert-manager for each Challenge to be completed.
- type: object
- properties:
- class:
- description: |-
- This field configures the annotation `kubernetes.io/ingress.class` when
- creating Ingress resources to solve ACME challenges that use this
- challenge solver. Only one of `class`, `name` or `ingressClassName` may
- be specified.
- type: string
- ingressClassName:
- description: |-
- This field configures the field `ingressClassName` on the created Ingress
- resources used to solve ACME challenges that use this challenge solver.
- This is the recommended way of configuring the ingress class. Only one of
- `class`, `name` or `ingressClassName` may be specified.
- type: string
- ingressTemplate:
- description: |-
- Optional ingress template used to configure the ACME challenge solver
- ingress used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver ingress.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver ingress.
- type: object
- additionalProperties:
- type: string
- name:
- description: |-
- The name of the ingress resource that should have ACME challenge solving
- routes inserted into it in order to solve HTTP01 challenges.
- This is typically used in conjunction with ingress controllers like
- ingress-gce, which maintains a 1:1 mapping between external IPs and
- ingress resources. Only one of `class`, `name` or `ingressClassName` may
- be specified.
- type: string
- podTemplate:
- description: |-
- Optional pod template used to configure the ACME challenge solver pods
- used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the pod used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- spec:
- description: |-
- PodSpec defines overrides for the HTTP01 challenge solver pod.
- Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
- All other fields will be ignored.
- type: object
- properties:
- affinity:
- description: If specified, the pod's scheduling constraints
- type: object
- properties:
- nodeAffinity:
- description: Describes node affinity scheduling rules for the pod.
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node matches the corresponding matchExpressions; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: |-
- An empty preferred scheduling term matches all objects with implicit weight 0
- (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
- type: object
- required:
- - preference
- - weight
- properties:
- preference:
- description: A node selector term, associated with the corresponding weight.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- weight:
- description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to an update), the system
- may or may not try to eventually evict the pod from its node.
- type: object
- required:
- - nodeSelectorTerms
- properties:
- nodeSelectorTerms:
- description: Required. A list of node selector terms. The terms are ORed.
- type: array
- items:
- description: |-
- A null or empty node selector term matches no objects. The requirements of
- them are ANDed.
- The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- podAffinity:
- description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- podAntiAffinity:
- description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the anti-affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling anti-affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the anti-affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the anti-affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- imagePullSecrets:
- description: If specified, the pod's imagePullSecrets
- type: array
- items:
- description: |-
- LocalObjectReference contains enough information to let you locate the
- referenced object inside the same namespace.
- type: object
- properties:
- name:
- description: |-
- Name of the referent.
- This field is effectively required, but due to backwards compatibility is
- allowed to be empty. Instances of this type with an empty value here are
- almost certainly wrong.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- default: ""
- x-kubernetes-map-type: atomic
- nodeSelector:
- description: |-
- NodeSelector is a selector which must be true for the pod to fit on a node.
- Selector which must match a node's labels for the pod to be scheduled on that node.
- More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
- type: object
- additionalProperties:
- type: string
- priorityClassName:
- description: If specified, the pod's priorityClassName.
- type: string
- securityContext:
- description: If specified, the pod's security context
- type: object
- properties:
- fsGroup:
- description: |-
- A special supplemental group that applies to all containers in a pod.
- Some volume types allow the Kubelet to change the ownership of that volume
- to be owned by the pod:
-
- 1. The owning GID will be the FSGroup
- 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
- 3. The permission bits are OR'd with rw-rw----
-
- If unset, the Kubelet will not modify the ownership and permissions of any volume.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- fsGroupChangePolicy:
- description: |-
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
- before being exposed inside Pod. This field will only apply to
- volume types which support fsGroup based ownership(and permissions).
- It will have no effect on ephemeral volume types such as: secret, configmaps
- and emptydir.
- Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
- Note that this field cannot be set when spec.os.name is windows.
- type: string
- runAsGroup:
- description: |-
- The GID to run the entrypoint of the container process.
- Uses runtime default if unset.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- runAsNonRoot:
- description: |-
- Indicates that the container must run as a non-root user.
- If true, the Kubelet will validate the image at runtime to ensure that it
- does not run as UID 0 (root) and fail to start the container if it does.
- If unset or false, no such validation will be performed.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence.
- type: boolean
- runAsUser:
- description: |-
- The UID to run the entrypoint of the container process.
- Defaults to user specified in image metadata if unspecified.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- seLinuxOptions:
- description: |-
- The SELinux context to be applied to all containers.
- If unspecified, the container runtime will allocate a random SELinux context for each
- container. May also be set in SecurityContext. If set in
- both SecurityContext and PodSecurityContext, the value specified in SecurityContext
- takes precedence for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- properties:
- level:
- description: Level is SELinux level label that applies to the container.
- type: string
- role:
- description: Role is a SELinux role label that applies to the container.
- type: string
- type:
- description: Type is a SELinux type label that applies to the container.
- type: string
- user:
- description: User is a SELinux user label that applies to the container.
- type: string
- seccompProfile:
- description: |-
- The seccomp options to use by the containers in this pod.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- required:
- - type
- properties:
- localhostProfile:
- description: |-
- localhostProfile indicates a profile defined in a file on the node should be used.
- The profile must be preconfigured on the node to work.
- Must be a descending path, relative to the kubelet's configured seccomp profile location.
- Must be set if type is "Localhost". Must NOT be set for any other type.
- type: string
- type:
- description: |-
- type indicates which kind of seccomp profile will be applied.
- Valid options are:
-
- Localhost - a profile defined in a file on the node should be used.
- RuntimeDefault - the container runtime default profile should be used.
- Unconfined - no profile should be applied.
- type: string
- supplementalGroups:
- description: |-
- A list of groups applied to the first process run in each container, in addition
- to the container's primary GID, the fsGroup (if specified), and group memberships
- defined in the container image for the uid of the container process. If unspecified,
- no additional groups are added to any container. Note that group memberships
- defined in the container image for the uid of the container process are still effective,
- even if they are not included in this list.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- type: integer
- format: int64
- sysctls:
- description: |-
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
- sysctls (by the container runtime) might fail to launch.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- description: Sysctl defines a kernel parameter to be set
- type: object
- required:
- - name
- - value
- properties:
- name:
- description: Name of a property to set
- type: string
- value:
- description: Value of a property to set
- type: string
- serviceAccountName:
- description: If specified, the pod's service account
- type: string
- tolerations:
- description: If specified, the pod's tolerations.
- type: array
- items:
- description: |-
- The pod this Toleration is attached to tolerates any taint that matches
- the triple <key,value,effect> using the matching operator <operator>.
- type: object
- properties:
- effect:
- description: |-
- Effect indicates the taint effect to match. Empty means match all taint effects.
- When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
- type: string
- key:
- description: |-
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
- If the key is empty, operator must be Exists; this combination means to match all values and all keys.
- type: string
- operator:
- description: |-
- Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
- Exists is equivalent to wildcard for value, so that a pod can
- tolerate all taints of a particular category.
- type: string
- tolerationSeconds:
- description: |-
- TolerationSeconds represents the period of time the toleration (which must be
- of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
- it is not set, which means tolerate the taint forever (do not evict). Zero and
- negative values will be treated as 0 (evict immediately) by the system.
- type: integer
- format: int64
- value:
- description: |-
- Value is the taint value the toleration matches to.
- If the operator is Exists, the value should be empty, otherwise just a regular string.
- type: string
- serviceType:
- description: |-
- Optional service type for Kubernetes solver service. Supported values
- are NodePort or ClusterIP. If unset, defaults to NodePort.
- type: string
- selector:
- description: |-
- Selector selects a set of DNSNames on the Certificate resource that
- should be solved using this challenge solver.
- If not specified, the solver will be treated as the 'default' solver
- with the lowest priority, i.e. if any other solver has a more specific
- match, it will be used instead.
- type: object
- properties:
- dnsNames:
- description: |-
- List of DNSNames that this solver will be used to solve.
- If specified and a match is found, a dnsNames selector will take
- precedence over a dnsZones selector.
- If multiple solvers match with the same dnsNames value, the solver
- with the most matching labels in matchLabels will be selected.
- If neither has more matches, the solver defined earlier in the list
- will be selected.
- type: array
- items:
- type: string
- dnsZones:
- description: |-
- List of DNSZones that this solver will be used to solve.
- The most specific DNS zone match specified here will take precedence
- over other DNS zone matches, so a solver specifying sys.example.com
- will be selected over one specifying example.com for the domain
- www.sys.example.com.
- If multiple solvers match with the same dnsZones value, the solver
- with the most matching labels in matchLabels will be selected.
- If neither has more matches, the solver defined earlier in the list
- will be selected.
- type: array
- items:
- type: string
- matchLabels:
- description: |-
- A label selector that is used to refine the set of certificate's that
- this challenge solver will apply to.
- type: object
- additionalProperties:
- type: string
- token:
- description: |-
- The ACME challenge token for this challenge.
- This is the raw value returned from the ACME server.
- type: string
- type:
- description: |-
- The type of ACME challenge this resource represents.
- One of "HTTP-01" or "DNS-01".
- type: string
- enum:
- - HTTP-01
- - DNS-01
- url:
- description: |-
- The URL of the ACME Challenge resource for this challenge.
- This can be used to lookup details about the status of this challenge.
- type: string
- wildcard:
- description: |-
- wildcard will be true if this challenge is for a wildcard identifier,
- for example '*.example.com'.
- type: boolean
- status:
- type: object
- properties:
- presented:
- description: |-
- presented will be set to true if the challenge values for this challenge
- are currently 'presented'.
- This *does not* imply the self check is passing. Only that the values
- have been 'submitted' for the appropriate challenge mechanism (i.e. the
- DNS01 TXT record has been presented, or the HTTP01 configuration has been
- configured).
- type: boolean
- processing:
- description: |-
- Used to denote whether this challenge should be processed or not.
- This field will only be set to true by the 'scheduling' component.
- It will only be set to false by the 'challenges' controller, after the
- challenge has reached a final state or timed out.
- If this field is set to false, the challenge controller will not take
- any more action.
- type: boolean
- reason:
- description: |-
- Contains human readable information on why the Challenge is in the
- current state.
- type: string
- state:
- description: |-
- Contains the current 'state' of the challenge.
- If not set, the state of the challenge is unknown.
- type: string
- enum:
- - valid
- - ready
- - pending
- - processing
- - invalid
- - expired
- - errored
- served: true
- storage: true
- subresources:
- status: {}
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- name: clusterissuers.cert-manager.io
- # START annotations {{- if .Values.crds.keep }}
- annotations:
- helm.sh/resource-policy: keep
- # END annotations {{- end }}
- labels:
- app: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/instance: '{{ .Release.Name }}'
- # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
- group: cert-manager.io
- names:
- kind: ClusterIssuer
- listKind: ClusterIssuerList
- plural: clusterissuers
- shortNames:
- - ciss
- singular: clusterissuer
- categories:
- - cert-manager
- scope: Cluster
- versions:
- - name: v1
- subresources:
- status: {}
- additionalPrinterColumns:
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- priority: 1
- type: string
- - jsonPath: .metadata.creationTimestamp
- description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
- name: Age
- type: date
- schema:
- openAPIV3Schema:
- description: |-
- A ClusterIssuer represents a certificate issuing authority which can be
- referenced as part of `issuerRef` fields.
- It is similar to an Issuer, however it is cluster-scoped and therefore can
- be referenced by resources that exist in *any* namespace, not just the same
- namespace as the referent.
- type: object
- required:
- - spec
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Desired state of the ClusterIssuer resource.
- type: object
- properties:
- acme:
- description: |-
- ACME configures this issuer to communicate with a RFC8555 (ACME) server
- to obtain signed x509 certificates.
- type: object
- required:
- - privateKeySecretRef
- - server
- properties:
- caBundle:
- description: |-
- Base64-encoded bundle of PEM CAs which can be used to validate the certificate
- chain presented by the ACME server.
- Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
- kinds of security vulnerabilities.
- If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
- the container is used to validate the TLS connection.
- type: string
- format: byte
- disableAccountKeyGeneration:
- description: |-
- Enables or disables generating a new ACME account key.
- If true, the Issuer resource will *not* request a new account but will expect
- the account key to be supplied via an existing secret.
- If false, the cert-manager system will generate a new ACME account key
- for the Issuer.
- Defaults to false.
- type: boolean
- email:
- description: |-
- Email is the email address to be associated with the ACME account.
- This field is optional, but it is strongly recommended to be set.
- It will be used to contact you in case of issues with your account or
- certificates, including expiry notification emails.
- This field may be updated after the account is initially registered.
- type: string
- enableDurationFeature:
- description: |-
- Enables requesting a Not After date on certificates that matches the
- duration of the certificate. This is not supported by all ACME servers
- like Let's Encrypt. If set to true when the ACME server does not support
- it, it will create an error on the Order.
- Defaults to false.
- type: boolean
- externalAccountBinding:
- description: |-
- ExternalAccountBinding is a reference to a CA external account of the ACME
- server.
- If set, upon registration cert-manager will attempt to associate the given
- external account credentials with the registered ACME account.
- type: object
- required:
- - keyID
- - keySecretRef
- properties:
- keyAlgorithm:
- description: |-
- Deprecated: keyAlgorithm field exists for historical compatibility
- reasons and should not be used. The algorithm is now hardcoded to HS256
- in golang/x/crypto/acme.
- type: string
- enum:
- - HS256
- - HS384
- - HS512
- keyID:
- description: keyID is the ID of the CA key that the External Account is bound to.
- type: string
- keySecretRef:
- description: |-
- keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
- Secret which holds the symmetric MAC key of the External Account Binding.
- The `key` is the index string that is paired with the key data in the
- Secret and should not be confused with the key data itself, or indeed with
- the External Account Binding keyID above.
- The secret key stored in the Secret **must** be un-padded, base64 URL
- encoded data.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- preferredChain:
- description: |-
- PreferredChain is the chain to use if the ACME server outputs multiple.
- PreferredChain is no guarantee that this one gets delivered by the ACME
- endpoint.
- For example, for Let's Encrypt's DST cross-sign you would use:
- "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
- This value picks the first certificate bundle in the combined set of
- ACME default and alternative chains that has a root-most certificate with
- this value as its issuer's commonname.
- type: string
- maxLength: 64
- privateKeySecretRef:
- description: |-
- PrivateKey is the name of a Kubernetes Secret resource that will be used to
- store the automatically generated ACME account private key.
- Optionally, a `key` may be specified to select a specific entry within
- the named Secret resource.
- If `key` is not specified, a default of `tls.key` will be used.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- profile:
- description: |-
- Profile allows requesting a certificate profile from the ACME server.
- Supported profiles are listed by the server's ACME directory URL.
- type: string
- server:
- description: |-
- Server is the URL used to access the ACME server's 'directory' endpoint.
- For example, for Let's Encrypt's staging endpoint, you would use:
- "https://acme-staging-v02.api.letsencrypt.org/directory".
- Only ACME v2 endpoints (i.e. RFC 8555) are supported.
- type: string
- skipTLSVerify:
- description: |-
- INSECURE: Enables or disables validation of the ACME server TLS certificate.
- If true, requests to the ACME server will not have the TLS certificate chain
- validated.
- Mutually exclusive with CABundle; prefer using CABundle to prevent various
- kinds of security vulnerabilities.
- Only enable this option in development environments.
- If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
- the container is used to validate the TLS connection.
- Defaults to false.
- type: boolean
- solvers:
- description: |-
- Solvers is a list of challenge solvers that will be used to solve
- ACME challenges for the matching domains.
- Solver configurations must be provided in order to obtain certificates
- from an ACME server.
- For more information, see: https://cert-manager.io/docs/configuration/acme/
- type: array
- items:
- description: |-
- An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
- A selector may be provided to use different solving strategies for different DNS names.
- Only one of HTTP01 or DNS01 must be provided.
- type: object
- properties:
- dns01:
- description: |-
- Configures cert-manager to attempt to complete authorizations by
- performing the DNS01 challenge flow.
- type: object
- properties:
- acmeDNS:
- description: |-
- Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
- DNS01 challenge records.
- type: object
- required:
- - accountSecretRef
- - host
- properties:
- accountSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- host:
- type: string
- akamai:
- description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
- type: object
- required:
- - accessTokenSecretRef
- - clientSecretSecretRef
- - clientTokenSecretRef
- - serviceConsumerDomain
- properties:
- accessTokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientSecretSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientTokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- serviceConsumerDomain:
- type: string
- azureDNS:
- description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
- type: object
- required:
- - resourceGroupName
- - subscriptionID
- properties:
- clientID:
- description: |-
- Auth: Azure Service Principal:
- The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
- If set, ClientSecret and TenantID must also be set.
- type: string
- clientSecretSecretRef:
- description: |-
- Auth: Azure Service Principal:
- A reference to a Secret containing the password associated with the Service Principal.
- If set, ClientID and TenantID must also be set.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- environment:
- description: name of the Azure environment (default AzurePublicCloud)
- type: string
- enum:
- - AzurePublicCloud
- - AzureChinaCloud
- - AzureGermanCloud
- - AzureUSGovernmentCloud
- hostedZoneName:
- description: name of the DNS zone that should be used
- type: string
- managedIdentity:
- description: |-
- Auth: Azure Workload Identity or Azure Managed Service Identity:
- Settings to enable Azure Workload Identity or Azure Managed Service Identity
- If set, ClientID, ClientSecret and TenantID must not be set.
- type: object
- properties:
- clientID:
- description: client ID of the managed identity, cannot be used at the same time as resourceID
- type: string
- resourceID:
- description: |-
- resource ID of the managed identity, cannot be used at the same time as clientID
- Cannot be used for Azure Managed Service Identity
- type: string
- tenantID:
- description: tenant ID of the managed identity, cannot be used at the same time as resourceID
- type: string
- resourceGroupName:
- description: resource group the DNS zone is located in
- type: string
- subscriptionID:
- description: ID of the Azure subscription
- type: string
- tenantID:
- description: |-
- Auth: Azure Service Principal:
- The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
- If set, ClientID and ClientSecret must also be set.
- type: string
- cloudDNS:
- description: Use the Google Cloud DNS API to manage DNS01 challenge records.
- type: object
- required:
- - project
- properties:
- hostedZoneName:
- description: |-
- HostedZoneName is an optional field that tells cert-manager in which
- Cloud DNS zone the challenge record has to be created.
- If left empty cert-manager will automatically choose a zone.
- type: string
- project:
- type: string
- serviceAccountSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- cloudflare:
- description: Use the Cloudflare API to manage DNS01 challenge records.
- type: object
- properties:
- apiKeySecretRef:
- description: |-
- API key to use to authenticate with Cloudflare.
- Note: using an API token to authenticate is now the recommended method
- as it allows greater control of permissions.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- apiTokenSecretRef:
- description: API token used to authenticate with Cloudflare.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- email:
- description: Email of the account, only required when using API key based authentication.
- type: string
- cnameStrategy:
- description: |-
- CNAMEStrategy configures how the DNS01 provider should handle CNAME
- records when found in DNS zones.
- type: string
- enum:
- - None
- - Follow
- digitalocean:
- description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
- type: object
- required:
- - tokenSecretRef
- properties:
- tokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- rfc2136:
- description: |-
- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
- to manage DNS01 challenge records.
- type: object
- required:
- - nameserver
- properties:
- nameserver:
- description: |-
- The IP address or hostname of an authoritative DNS server supporting
- RFC2136 in the form host:port. If the host is an IPv6 address it must be
- enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
- This field is required.
- type: string
- tsigAlgorithm:
- description: |-
- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
- when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
- Supported values are (case-insensitive): ``HMACMD5`` (default),
- ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
- type: string
- tsigKeyName:
- description: |-
- The TSIG Key name configured in the DNS.
- If ``tsigSecretSecretRef`` is defined, this field is required.
- type: string
- tsigSecretSecretRef:
- description: |-
- The name of the secret containing the TSIG value.
- If ``tsigKeyName`` is defined, this field is required.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- route53:
- description: Use the AWS Route53 API to manage DNS01 challenge records.
- type: object
- properties:
- accessKeyID:
- description: |-
- The AccessKeyID is used for authentication.
- Cannot be set when SecretAccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: string
- accessKeyIDSecretRef:
- description: |-
- The SecretAccessKey is used for authentication. If set, pull the AWS
- access key ID from a key within a Kubernetes Secret.
- Cannot be set when AccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- auth:
- description: Auth configures how cert-manager authenticates.
- type: object
- required:
- - kubernetes
- properties:
- kubernetes:
- description: |-
- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
- by passing a bound ServiceAccount token.
- type: object
- required:
- - serviceAccountRef
- properties:
- serviceAccountRef:
- description: |-
- A reference to a service account that will be used to request a bound
- token (also known as "projected token"). To use this field, you must
- configure an RBAC rule to let cert-manager request a token.
- type: object
- required:
- - name
- properties:
- audiences:
- description: |-
- TokenAudiences is an optional list of audiences to include in the
- token passed to AWS. The default token consisting of the issuer's namespace
- and name is always included.
- If unset the audience defaults to `sts.amazonaws.com`.
- type: array
- items:
- type: string
- name:
- description: Name of the ServiceAccount used to request a token.
- type: string
- hostedZoneID:
- description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
- type: string
- region:
- description: |-
- Override the AWS region.
-
- Route53 is a global service and does not have regional endpoints but the
- region specified here (or via environment variables) is used as a hint to
- help compute the correct AWS credential scope and partition when it
- connects to Route53. See:
- - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
- - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
- If you omit this region field, cert-manager will use the region from
- AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
- in the cert-manager controller Pod.
-
- The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
- Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
- [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
- In this case this `region` field value is ignored.
-
- The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
- Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
- [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
- In this case this `region` field value is ignored.
- type: string
- role:
- description: |-
- Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
- or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
- type: string
- secretAccessKeySecretRef:
- description: |-
- The SecretAccessKey is used for authentication.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- webhook:
- description: |-
- Configure an external webhook based DNS01 challenge solver to manage
- DNS01 challenge records.
- type: object
- required:
- - groupName
- - solverName
- properties:
- config:
- description: |-
- Additional configuration that should be passed to the webhook apiserver
- when challenges are processed.
- This can contain arbitrary JSON data.
- Secret values should not be specified in this stanza.
- If secret values are needed (e.g., credentials for a DNS service), you
- should use a SecretKeySelector to reference a Secret resource.
- For details on the schema of this field, consult the webhook provider
- implementation's documentation.
- x-kubernetes-preserve-unknown-fields: true
- groupName:
- description: |-
- The API group name that should be used when POSTing ChallengePayload
- resources to the webhook apiserver.
- This should be the same as the GroupName specified in the webhook
- provider implementation.
- type: string
- solverName:
- description: |-
- The name of the solver to use, as defined in the webhook provider
- implementation.
- This will typically be the name of the provider, e.g., 'cloudflare'.
- type: string
- http01:
- description: |-
- Configures cert-manager to attempt to complete authorizations by
- performing the HTTP01 challenge flow.
- It is not possible to obtain certificates for wildcard domain names
- (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
- type: object
- properties:
- gatewayHTTPRoute:
- description: |-
- The Gateway API is a sig-network community API that models service networking
- in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
- create HTTPRoutes with the specified labels in the same namespace as the challenge.
- This solver is experimental, and fields / behaviour may change in the future.
- type: object
- properties:
- labels:
- description: |-
- Custom labels that will be applied to HTTPRoutes created by cert-manager
- while solving HTTP-01 challenges.
- type: object
- additionalProperties:
- type: string
- parentRefs:
- description: |-
- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
- cert-manager needs to know which parentRefs should be used when creating
- the HTTPRoute. Usually, the parentRef references a Gateway. See:
- https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
- type: array
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- type: object
- required:
- - name
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- type: string
- default: gateway.networking.k8s.io
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- kind:
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- type: string
- default: Gateway
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- type: string
- maxLength: 253
- minLength: 1
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
- <gateway:experimental:description>
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
- </gateway:experimental:description>
-
- Support: Core
- type: string
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
- <gateway:experimental:description>
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
- </gateway:experimental:description>
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- type: integer
- format: int32
- maximum: 65535
- minimum: 1
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- type: string
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- podTemplate:
- description: |-
- Optional pod template used to configure the ACME challenge solver pods
- used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the pod used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- spec:
- description: |-
- PodSpec defines overrides for the HTTP01 challenge solver pod.
- Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
- All other fields will be ignored.
- type: object
- properties:
- affinity:
- description: If specified, the pod's scheduling constraints
- type: object
- properties:
- nodeAffinity:
- description: Describes node affinity scheduling rules for the pod.
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node matches the corresponding matchExpressions; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: |-
- An empty preferred scheduling term matches all objects with implicit weight 0
- (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
- type: object
- required:
- - preference
- - weight
- properties:
- preference:
- description: A node selector term, associated with the corresponding weight.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- weight:
- description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to an update), the system
- may or may not try to eventually evict the pod from its node.
- type: object
- required:
- - nodeSelectorTerms
- properties:
- nodeSelectorTerms:
- description: Required. A list of node selector terms. The terms are ORed.
- type: array
- items:
- description: |-
- A null or empty node selector term matches no objects. The requirements of
- them are ANDed.
- The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- podAffinity:
- description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- podAntiAffinity:
- description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the anti-affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling anti-affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the anti-affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the anti-affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- imagePullSecrets:
- description: If specified, the pod's imagePullSecrets
- type: array
- items:
- description: |-
- LocalObjectReference contains enough information to let you locate the
- referenced object inside the same namespace.
- type: object
- properties:
- name:
- description: |-
- Name of the referent.
- This field is effectively required, but due to backwards compatibility is
- allowed to be empty. Instances of this type with an empty value here are
- almost certainly wrong.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- default: ""
- x-kubernetes-map-type: atomic
- nodeSelector:
- description: |-
- NodeSelector is a selector which must be true for the pod to fit on a node.
- Selector which must match a node's labels for the pod to be scheduled on that node.
- More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
- type: object
- additionalProperties:
- type: string
- priorityClassName:
- description: If specified, the pod's priorityClassName.
- type: string
- securityContext:
- description: If specified, the pod's security context
- type: object
- properties:
- fsGroup:
- description: |-
- A special supplemental group that applies to all containers in a pod.
- Some volume types allow the Kubelet to change the ownership of that volume
- to be owned by the pod:
-
- 1. The owning GID will be the FSGroup
- 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
- 3. The permission bits are OR'd with rw-rw----
-
- If unset, the Kubelet will not modify the ownership and permissions of any volume.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- fsGroupChangePolicy:
- description: |-
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
- before being exposed inside Pod. This field will only apply to
- volume types which support fsGroup based ownership(and permissions).
- It will have no effect on ephemeral volume types such as: secret, configmaps
- and emptydir.
- Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
- Note that this field cannot be set when spec.os.name is windows.
- type: string
- runAsGroup:
- description: |-
- The GID to run the entrypoint of the container process.
- Uses runtime default if unset.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- runAsNonRoot:
- description: |-
- Indicates that the container must run as a non-root user.
- If true, the Kubelet will validate the image at runtime to ensure that it
- does not run as UID 0 (root) and fail to start the container if it does.
- If unset or false, no such validation will be performed.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence.
- type: boolean
- runAsUser:
- description: |-
- The UID to run the entrypoint of the container process.
- Defaults to user specified in image metadata if unspecified.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- seLinuxOptions:
- description: |-
- The SELinux context to be applied to all containers.
- If unspecified, the container runtime will allocate a random SELinux context for each
- container. May also be set in SecurityContext. If set in
- both SecurityContext and PodSecurityContext, the value specified in SecurityContext
- takes precedence for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- properties:
- level:
- description: Level is SELinux level label that applies to the container.
- type: string
- role:
- description: Role is a SELinux role label that applies to the container.
- type: string
- type:
- description: Type is a SELinux type label that applies to the container.
- type: string
- user:
- description: User is a SELinux user label that applies to the container.
- type: string
- seccompProfile:
- description: |-
- The seccomp options to use by the containers in this pod.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- required:
- - type
- properties:
- localhostProfile:
- description: |-
- localhostProfile indicates a profile defined in a file on the node should be used.
- The profile must be preconfigured on the node to work.
- Must be a descending path, relative to the kubelet's configured seccomp profile location.
- Must be set if type is "Localhost". Must NOT be set for any other type.
- type: string
- type:
- description: |-
- type indicates which kind of seccomp profile will be applied.
- Valid options are:
-
- Localhost - a profile defined in a file on the node should be used.
- RuntimeDefault - the container runtime default profile should be used.
- Unconfined - no profile should be applied.
- type: string
- supplementalGroups:
- description: |-
- A list of groups applied to the first process run in each container, in addition
- to the container's primary GID, the fsGroup (if specified), and group memberships
- defined in the container image for the uid of the container process. If unspecified,
- no additional groups are added to any container. Note that group memberships
- defined in the container image for the uid of the container process are still effective,
- even if they are not included in this list.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- type: integer
- format: int64
- sysctls:
- description: |-
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
- sysctls (by the container runtime) might fail to launch.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- description: Sysctl defines a kernel parameter to be set
- type: object
- required:
- - name
- - value
- properties:
- name:
- description: Name of a property to set
- type: string
- value:
- description: Value of a property to set
- type: string
- serviceAccountName:
- description: If specified, the pod's service account
- type: string
- tolerations:
- description: If specified, the pod's tolerations.
- type: array
- items:
- description: |-
- The pod this Toleration is attached to tolerates any taint that matches
- the triple <key,value,effect> using the matching operator <operator>.
- type: object
- properties:
- effect:
- description: |-
- Effect indicates the taint effect to match. Empty means match all taint effects.
- When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
- type: string
- key:
- description: |-
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
- If the key is empty, operator must be Exists; this combination means to match all values and all keys.
- type: string
- operator:
- description: |-
- Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
- Exists is equivalent to wildcard for value, so that a pod can
- tolerate all taints of a particular category.
- type: string
- tolerationSeconds:
- description: |-
- TolerationSeconds represents the period of time the toleration (which must be
- of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
- it is not set, which means tolerate the taint forever (do not evict). Zero and
- negative values will be treated as 0 (evict immediately) by the system.
- type: integer
- format: int64
- value:
- description: |-
- Value is the taint value the toleration matches to.
- If the operator is Exists, the value should be empty, otherwise just a regular string.
- type: string
- serviceType:
- description: |-
- Optional service type for Kubernetes solver service. Supported values
- are NodePort or ClusterIP. If unset, defaults to NodePort.
- type: string
- ingress:
- description: |-
- The ingress based HTTP01 challenge solver will solve challenges by
- creating or modifying Ingress resources in order to route requests for
- '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
- provisioned by cert-manager for each Challenge to be completed.
- type: object
- properties:
- class:
- description: |-
- This field configures the annotation `kubernetes.io/ingress.class` when
- creating Ingress resources to solve ACME challenges that use this
- challenge solver. Only one of `class`, `name` or `ingressClassName` may
- be specified.
- type: string
- ingressClassName:
- description: |-
- This field configures the field `ingressClassName` on the created Ingress
- resources used to solve ACME challenges that use this challenge solver.
- This is the recommended way of configuring the ingress class. Only one of
- `class`, `name` or `ingressClassName` may be specified.
- type: string
- ingressTemplate:
- description: |-
- Optional ingress template used to configure the ACME challenge solver
- ingress used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver ingress.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver ingress.
- type: object
- additionalProperties:
- type: string
- name:
- description: |-
- The name of the ingress resource that should have ACME challenge solving
- routes inserted into it in order to solve HTTP01 challenges.
- This is typically used in conjunction with ingress controllers like
- ingress-gce, which maintains a 1:1 mapping between external IPs and
- ingress resources. Only one of `class`, `name` or `ingressClassName` may
- be specified.
- type: string
- podTemplate:
- description: |-
- Optional pod template used to configure the ACME challenge solver pods
- used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the pod used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- spec:
- description: |-
- PodSpec defines overrides for the HTTP01 challenge solver pod.
- Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
- All other fields will be ignored.
- type: object
- properties:
- affinity:
- description: If specified, the pod's scheduling constraints
- type: object
- properties:
- nodeAffinity:
- description: Describes node affinity scheduling rules for the pod.
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node matches the corresponding matchExpressions; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: |-
- An empty preferred scheduling term matches all objects with implicit weight 0
- (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
- type: object
- required:
- - preference
- - weight
- properties:
- preference:
- description: A node selector term, associated with the corresponding weight.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- weight:
- description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to an update), the system
- may or may not try to eventually evict the pod from its node.
- type: object
- required:
- - nodeSelectorTerms
- properties:
- nodeSelectorTerms:
- description: Required. A list of node selector terms. The terms are ORed.
- type: array
- items:
- description: |-
- A null or empty node selector term matches no objects. The requirements of
- them are ANDed.
- The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- podAffinity:
- description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- podAntiAffinity:
- description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the anti-affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling anti-affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the anti-affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the anti-affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- imagePullSecrets:
- description: If specified, the pod's imagePullSecrets
- type: array
- items:
- description: |-
- LocalObjectReference contains enough information to let you locate the
- referenced object inside the same namespace.
- type: object
- properties:
- name:
- description: |-
- Name of the referent.
- This field is effectively required, but due to backwards compatibility is
- allowed to be empty. Instances of this type with an empty value here are
- almost certainly wrong.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- default: ""
- x-kubernetes-map-type: atomic
- nodeSelector:
- description: |-
- NodeSelector is a selector which must be true for the pod to fit on a node.
- Selector which must match a node's labels for the pod to be scheduled on that node.
- More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
- type: object
- additionalProperties:
- type: string
- priorityClassName:
- description: If specified, the pod's priorityClassName.
- type: string
- securityContext:
- description: If specified, the pod's security context
- type: object
- properties:
- fsGroup:
- description: |-
- A special supplemental group that applies to all containers in a pod.
- Some volume types allow the Kubelet to change the ownership of that volume
- to be owned by the pod:
-
- 1. The owning GID will be the FSGroup
- 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
- 3. The permission bits are OR'd with rw-rw----
-
- If unset, the Kubelet will not modify the ownership and permissions of any volume.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- fsGroupChangePolicy:
- description: |-
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
- before being exposed inside Pod. This field will only apply to
- volume types which support fsGroup based ownership(and permissions).
- It will have no effect on ephemeral volume types such as: secret, configmaps
- and emptydir.
- Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
- Note that this field cannot be set when spec.os.name is windows.
- type: string
- runAsGroup:
- description: |-
- The GID to run the entrypoint of the container process.
- Uses runtime default if unset.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- runAsNonRoot:
- description: |-
- Indicates that the container must run as a non-root user.
- If true, the Kubelet will validate the image at runtime to ensure that it
- does not run as UID 0 (root) and fail to start the container if it does.
- If unset or false, no such validation will be performed.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence.
- type: boolean
- runAsUser:
- description: |-
- The UID to run the entrypoint of the container process.
- Defaults to user specified in image metadata if unspecified.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- seLinuxOptions:
- description: |-
- The SELinux context to be applied to all containers.
- If unspecified, the container runtime will allocate a random SELinux context for each
- container. May also be set in SecurityContext. If set in
- both SecurityContext and PodSecurityContext, the value specified in SecurityContext
- takes precedence for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- properties:
- level:
- description: Level is SELinux level label that applies to the container.
- type: string
- role:
- description: Role is a SELinux role label that applies to the container.
- type: string
- type:
- description: Type is a SELinux type label that applies to the container.
- type: string
- user:
- description: User is a SELinux user label that applies to the container.
- type: string
- seccompProfile:
- description: |-
- The seccomp options to use by the containers in this pod.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- required:
- - type
- properties:
- localhostProfile:
- description: |-
- localhostProfile indicates a profile defined in a file on the node should be used.
- The profile must be preconfigured on the node to work.
- Must be a descending path, relative to the kubelet's configured seccomp profile location.
- Must be set if type is "Localhost". Must NOT be set for any other type.
- type: string
- type:
- description: |-
- type indicates which kind of seccomp profile will be applied.
- Valid options are:
-
- Localhost - a profile defined in a file on the node should be used.
- RuntimeDefault - the container runtime default profile should be used.
- Unconfined - no profile should be applied.
- type: string
- supplementalGroups:
- description: |-
- A list of groups applied to the first process run in each container, in addition
- to the container's primary GID, the fsGroup (if specified), and group memberships
- defined in the container image for the uid of the container process. If unspecified,
- no additional groups are added to any container. Note that group memberships
- defined in the container image for the uid of the container process are still effective,
- even if they are not included in this list.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- type: integer
- format: int64
- sysctls:
- description: |-
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
- sysctls (by the container runtime) might fail to launch.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- description: Sysctl defines a kernel parameter to be set
- type: object
- required:
- - name
- - value
- properties:
- name:
- description: Name of a property to set
- type: string
- value:
- description: Value of a property to set
- type: string
- serviceAccountName:
- description: If specified, the pod's service account
- type: string
- tolerations:
- description: If specified, the pod's tolerations.
- type: array
- items:
- description: |-
- The pod this Toleration is attached to tolerates any taint that matches
- the triple <key,value,effect> using the matching operator <operator>.
- type: object
- properties:
- effect:
- description: |-
- Effect indicates the taint effect to match. Empty means match all taint effects.
- When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
- type: string
- key:
- description: |-
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
- If the key is empty, operator must be Exists; this combination means to match all values and all keys.
- type: string
- operator:
- description: |-
- Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
- Exists is equivalent to wildcard for value, so that a pod can
- tolerate all taints of a particular category.
- type: string
- tolerationSeconds:
- description: |-
- TolerationSeconds represents the period of time the toleration (which must be
- of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
- it is not set, which means tolerate the taint forever (do not evict). Zero and
- negative values will be treated as 0 (evict immediately) by the system.
- type: integer
- format: int64
- value:
- description: |-
- Value is the taint value the toleration matches to.
- If the operator is Exists, the value should be empty, otherwise just a regular string.
- type: string
- serviceType:
- description: |-
- Optional service type for Kubernetes solver service. Supported values
- are NodePort or ClusterIP. If unset, defaults to NodePort.
- type: string
- selector:
- description: |-
- Selector selects a set of DNSNames on the Certificate resource that
- should be solved using this challenge solver.
- If not specified, the solver will be treated as the 'default' solver
- with the lowest priority, i.e. if any other solver has a more specific
- match, it will be used instead.
- type: object
- properties:
- dnsNames:
- description: |-
- List of DNSNames that this solver will be used to solve.
- If specified and a match is found, a dnsNames selector will take
- precedence over a dnsZones selector.
- If multiple solvers match with the same dnsNames value, the solver
- with the most matching labels in matchLabels will be selected.
- If neither has more matches, the solver defined earlier in the list
- will be selected.
- type: array
- items:
- type: string
- dnsZones:
- description: |-
- List of DNSZones that this solver will be used to solve.
- The most specific DNS zone match specified here will take precedence
- over other DNS zone matches, so a solver specifying sys.example.com
- will be selected over one specifying example.com for the domain
- www.sys.example.com.
- If multiple solvers match with the same dnsZones value, the solver
- with the most matching labels in matchLabels will be selected.
- If neither has more matches, the solver defined earlier in the list
- will be selected.
- type: array
- items:
- type: string
- matchLabels:
- description: |-
- A label selector that is used to refine the set of certificate's that
- this challenge solver will apply to.
- type: object
- additionalProperties:
- type: string
- ca:
- description: |-
- CA configures this issuer to sign certificates using a signing CA keypair
- stored in a Secret resource.
- This is used to build internal PKIs that are managed by cert-manager.
- type: object
- required:
- - secretName
- properties:
- crlDistributionPoints:
- description: |-
- The CRL distribution points is an X.509 v3 certificate extension which identifies
- the location of the CRL from which the revocation of this certificate can be checked.
- If not set, certificates will be issued without distribution points set.
- type: array
- items:
- type: string
- issuingCertificateURLs:
- description: |-
- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
- it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
- As an example, such a URL might be "http://ca.domain.com/ca.crt".
- type: array
- items:
- type: string
- ocspServers:
- description: |-
- The OCSP server list is an X.509 v3 extension that defines a list of
- URLs of OCSP responders. The OCSP responders can be queried for the
- revocation status of an issued certificate. If not set, the
- certificate will be issued with no OCSP servers set. For example, an
- OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
- type: array
- items:
- type: string
- secretName:
- description: |-
- SecretName is the name of the secret used to sign Certificates issued
- by this Issuer.
- type: string
- selfSigned:
- description: |-
- SelfSigned configures this issuer to 'self sign' certificates using the
- private key used to create the CertificateRequest object.
- type: object
- properties:
- crlDistributionPoints:
- description: |-
- The CRL distribution points is an X.509 v3 certificate extension which identifies
- the location of the CRL from which the revocation of this certificate can be checked.
- If not set certificate will be issued without CDP. Values are strings.
- type: array
- items:
- type: string
- vault:
- description: |-
- Vault configures this issuer to sign certificates using a HashiCorp Vault
- PKI backend.
- type: object
- required:
- - auth
- - path
- - server
- properties:
- auth:
- description: Auth configures how cert-manager authenticates with the Vault server.
- type: object
- properties:
- appRole:
- description: |-
- AppRole authenticates with Vault using the App Role auth mechanism,
- with the role and secret stored in a Kubernetes Secret resource.
- type: object
- required:
- - path
- - roleId
- - secretRef
- properties:
- path:
- description: |-
- Path where the App Role authentication backend is mounted in Vault, e.g:
- "approle"
- type: string
- roleId:
- description: |-
- RoleID configured in the App Role authentication backend when setting
- up the authentication backend in Vault.
- type: string
- secretRef:
- description: |-
- Reference to a key in a Secret that contains the App Role secret used
- to authenticate with Vault.
- The `key` field must be specified and denotes which entry within the Secret
- resource is used as the app role secret.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientCertificate:
- description: |-
- ClientCertificate authenticates with Vault by presenting a client
- certificate during the request's TLS handshake.
- Works only when using HTTPS protocol.
- type: object
- properties:
- mountPath:
- description: |-
- The Vault mountPath here is the mount path to use when authenticating with
- Vault. For example, setting a value to `/v1/auth/foo`, will use the path
- `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
- default value "/v1/auth/cert" will be used.
- type: string
- name:
- description: |-
- Name of the certificate role to authenticate against.
- If not set, matching any certificate role, if available.
- type: string
- secretName:
- description: |-
- Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
- tls.crt and tls.key) used to authenticate to Vault using TLS client
- authentication.
- type: string
- kubernetes:
- description: |-
- Kubernetes authenticates with Vault by passing the ServiceAccount
- token stored in the named Secret resource to the Vault server.
- type: object
- required:
- - role
- properties:
- mountPath:
- description: |-
- The Vault mountPath here is the mount path to use when authenticating with
- Vault. For example, setting a value to `/v1/auth/foo`, will use the path
- `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
- default value "/v1/auth/kubernetes" will be used.
- type: string
- role:
- description: |-
- A required field containing the Vault Role to assume. A Role binds a
- Kubernetes ServiceAccount with a set of Vault policies.
- type: string
- secretRef:
- description: |-
- The required Secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with Vault. Use of 'ambient credentials' is not
- supported.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- serviceAccountRef:
- description: |-
- A reference to a service account that will be used to request a bound
- token (also known as "projected token"). Compared to using "secretRef",
- using this field means that you don't rely on statically bound tokens. To
- use this field, you must configure an RBAC rule to let cert-manager
- request a token.
- type: object
- required:
- - name
- properties:
- audiences:
- description: |-
- TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
- consisting of the issuer's namespace and name is always included.
- type: array
- items:
- type: string
- name:
- description: Name of the ServiceAccount used to request a token.
- type: string
- tokenSecretRef:
- description: TokenSecretRef authenticates with Vault by presenting a token.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- caBundle:
- description: |-
- Base64-encoded bundle of PEM CAs which will be used to validate the certificate
- chain presented by Vault. Only used if using HTTPS to connect to Vault and
- ignored for HTTP connections.
- Mutually exclusive with CABundleSecretRef.
- If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
- the cert-manager controller container is used to validate the TLS connection.
- type: string
- format: byte
- caBundleSecretRef:
- description: |-
- Reference to a Secret containing a bundle of PEM-encoded CAs to use when
- verifying the certificate chain presented by Vault when using HTTPS.
- Mutually exclusive with CABundle.
- If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
- the cert-manager controller container is used to validate the TLS connection.
- If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientCertSecretRef:
- description: |-
- Reference to a Secret containing a PEM-encoded Client Certificate to use when the
- Vault server requires mTLS.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientKeySecretRef:
- description: |-
- Reference to a Secret containing a PEM-encoded Client Private Key to use when the
- Vault server requires mTLS.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- namespace:
- description: |-
- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
- More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
- type: string
- path:
- description: |-
- Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
- "my_pki_mount/sign/my-role-name".
- type: string
- server:
- description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
- type: string
- serverName:
- description: |-
- ServerName is used to verify the hostname on the returned certificates
- by the Vault server.
- type: string
- venafi:
- description: |-
- Venafi configures this issuer to sign certificates using a Venafi TPP
- or Venafi Cloud policy zone.
- type: object
- required:
- - zone
- properties:
- cloud:
- description: |-
- Cloud specifies the Venafi cloud configuration settings.
- Only one of TPP or Cloud may be specified.
- type: object
- required:
- - apiTokenSecretRef
- properties:
- apiTokenSecretRef:
- description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- url:
- description: |-
- URL is the base URL for Venafi Cloud.
- Defaults to "https://api.venafi.cloud/".
- type: string
- tpp:
- description: |-
- TPP specifies Trust Protection Platform configuration settings.
- Only one of TPP or Cloud may be specified.
- type: object
- required:
- - credentialsRef
- - url
- properties:
- caBundle:
- description: |-
- Base64-encoded bundle of PEM CAs which will be used to validate the certificate
- chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
- If undefined, the certificate bundle in the cert-manager controller container
- is used to validate the chain.
- type: string
- format: byte
- caBundleSecretRef:
- description: |-
- Reference to a Secret containing a base64-encoded bundle of PEM CAs
- which will be used to validate the certificate chain presented by the TPP server.
- Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
- If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
- the cert-manager controller container is used to validate the TLS connection.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- credentialsRef:
- description: |-
- CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
- The secret must contain the key 'access-token' for the Access Token Authentication,
- or two keys, 'username' and 'password' for the API Keys Authentication.
- type: object
- required:
- - name
- properties:
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- url:
- description: |-
- URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
- for example: "https://tpp.example.com/vedsdk".
- type: string
- zone:
- description: |-
- Zone is the Venafi Policy Zone to use for this issuer.
- All requests made to the Venafi platform will be restricted by the named
- zone policy.
- This field is required.
- type: string
- status:
- description: Status of the ClusterIssuer. This is set and managed automatically.
- type: object
- properties:
- acme:
- description: |-
- ACME specific status options.
- This field should only be set if the Issuer is configured to use an ACME
- server to issue certificates.
- type: object
- properties:
- lastPrivateKeyHash:
- description: |-
- LastPrivateKeyHash is a hash of the private key associated with the latest
- registered ACME account, in order to track changes made to registered account
- associated with the Issuer
- type: string
- lastRegisteredEmail:
- description: |-
- LastRegisteredEmail is the email associated with the latest registered
- ACME account, in order to track changes made to registered account
- associated with the Issuer
- type: string
- uri:
- description: |-
- URI is the unique account identifier, which can also be used to retrieve
- account details from the CA
- type: string
- conditions:
- description: |-
- List of status conditions to indicate the status of a CertificateRequest.
- Known condition types are `Ready`.
- type: array
- items:
- description: IssuerCondition contains condition information for an Issuer.
- type: object
- required:
- - status
- - type
- properties:
- lastTransitionTime:
- description: |-
- LastTransitionTime is the timestamp corresponding to the last status
- change of this condition.
- type: string
- format: date-time
- message:
- description: |-
- Message is a human readable description of the details of the last
- transition, complementing reason.
- type: string
- observedGeneration:
- description: |-
- If set, this represents the .metadata.generation that the condition was
- set based upon.
- For instance, if .metadata.generation is currently 12, but the
- .status.condition[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the Issuer.
- type: integer
- format: int64
- reason:
- description: |-
- Reason is a brief machine readable explanation for the condition's last
- transition.
- type: string
- status:
- description: Status of the condition, one of (`True`, `False`, `Unknown`).
- type: string
- enum:
- - "True"
- - "False"
- - Unknown
- type:
- description: Type of the condition, known values are (`Ready`).
- type: string
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- served: true
- storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- name: issuers.cert-manager.io
- # START annotations {{- if .Values.crds.keep }}
- annotations:
- helm.sh/resource-policy: keep
- # END annotations {{- end }}
- labels:
- app: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/instance: '{{ .Release.Name }}'
- app.kubernetes.io/component: "crds"
- # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
- group: cert-manager.io
- names:
- kind: Issuer
- listKind: IssuerList
- plural: issuers
- shortNames:
- - iss
- singular: issuer
- categories:
- - cert-manager
- scope: Namespaced
- versions:
- - name: v1
- subresources:
- status: {}
- additionalPrinterColumns:
- - jsonPath: .status.conditions[?(@.type=="Ready")].status
- name: Ready
- type: string
- - jsonPath: .status.conditions[?(@.type=="Ready")].message
- name: Status
- priority: 1
- type: string
- - jsonPath: .metadata.creationTimestamp
- description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
- name: Age
- type: date
- schema:
- openAPIV3Schema:
- description: |-
- An Issuer represents a certificate issuing authority which can be
- referenced as part of `issuerRef` fields.
- It is scoped to a single namespace and can therefore only be referenced by
- resources within the same namespace.
- type: object
- required:
- - spec
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Desired state of the Issuer resource.
- type: object
- properties:
- acme:
- description: |-
- ACME configures this issuer to communicate with a RFC8555 (ACME) server
- to obtain signed x509 certificates.
- type: object
- required:
- - privateKeySecretRef
- - server
- properties:
- caBundle:
- description: |-
- Base64-encoded bundle of PEM CAs which can be used to validate the certificate
- chain presented by the ACME server.
- Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
- kinds of security vulnerabilities.
- If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
- the container is used to validate the TLS connection.
- type: string
- format: byte
- disableAccountKeyGeneration:
- description: |-
- Enables or disables generating a new ACME account key.
- If true, the Issuer resource will *not* request a new account but will expect
- the account key to be supplied via an existing secret.
- If false, the cert-manager system will generate a new ACME account key
- for the Issuer.
- Defaults to false.
- type: boolean
- email:
- description: |-
- Email is the email address to be associated with the ACME account.
- This field is optional, but it is strongly recommended to be set.
- It will be used to contact you in case of issues with your account or
- certificates, including expiry notification emails.
- This field may be updated after the account is initially registered.
- type: string
- enableDurationFeature:
- description: |-
- Enables requesting a Not After date on certificates that matches the
- duration of the certificate. This is not supported by all ACME servers
- like Let's Encrypt. If set to true when the ACME server does not support
- it, it will create an error on the Order.
- Defaults to false.
- type: boolean
- externalAccountBinding:
- description: |-
- ExternalAccountBinding is a reference to a CA external account of the ACME
- server.
- If set, upon registration cert-manager will attempt to associate the given
- external account credentials with the registered ACME account.
- type: object
- required:
- - keyID
- - keySecretRef
- properties:
- keyAlgorithm:
- description: |-
- Deprecated: keyAlgorithm field exists for historical compatibility
- reasons and should not be used. The algorithm is now hardcoded to HS256
- in golang/x/crypto/acme.
- type: string
- enum:
- - HS256
- - HS384
- - HS512
- keyID:
- description: keyID is the ID of the CA key that the External Account is bound to.
- type: string
- keySecretRef:
- description: |-
- keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
- Secret which holds the symmetric MAC key of the External Account Binding.
- The `key` is the index string that is paired with the key data in the
- Secret and should not be confused with the key data itself, or indeed with
- the External Account Binding keyID above.
- The secret key stored in the Secret **must** be un-padded, base64 URL
- encoded data.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- preferredChain:
- description: |-
- PreferredChain is the chain to use if the ACME server outputs multiple.
- PreferredChain is no guarantee that this one gets delivered by the ACME
- endpoint.
- For example, for Let's Encrypt's DST cross-sign you would use:
- "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
- This value picks the first certificate bundle in the combined set of
- ACME default and alternative chains that has a root-most certificate with
- this value as its issuer's commonname.
- type: string
- maxLength: 64
- privateKeySecretRef:
- description: |-
- PrivateKey is the name of a Kubernetes Secret resource that will be used to
- store the automatically generated ACME account private key.
- Optionally, a `key` may be specified to select a specific entry within
- the named Secret resource.
- If `key` is not specified, a default of `tls.key` will be used.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- profile:
- description: |-
- Profile allows requesting a certificate profile from the ACME server.
- Supported profiles are listed by the server's ACME directory URL.
- type: string
- server:
- description: |-
- Server is the URL used to access the ACME server's 'directory' endpoint.
- For example, for Let's Encrypt's staging endpoint, you would use:
- "https://acme-staging-v02.api.letsencrypt.org/directory".
- Only ACME v2 endpoints (i.e. RFC 8555) are supported.
- type: string
- skipTLSVerify:
- description: |-
- INSECURE: Enables or disables validation of the ACME server TLS certificate.
- If true, requests to the ACME server will not have the TLS certificate chain
- validated.
- Mutually exclusive with CABundle; prefer using CABundle to prevent various
- kinds of security vulnerabilities.
- Only enable this option in development environments.
- If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
- the container is used to validate the TLS connection.
- Defaults to false.
- type: boolean
- solvers:
- description: |-
- Solvers is a list of challenge solvers that will be used to solve
- ACME challenges for the matching domains.
- Solver configurations must be provided in order to obtain certificates
- from an ACME server.
- For more information, see: https://cert-manager.io/docs/configuration/acme/
- type: array
- items:
- description: |-
- An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
- A selector may be provided to use different solving strategies for different DNS names.
- Only one of HTTP01 or DNS01 must be provided.
- type: object
- properties:
- dns01:
- description: |-
- Configures cert-manager to attempt to complete authorizations by
- performing the DNS01 challenge flow.
- type: object
- properties:
- acmeDNS:
- description: |-
- Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
- DNS01 challenge records.
- type: object
- required:
- - accountSecretRef
- - host
- properties:
- accountSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- host:
- type: string
- akamai:
- description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
- type: object
- required:
- - accessTokenSecretRef
- - clientSecretSecretRef
- - clientTokenSecretRef
- - serviceConsumerDomain
- properties:
- accessTokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientSecretSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientTokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- serviceConsumerDomain:
- type: string
- azureDNS:
- description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
- type: object
- required:
- - resourceGroupName
- - subscriptionID
- properties:
- clientID:
- description: |-
- Auth: Azure Service Principal:
- The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
- If set, ClientSecret and TenantID must also be set.
- type: string
- clientSecretSecretRef:
- description: |-
- Auth: Azure Service Principal:
- A reference to a Secret containing the password associated with the Service Principal.
- If set, ClientID and TenantID must also be set.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- environment:
- description: name of the Azure environment (default AzurePublicCloud)
- type: string
- enum:
- - AzurePublicCloud
- - AzureChinaCloud
- - AzureGermanCloud
- - AzureUSGovernmentCloud
- hostedZoneName:
- description: name of the DNS zone that should be used
- type: string
- managedIdentity:
- description: |-
- Auth: Azure Workload Identity or Azure Managed Service Identity:
- Settings to enable Azure Workload Identity or Azure Managed Service Identity
- If set, ClientID, ClientSecret and TenantID must not be set.
- type: object
- properties:
- clientID:
- description: client ID of the managed identity, cannot be used at the same time as resourceID
- type: string
- resourceID:
- description: |-
- resource ID of the managed identity, cannot be used at the same time as clientID
- Cannot be used for Azure Managed Service Identity
- type: string
- tenantID:
- description: tenant ID of the managed identity, cannot be used at the same time as resourceID
- type: string
- resourceGroupName:
- description: resource group the DNS zone is located in
- type: string
- subscriptionID:
- description: ID of the Azure subscription
- type: string
- tenantID:
- description: |-
- Auth: Azure Service Principal:
- The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
- If set, ClientID and ClientSecret must also be set.
- type: string
- cloudDNS:
- description: Use the Google Cloud DNS API to manage DNS01 challenge records.
- type: object
- required:
- - project
- properties:
- hostedZoneName:
- description: |-
- HostedZoneName is an optional field that tells cert-manager in which
- Cloud DNS zone the challenge record has to be created.
- If left empty cert-manager will automatically choose a zone.
- type: string
- project:
- type: string
- serviceAccountSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- cloudflare:
- description: Use the Cloudflare API to manage DNS01 challenge records.
- type: object
- properties:
- apiKeySecretRef:
- description: |-
- API key to use to authenticate with Cloudflare.
- Note: using an API token to authenticate is now the recommended method
- as it allows greater control of permissions.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- apiTokenSecretRef:
- description: API token used to authenticate with Cloudflare.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- email:
- description: Email of the account, only required when using API key based authentication.
- type: string
- cnameStrategy:
- description: |-
- CNAMEStrategy configures how the DNS01 provider should handle CNAME
- records when found in DNS zones.
- type: string
- enum:
- - None
- - Follow
- digitalocean:
- description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
- type: object
- required:
- - tokenSecretRef
- properties:
- tokenSecretRef:
- description: |-
- A reference to a specific 'key' within a Secret resource.
- In some instances, `key` is a required field.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- rfc2136:
- description: |-
- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
- to manage DNS01 challenge records.
- type: object
- required:
- - nameserver
- properties:
- nameserver:
- description: |-
- The IP address or hostname of an authoritative DNS server supporting
- RFC2136 in the form host:port. If the host is an IPv6 address it must be
- enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
- This field is required.
- type: string
- tsigAlgorithm:
- description: |-
- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
- when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
- Supported values are (case-insensitive): ``HMACMD5`` (default),
- ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
- type: string
- tsigKeyName:
- description: |-
- The TSIG Key name configured in the DNS.
- If ``tsigSecretSecretRef`` is defined, this field is required.
- type: string
- tsigSecretSecretRef:
- description: |-
- The name of the secret containing the TSIG value.
- If ``tsigKeyName`` is defined, this field is required.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- route53:
- description: Use the AWS Route53 API to manage DNS01 challenge records.
- type: object
- properties:
- accessKeyID:
- description: |-
- The AccessKeyID is used for authentication.
- Cannot be set when SecretAccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: string
- accessKeyIDSecretRef:
- description: |-
- The SecretAccessKey is used for authentication. If set, pull the AWS
- access key ID from a key within a Kubernetes Secret.
- Cannot be set when AccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- auth:
- description: Auth configures how cert-manager authenticates.
- type: object
- required:
- - kubernetes
- properties:
- kubernetes:
- description: |-
- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
- by passing a bound ServiceAccount token.
- type: object
- required:
- - serviceAccountRef
- properties:
- serviceAccountRef:
- description: |-
- A reference to a service account that will be used to request a bound
- token (also known as "projected token"). To use this field, you must
- configure an RBAC rule to let cert-manager request a token.
- type: object
- required:
- - name
- properties:
- audiences:
- description: |-
- TokenAudiences is an optional list of audiences to include in the
- token passed to AWS. The default token consisting of the issuer's namespace
- and name is always included.
- If unset the audience defaults to `sts.amazonaws.com`.
- type: array
- items:
- type: string
- name:
- description: Name of the ServiceAccount used to request a token.
- type: string
- hostedZoneID:
- description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
- type: string
- region:
- description: |-
- Override the AWS region.
-
- Route53 is a global service and does not have regional endpoints but the
- region specified here (or via environment variables) is used as a hint to
- help compute the correct AWS credential scope and partition when it
- connects to Route53. See:
- - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
- - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
-
- If you omit this region field, cert-manager will use the region from
- AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
- in the cert-manager controller Pod.
-
- The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
- Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
- [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
- In this case this `region` field value is ignored.
-
- The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
- Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
- [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
- In this case this `region` field value is ignored.
- type: string
- role:
- description: |-
- Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
- or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
- type: string
- secretAccessKeySecretRef:
- description: |-
- The SecretAccessKey is used for authentication.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
- see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- webhook:
- description: |-
- Configure an external webhook based DNS01 challenge solver to manage
- DNS01 challenge records.
- type: object
- required:
- - groupName
- - solverName
- properties:
- config:
- description: |-
- Additional configuration that should be passed to the webhook apiserver
- when challenges are processed.
- This can contain arbitrary JSON data.
- Secret values should not be specified in this stanza.
- If secret values are needed (e.g., credentials for a DNS service), you
- should use a SecretKeySelector to reference a Secret resource.
- For details on the schema of this field, consult the webhook provider
- implementation's documentation.
- x-kubernetes-preserve-unknown-fields: true
- groupName:
- description: |-
- The API group name that should be used when POSTing ChallengePayload
- resources to the webhook apiserver.
- This should be the same as the GroupName specified in the webhook
- provider implementation.
- type: string
- solverName:
- description: |-
- The name of the solver to use, as defined in the webhook provider
- implementation.
- This will typically be the name of the provider, e.g., 'cloudflare'.
- type: string
- http01:
- description: |-
- Configures cert-manager to attempt to complete authorizations by
- performing the HTTP01 challenge flow.
- It is not possible to obtain certificates for wildcard domain names
- (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
- type: object
- properties:
- gatewayHTTPRoute:
- description: |-
- The Gateway API is a sig-network community API that models service networking
- in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
- create HTTPRoutes with the specified labels in the same namespace as the challenge.
- This solver is experimental, and fields / behaviour may change in the future.
- type: object
- properties:
- labels:
- description: |-
- Custom labels that will be applied to HTTPRoutes created by cert-manager
- while solving HTTP-01 challenges.
- type: object
- additionalProperties:
- type: string
- parentRefs:
- description: |-
- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
- cert-manager needs to know which parentRefs should be used when creating
- the HTTPRoute. Usually, the parentRef references a Gateway. See:
- https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
- type: array
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- type: object
- required:
- - name
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- type: string
- default: gateway.networking.k8s.io
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- kind:
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- type: string
- default: Gateway
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- type: string
- maxLength: 253
- minLength: 1
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
- <gateway:experimental:description>
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
- </gateway:experimental:description>
-
- Support: Core
- type: string
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
- <gateway:experimental:description>
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
- </gateway:experimental:description>
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- type: integer
- format: int32
- maximum: 65535
- minimum: 1
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- type: string
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- podTemplate:
- description: |-
- Optional pod template used to configure the ACME challenge solver pods
- used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the pod used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- spec:
- description: |-
- PodSpec defines overrides for the HTTP01 challenge solver pod.
- Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
- All other fields will be ignored.
- type: object
- properties:
- affinity:
- description: If specified, the pod's scheduling constraints
- type: object
- properties:
- nodeAffinity:
- description: Describes node affinity scheduling rules for the pod.
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node matches the corresponding matchExpressions; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: |-
- An empty preferred scheduling term matches all objects with implicit weight 0
- (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
- type: object
- required:
- - preference
- - weight
- properties:
- preference:
- description: A node selector term, associated with the corresponding weight.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- weight:
- description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to an update), the system
- may or may not try to eventually evict the pod from its node.
- type: object
- required:
- - nodeSelectorTerms
- properties:
- nodeSelectorTerms:
- description: Required. A list of node selector terms. The terms are ORed.
- type: array
- items:
- description: |-
- A null or empty node selector term matches no objects. The requirements of
- them are ANDed.
- The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- podAffinity:
- description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- podAntiAffinity:
- description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the anti-affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling anti-affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the anti-affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the anti-affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- imagePullSecrets:
- description: If specified, the pod's imagePullSecrets
- type: array
- items:
- description: |-
- LocalObjectReference contains enough information to let you locate the
- referenced object inside the same namespace.
- type: object
- properties:
- name:
- description: |-
- Name of the referent.
- This field is effectively required, but due to backwards compatibility is
- allowed to be empty. Instances of this type with an empty value here are
- almost certainly wrong.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- default: ""
- x-kubernetes-map-type: atomic
- nodeSelector:
- description: |-
- NodeSelector is a selector which must be true for the pod to fit on a node.
- Selector which must match a node's labels for the pod to be scheduled on that node.
- More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
- type: object
- additionalProperties:
- type: string
- priorityClassName:
- description: If specified, the pod's priorityClassName.
- type: string
- securityContext:
- description: If specified, the pod's security context
- type: object
- properties:
- fsGroup:
- description: |-
- A special supplemental group that applies to all containers in a pod.
- Some volume types allow the Kubelet to change the ownership of that volume
- to be owned by the pod:
-
- 1. The owning GID will be the FSGroup
- 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
- 3. The permission bits are OR'd with rw-rw----
-
- If unset, the Kubelet will not modify the ownership and permissions of any volume.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- fsGroupChangePolicy:
- description: |-
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
- before being exposed inside Pod. This field will only apply to
- volume types which support fsGroup based ownership(and permissions).
- It will have no effect on ephemeral volume types such as: secret, configmaps
- and emptydir.
- Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
- Note that this field cannot be set when spec.os.name is windows.
- type: string
- runAsGroup:
- description: |-
- The GID to run the entrypoint of the container process.
- Uses runtime default if unset.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- runAsNonRoot:
- description: |-
- Indicates that the container must run as a non-root user.
- If true, the Kubelet will validate the image at runtime to ensure that it
- does not run as UID 0 (root) and fail to start the container if it does.
- If unset or false, no such validation will be performed.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence.
- type: boolean
- runAsUser:
- description: |-
- The UID to run the entrypoint of the container process.
- Defaults to user specified in image metadata if unspecified.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- seLinuxOptions:
- description: |-
- The SELinux context to be applied to all containers.
- If unspecified, the container runtime will allocate a random SELinux context for each
- container. May also be set in SecurityContext. If set in
- both SecurityContext and PodSecurityContext, the value specified in SecurityContext
- takes precedence for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- properties:
- level:
- description: Level is SELinux level label that applies to the container.
- type: string
- role:
- description: Role is a SELinux role label that applies to the container.
- type: string
- type:
- description: Type is a SELinux type label that applies to the container.
- type: string
- user:
- description: User is a SELinux user label that applies to the container.
- type: string
- seccompProfile:
- description: |-
- The seccomp options to use by the containers in this pod.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- required:
- - type
- properties:
- localhostProfile:
- description: |-
- localhostProfile indicates a profile defined in a file on the node should be used.
- The profile must be preconfigured on the node to work.
- Must be a descending path, relative to the kubelet's configured seccomp profile location.
- Must be set if type is "Localhost". Must NOT be set for any other type.
- type: string
- type:
- description: |-
- type indicates which kind of seccomp profile will be applied.
- Valid options are:
-
- Localhost - a profile defined in a file on the node should be used.
- RuntimeDefault - the container runtime default profile should be used.
- Unconfined - no profile should be applied.
- type: string
- supplementalGroups:
- description: |-
- A list of groups applied to the first process run in each container, in addition
- to the container's primary GID, the fsGroup (if specified), and group memberships
- defined in the container image for the uid of the container process. If unspecified,
- no additional groups are added to any container. Note that group memberships
- defined in the container image for the uid of the container process are still effective,
- even if they are not included in this list.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- type: integer
- format: int64
- sysctls:
- description: |-
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
- sysctls (by the container runtime) might fail to launch.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- description: Sysctl defines a kernel parameter to be set
- type: object
- required:
- - name
- - value
- properties:
- name:
- description: Name of a property to set
- type: string
- value:
- description: Value of a property to set
- type: string
- serviceAccountName:
- description: If specified, the pod's service account
- type: string
- tolerations:
- description: If specified, the pod's tolerations.
- type: array
- items:
- description: |-
- The pod this Toleration is attached to tolerates any taint that matches
- the triple <key,value,effect> using the matching operator <operator>.
- type: object
- properties:
- effect:
- description: |-
- Effect indicates the taint effect to match. Empty means match all taint effects.
- When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
- type: string
- key:
- description: |-
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
- If the key is empty, operator must be Exists; this combination means to match all values and all keys.
- type: string
- operator:
- description: |-
- Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
- Exists is equivalent to wildcard for value, so that a pod can
- tolerate all taints of a particular category.
- type: string
- tolerationSeconds:
- description: |-
- TolerationSeconds represents the period of time the toleration (which must be
- of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
- it is not set, which means tolerate the taint forever (do not evict). Zero and
- negative values will be treated as 0 (evict immediately) by the system.
- type: integer
- format: int64
- value:
- description: |-
- Value is the taint value the toleration matches to.
- If the operator is Exists, the value should be empty, otherwise just a regular string.
- type: string
- serviceType:
- description: |-
- Optional service type for Kubernetes solver service. Supported values
- are NodePort or ClusterIP. If unset, defaults to NodePort.
- type: string
- ingress:
- description: |-
- The ingress based HTTP01 challenge solver will solve challenges by
- creating or modifying Ingress resources in order to route requests for
- '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
- provisioned by cert-manager for each Challenge to be completed.
- type: object
- properties:
- class:
- description: |-
- This field configures the annotation `kubernetes.io/ingress.class` when
- creating Ingress resources to solve ACME challenges that use this
- challenge solver. Only one of `class`, `name` or `ingressClassName` may
- be specified.
- type: string
- ingressClassName:
- description: |-
- This field configures the field `ingressClassName` on the created Ingress
- resources used to solve ACME challenges that use this challenge solver.
- This is the recommended way of configuring the ingress class. Only one of
- `class`, `name` or `ingressClassName` may be specified.
- type: string
- ingressTemplate:
- description: |-
- Optional ingress template used to configure the ACME challenge solver
- ingress used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver ingress.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver ingress.
- type: object
- additionalProperties:
- type: string
- name:
- description: |-
- The name of the ingress resource that should have ACME challenge solving
- routes inserted into it in order to solve HTTP01 challenges.
- This is typically used in conjunction with ingress controllers like
- ingress-gce, which maintains a 1:1 mapping between external IPs and
- ingress resources. Only one of `class`, `name` or `ingressClassName` may
- be specified.
- type: string
- podTemplate:
- description: |-
- Optional pod template used to configure the ACME challenge solver pods
- used for HTTP01 challenges.
- type: object
- properties:
- metadata:
- description: |-
- ObjectMeta overrides for the pod used to solve HTTP01 challenges.
- Only the 'labels' and 'annotations' fields may be set.
- If labels or annotations overlap with in-built values, the values here
- will override the in-built values.
- type: object
- properties:
- annotations:
- description: Annotations that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- labels:
- description: Labels that should be added to the created ACME HTTP01 solver pods.
- type: object
- additionalProperties:
- type: string
- spec:
- description: |-
- PodSpec defines overrides for the HTTP01 challenge solver pod.
- Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
- All other fields will be ignored.
- type: object
- properties:
- affinity:
- description: If specified, the pod's scheduling constraints
- type: object
- properties:
- nodeAffinity:
- description: Describes node affinity scheduling rules for the pod.
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node matches the corresponding matchExpressions; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: |-
- An empty preferred scheduling term matches all objects with implicit weight 0
- (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
- type: object
- required:
- - preference
- - weight
- properties:
- preference:
- description: A node selector term, associated with the corresponding weight.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- weight:
- description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to an update), the system
- may or may not try to eventually evict the pod from its node.
- type: object
- required:
- - nodeSelectorTerms
- properties:
- nodeSelectorTerms:
- description: Required. A list of node selector terms. The terms are ORed.
- type: array
- items:
- description: |-
- A null or empty node selector term matches no objects. The requirements of
- them are ANDed.
- The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
- type: object
- properties:
- matchExpressions:
- description: A list of node selector requirements by node's labels.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchFields:
- description: A list of node selector requirements by node's fields.
- type: array
- items:
- description: |-
- A node selector requirement is a selector that contains values, a key, and an operator
- that relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: The label key that the selector applies to.
- type: string
- operator:
- description: |-
- Represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
- type: string
- values:
- description: |-
- An array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. If the operator is Gt or Lt, the values
- array must have a single element, which will be interpreted as an integer.
- This array is replaced during a strategic merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- x-kubernetes-list-type: atomic
- x-kubernetes-map-type: atomic
- podAffinity:
- description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- podAntiAffinity:
- description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
- type: object
- properties:
- preferredDuringSchedulingIgnoredDuringExecution:
- description: |-
- The scheduler will prefer to schedule pods to nodes that satisfy
- the anti-affinity expressions specified by this field, but it may choose
- a node that violates one or more of the expressions. The node that is
- most preferred is the one with the greatest sum of weights, i.e.
- for each node that meets all of the scheduling requirements (resource
- request, requiredDuringScheduling anti-affinity expressions, etc.),
- compute a sum by iterating through the elements of this field and adding
- "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
- node(s) with the highest sum are the most preferred.
- type: array
- items:
- description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
- type: object
- required:
- - podAffinityTerm
- - weight
- properties:
- podAffinityTerm:
- description: Required. A pod affinity term, associated with the corresponding weight.
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- weight:
- description: |-
- weight associated with matching the corresponding podAffinityTerm,
- in the range 1-100.
- type: integer
- format: int32
- x-kubernetes-list-type: atomic
- requiredDuringSchedulingIgnoredDuringExecution:
- description: |-
- If the anti-affinity requirements specified by this field are not met at
- scheduling time, the pod will not be scheduled onto the node.
- If the anti-affinity requirements specified by this field cease to be met
- at some point during pod execution (e.g. due to a pod label update), the
- system may or may not try to eventually evict the pod from its node.
- When there are multiple elements, the lists of nodes corresponding to each
- podAffinityTerm are intersected, i.e. all terms must be satisfied.
- type: array
- items:
- description: |-
- Defines a set of pods (namely those matching the labelSelector
- relative to the given namespace(s)) that this pod should be
- co-located (affinity) or not co-located (anti-affinity) with,
- where co-located is defined as running on a node whose value of
- the label with key <topologyKey> matches that of any node on which
- a pod of the set of pods is running
- type: object
- required:
- - topologyKey
- properties:
- labelSelector:
- description: |-
- A label query over a set of resources, in this case pods.
- If it's null, this PodAffinityTerm matches with no Pods.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- matchLabelKeys:
- description: |-
- MatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both matchLabelKeys and labelSelector.
- Also, matchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- mismatchLabelKeys:
- description: |-
- MismatchLabelKeys is a set of pod label keys to select which pods will
- be taken into consideration. The keys are used to lookup values from the
- incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
- to select the group of existing pods which pods will be taken into consideration
- for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
- pod labels will be ignored. The default value is empty.
- The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
- Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
- This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- namespaceSelector:
- description: |-
- A label query over the set of namespaces that the term applies to.
- The term is applied to the union of the namespaces selected by this field
- and the ones listed in the namespaces field.
- null selector and null or empty namespaces list means "this pod's namespace".
- An empty selector ({}) matches all namespaces.
- type: object
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
- type: array
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- type: object
- required:
- - key
- - operator
- properties:
- key:
- description: key is the label key that the selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- x-kubernetes-list-type: atomic
- matchLabels:
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- additionalProperties:
- type: string
- x-kubernetes-map-type: atomic
- namespaces:
- description: |-
- namespaces specifies a static list of namespace names that the term applies to.
- The term is applied to the union of the namespaces listed in this field
- and the ones selected by namespaceSelector.
- null or empty namespaces list and null namespaceSelector means "this pod's namespace".
- type: array
- items:
- type: string
- x-kubernetes-list-type: atomic
- topologyKey:
- description: |-
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
- the labelSelector in the specified namespaces, where co-located is defined as running on a node
- whose value of the label with key topologyKey matches that of any node on which any of the
- selected pods is running.
- Empty topologyKey is not allowed.
- type: string
- x-kubernetes-list-type: atomic
- imagePullSecrets:
- description: If specified, the pod's imagePullSecrets
- type: array
- items:
- description: |-
- LocalObjectReference contains enough information to let you locate the
- referenced object inside the same namespace.
- type: object
- properties:
- name:
- description: |-
- Name of the referent.
- This field is effectively required, but due to backwards compatibility is
- allowed to be empty. Instances of this type with an empty value here are
- almost certainly wrong.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- default: ""
- x-kubernetes-map-type: atomic
- nodeSelector:
- description: |-
- NodeSelector is a selector which must be true for the pod to fit on a node.
- Selector which must match a node's labels for the pod to be scheduled on that node.
- More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
- type: object
- additionalProperties:
- type: string
- priorityClassName:
- description: If specified, the pod's priorityClassName.
- type: string
- securityContext:
- description: If specified, the pod's security context
- type: object
- properties:
- fsGroup:
- description: |-
- A special supplemental group that applies to all containers in a pod.
- Some volume types allow the Kubelet to change the ownership of that volume
- to be owned by the pod:
-
- 1. The owning GID will be the FSGroup
- 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
- 3. The permission bits are OR'd with rw-rw----
-
- If unset, the Kubelet will not modify the ownership and permissions of any volume.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- fsGroupChangePolicy:
- description: |-
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
- before being exposed inside Pod. This field will only apply to
- volume types which support fsGroup based ownership(and permissions).
- It will have no effect on ephemeral volume types such as: secret, configmaps
- and emptydir.
- Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
- Note that this field cannot be set when spec.os.name is windows.
- type: string
- runAsGroup:
- description: |-
- The GID to run the entrypoint of the container process.
- Uses runtime default if unset.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- runAsNonRoot:
- description: |-
- Indicates that the container must run as a non-root user.
- If true, the Kubelet will validate the image at runtime to ensure that it
- does not run as UID 0 (root) and fail to start the container if it does.
- If unset or false, no such validation will be performed.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence.
- type: boolean
- runAsUser:
- description: |-
- The UID to run the entrypoint of the container process.
- Defaults to user specified in image metadata if unspecified.
- May also be set in SecurityContext. If set in both SecurityContext and
- PodSecurityContext, the value specified in SecurityContext takes precedence
- for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: integer
- format: int64
- seLinuxOptions:
- description: |-
- The SELinux context to be applied to all containers.
- If unspecified, the container runtime will allocate a random SELinux context for each
- container. May also be set in SecurityContext. If set in
- both SecurityContext and PodSecurityContext, the value specified in SecurityContext
- takes precedence for that container.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- properties:
- level:
- description: Level is SELinux level label that applies to the container.
- type: string
- role:
- description: Role is a SELinux role label that applies to the container.
- type: string
- type:
- description: Type is a SELinux type label that applies to the container.
- type: string
- user:
- description: User is a SELinux user label that applies to the container.
- type: string
- seccompProfile:
- description: |-
- The seccomp options to use by the containers in this pod.
- Note that this field cannot be set when spec.os.name is windows.
- type: object
- required:
- - type
- properties:
- localhostProfile:
- description: |-
- localhostProfile indicates a profile defined in a file on the node should be used.
- The profile must be preconfigured on the node to work.
- Must be a descending path, relative to the kubelet's configured seccomp profile location.
- Must be set if type is "Localhost". Must NOT be set for any other type.
- type: string
- type:
- description: |-
- type indicates which kind of seccomp profile will be applied.
- Valid options are:
-
- Localhost - a profile defined in a file on the node should be used.
- RuntimeDefault - the container runtime default profile should be used.
- Unconfined - no profile should be applied.
- type: string
- supplementalGroups:
- description: |-
- A list of groups applied to the first process run in each container, in addition
- to the container's primary GID, the fsGroup (if specified), and group memberships
- defined in the container image for the uid of the container process. If unspecified,
- no additional groups are added to any container. Note that group memberships
- defined in the container image for the uid of the container process are still effective,
- even if they are not included in this list.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- type: integer
- format: int64
- sysctls:
- description: |-
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
- sysctls (by the container runtime) might fail to launch.
- Note that this field cannot be set when spec.os.name is windows.
- type: array
- items:
- description: Sysctl defines a kernel parameter to be set
- type: object
- required:
- - name
- - value
- properties:
- name:
- description: Name of a property to set
- type: string
- value:
- description: Value of a property to set
- type: string
- serviceAccountName:
- description: If specified, the pod's service account
- type: string
- tolerations:
- description: If specified, the pod's tolerations.
- type: array
- items:
- description: |-
- The pod this Toleration is attached to tolerates any taint that matches
- the triple <key,value,effect> using the matching operator <operator>.
- type: object
- properties:
- effect:
- description: |-
- Effect indicates the taint effect to match. Empty means match all taint effects.
- When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
- type: string
- key:
- description: |-
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
- If the key is empty, operator must be Exists; this combination means to match all values and all keys.
- type: string
- operator:
- description: |-
- Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
- Exists is equivalent to wildcard for value, so that a pod can
- tolerate all taints of a particular category.
- type: string
- tolerationSeconds:
- description: |-
- TolerationSeconds represents the period of time the toleration (which must be
- of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
- it is not set, which means tolerate the taint forever (do not evict). Zero and
- negative values will be treated as 0 (evict immediately) by the system.
- type: integer
- format: int64
- value:
- description: |-
- Value is the taint value the toleration matches to.
- If the operator is Exists, the value should be empty, otherwise just a regular string.
- type: string
- serviceType:
- description: |-
- Optional service type for Kubernetes solver service. Supported values
- are NodePort or ClusterIP. If unset, defaults to NodePort.
- type: string
- selector:
- description: |-
- Selector selects a set of DNSNames on the Certificate resource that
- should be solved using this challenge solver.
- If not specified, the solver will be treated as the 'default' solver
- with the lowest priority, i.e. if any other solver has a more specific
- match, it will be used instead.
- type: object
- properties:
- dnsNames:
- description: |-
- List of DNSNames that this solver will be used to solve.
- If specified and a match is found, a dnsNames selector will take
- precedence over a dnsZones selector.
- If multiple solvers match with the same dnsNames value, the solver
- with the most matching labels in matchLabels will be selected.
- If neither has more matches, the solver defined earlier in the list
- will be selected.
- type: array
- items:
- type: string
- dnsZones:
- description: |-
- List of DNSZones that this solver will be used to solve.
- The most specific DNS zone match specified here will take precedence
- over other DNS zone matches, so a solver specifying sys.example.com
- will be selected over one specifying example.com for the domain
- www.sys.example.com.
- If multiple solvers match with the same dnsZones value, the solver
- with the most matching labels in matchLabels will be selected.
- If neither has more matches, the solver defined earlier in the list
- will be selected.
- type: array
- items:
- type: string
- matchLabels:
- description: |-
- A label selector that is used to refine the set of certificate's that
- this challenge solver will apply to.
- type: object
- additionalProperties:
- type: string
- ca:
- description: |-
- CA configures this issuer to sign certificates using a signing CA keypair
- stored in a Secret resource.
- This is used to build internal PKIs that are managed by cert-manager.
- type: object
- required:
- - secretName
- properties:
- crlDistributionPoints:
- description: |-
- The CRL distribution points is an X.509 v3 certificate extension which identifies
- the location of the CRL from which the revocation of this certificate can be checked.
- If not set, certificates will be issued without distribution points set.
- type: array
- items:
- type: string
- issuingCertificateURLs:
- description: |-
- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
- it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
- As an example, such a URL might be "http://ca.domain.com/ca.crt".
- type: array
- items:
- type: string
- ocspServers:
- description: |-
- The OCSP server list is an X.509 v3 extension that defines a list of
- URLs of OCSP responders. The OCSP responders can be queried for the
- revocation status of an issued certificate. If not set, the
- certificate will be issued with no OCSP servers set. For example, an
- OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
- type: array
- items:
- type: string
- secretName:
- description: |-
- SecretName is the name of the secret used to sign Certificates issued
- by this Issuer.
- type: string
- selfSigned:
- description: |-
- SelfSigned configures this issuer to 'self sign' certificates using the
- private key used to create the CertificateRequest object.
- type: object
- properties:
- crlDistributionPoints:
- description: |-
- The CRL distribution points is an X.509 v3 certificate extension which identifies
- the location of the CRL from which the revocation of this certificate can be checked.
- If not set certificate will be issued without CDP. Values are strings.
- type: array
- items:
- type: string
- vault:
- description: |-
- Vault configures this issuer to sign certificates using a HashiCorp Vault
- PKI backend.
- type: object
- required:
- - auth
- - path
- - server
- properties:
- auth:
- description: Auth configures how cert-manager authenticates with the Vault server.
- type: object
- properties:
- appRole:
- description: |-
- AppRole authenticates with Vault using the App Role auth mechanism,
- with the role and secret stored in a Kubernetes Secret resource.
- type: object
- required:
- - path
- - roleId
- - secretRef
- properties:
- path:
- description: |-
- Path where the App Role authentication backend is mounted in Vault, e.g:
- "approle"
- type: string
- roleId:
- description: |-
- RoleID configured in the App Role authentication backend when setting
- up the authentication backend in Vault.
- type: string
- secretRef:
- description: |-
- Reference to a key in a Secret that contains the App Role secret used
- to authenticate with Vault.
- The `key` field must be specified and denotes which entry within the Secret
- resource is used as the app role secret.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientCertificate:
- description: |-
- ClientCertificate authenticates with Vault by presenting a client
- certificate during the request's TLS handshake.
- Works only when using HTTPS protocol.
- type: object
- properties:
- mountPath:
- description: |-
- The Vault mountPath here is the mount path to use when authenticating with
- Vault. For example, setting a value to `/v1/auth/foo`, will use the path
- `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
- default value "/v1/auth/cert" will be used.
- type: string
- name:
- description: |-
- Name of the certificate role to authenticate against.
- If not set, matching any certificate role, if available.
- type: string
- secretName:
- description: |-
- Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
- tls.crt and tls.key) used to authenticate to Vault using TLS client
- authentication.
- type: string
- kubernetes:
- description: |-
- Kubernetes authenticates with Vault by passing the ServiceAccount
- token stored in the named Secret resource to the Vault server.
- type: object
- required:
- - role
- properties:
- mountPath:
- description: |-
- The Vault mountPath here is the mount path to use when authenticating with
- Vault. For example, setting a value to `/v1/auth/foo`, will use the path
- `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
- default value "/v1/auth/kubernetes" will be used.
- type: string
- role:
- description: |-
- A required field containing the Vault Role to assume. A Role binds a
- Kubernetes ServiceAccount with a set of Vault policies.
- type: string
- secretRef:
- description: |-
- The required Secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with Vault. Use of 'ambient credentials' is not
- supported.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- serviceAccountRef:
- description: |-
- A reference to a service account that will be used to request a bound
- token (also known as "projected token"). Compared to using "secretRef",
- using this field means that you don't rely on statically bound tokens. To
- use this field, you must configure an RBAC rule to let cert-manager
- request a token.
- type: object
- required:
- - name
- properties:
- audiences:
- description: |-
- TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
- consisting of the issuer's namespace and name is always included.
- type: array
- items:
- type: string
- name:
- description: Name of the ServiceAccount used to request a token.
- type: string
- tokenSecretRef:
- description: TokenSecretRef authenticates with Vault by presenting a token.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- caBundle:
- description: |-
- Base64-encoded bundle of PEM CAs which will be used to validate the certificate
- chain presented by Vault. Only used if using HTTPS to connect to Vault and
- ignored for HTTP connections.
- Mutually exclusive with CABundleSecretRef.
- If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
- the cert-manager controller container is used to validate the TLS connection.
- type: string
- format: byte
- caBundleSecretRef:
- description: |-
- Reference to a Secret containing a bundle of PEM-encoded CAs to use when
- verifying the certificate chain presented by Vault when using HTTPS.
- Mutually exclusive with CABundle.
- If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
- the cert-manager controller container is used to validate the TLS connection.
- If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientCertSecretRef:
- description: |-
- Reference to a Secret containing a PEM-encoded Client Certificate to use when the
- Vault server requires mTLS.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- clientKeySecretRef:
- description: |-
- Reference to a Secret containing a PEM-encoded Client Private Key to use when the
- Vault server requires mTLS.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- namespace:
- description: |-
- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
- More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
- type: string
- path:
- description: |-
- Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
- "my_pki_mount/sign/my-role-name".
- type: string
- server:
- description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
- type: string
- serverName:
- description: |-
- ServerName is used to verify the hostname on the returned certificates
- by the Vault server.
- type: string
- venafi:
- description: |-
- Venafi configures this issuer to sign certificates using a Venafi TPP
- or Venafi Cloud policy zone.
- type: object
- required:
- - zone
- properties:
- cloud:
- description: |-
- Cloud specifies the Venafi cloud configuration settings.
- Only one of TPP or Cloud may be specified.
- type: object
- required:
- - apiTokenSecretRef
- properties:
- apiTokenSecretRef:
- description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- url:
- description: |-
- URL is the base URL for Venafi Cloud.
- Defaults to "https://api.venafi.cloud/".
- type: string
- tpp:
- description: |-
- TPP specifies Trust Protection Platform configuration settings.
- Only one of TPP or Cloud may be specified.
- type: object
- required:
- - credentialsRef
- - url
- properties:
- caBundle:
- description: |-
- Base64-encoded bundle of PEM CAs which will be used to validate the certificate
- chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
- If undefined, the certificate bundle in the cert-manager controller container
- is used to validate the chain.
- type: string
- format: byte
- caBundleSecretRef:
- description: |-
- Reference to a Secret containing a base64-encoded bundle of PEM CAs
- which will be used to validate the certificate chain presented by the TPP server.
- Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
- If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
- the cert-manager controller container is used to validate the TLS connection.
- type: object
- required:
- - name
- properties:
- key:
- description: |-
- The key of the entry in the Secret resource's `data` field to be used.
- Some instances of this field may be defaulted, in others it may be
- required.
- type: string
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- credentialsRef:
- description: |-
- CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
- The secret must contain the key 'access-token' for the Access Token Authentication,
- or two keys, 'username' and 'password' for the API Keys Authentication.
- type: object
- required:
- - name
- properties:
- name:
- description: |-
- Name of the resource being referred to.
- More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
- type: string
- url:
- description: |-
- URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
- for example: "https://tpp.example.com/vedsdk".
- type: string
- zone:
- description: |-
- Zone is the Venafi Policy Zone to use for this issuer.
- All requests made to the Venafi platform will be restricted by the named
- zone policy.
- This field is required.
- type: string
- status:
- description: Status of the Issuer. This is set and managed automatically.
- type: object
- properties:
- acme:
- description: |-
- ACME specific status options.
- This field should only be set if the Issuer is configured to use an ACME
- server to issue certificates.
- type: object
- properties:
- lastPrivateKeyHash:
- description: |-
- LastPrivateKeyHash is a hash of the private key associated with the latest
- registered ACME account, in order to track changes made to registered account
- associated with the Issuer
- type: string
- lastRegisteredEmail:
- description: |-
- LastRegisteredEmail is the email associated with the latest registered
- ACME account, in order to track changes made to registered account
- associated with the Issuer
- type: string
- uri:
- description: |-
- URI is the unique account identifier, which can also be used to retrieve
- account details from the CA
- type: string
- conditions:
- description: |-
- List of status conditions to indicate the status of a CertificateRequest.
- Known condition types are `Ready`.
- type: array
- items:
- description: IssuerCondition contains condition information for an Issuer.
- type: object
- required:
- - status
- - type
- properties:
- lastTransitionTime:
- description: |-
- LastTransitionTime is the timestamp corresponding to the last status
- change of this condition.
- type: string
- format: date-time
- message:
- description: |-
- Message is a human readable description of the details of the last
- transition, complementing reason.
- type: string
- observedGeneration:
- description: |-
- If set, this represents the .metadata.generation that the condition was
- set based upon.
- For instance, if .metadata.generation is currently 12, but the
- .status.condition[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the Issuer.
- type: integer
- format: int64
- reason:
- description: |-
- Reason is a brief machine readable explanation for the condition's last
- transition.
- type: string
- status:
- description: Status of the condition, one of (`True`, `False`, `Unknown`).
- type: string
- enum:
- - "True"
- - "False"
- - Unknown
- type:
- description: Type of the condition, known values are (`Ready`).
- type: string
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- served: true
- storage: true
-
-# END crd {{- end }}
-
----
-# START crd {{- if or .Values.crds.enabled .Values.installCRDs }}
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- name: orders.acme.cert-manager.io
- # START annotations {{- if .Values.crds.keep }}
- annotations:
- helm.sh/resource-policy: keep
- # END annotations {{- end }}
- labels:
- app: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
- app.kubernetes.io/instance: '{{ .Release.Name }}'
- app.kubernetes.io/component: "crds"
- # Generated labels {{- include "labels" . | nindent 4 }}
-spec:
- group: acme.cert-manager.io
- names:
- kind: Order
- listKind: OrderList
- plural: orders
- singular: order
- categories:
- - cert-manager
- - cert-manager-acme
- scope: Namespaced
- versions:
- - name: v1
- subresources:
- status: {}
- additionalPrinterColumns:
- - jsonPath: .status.state
- name: State
- type: string
- - jsonPath: .spec.issuerRef.name
- name: Issuer
- priority: 1
- type: string
- - jsonPath: .status.reason
- name: Reason
- priority: 1
- type: string
- - jsonPath: .metadata.creationTimestamp
- description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
- name: Age
- type: date
- schema:
- openAPIV3Schema:
- description: Order is a type to represent an Order with an ACME server
- type: object
- required:
- - metadata
- - spec
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- type: object
- required:
- - issuerRef
- - request
- properties:
- commonName:
- description: |-
- CommonName is the common name as specified on the DER encoded CSR.
- If specified, this value must also be present in `dnsNames` or `ipAddresses`.
- This field must match the corresponding field on the DER encoded CSR.
- type: string
- dnsNames:
- description: |-
- DNSNames is a list of DNS names that should be included as part of the Order
- validation process.
- This field must match the corresponding field on the DER encoded CSR.
- type: array
- items:
- type: string
- duration:
- description: |-
- Duration is the duration for the not after date for the requested certificate.
- this is set on order creation as pe the ACME spec.
- type: string
- ipAddresses:
- description: |-
- IPAddresses is a list of IP addresses that should be included as part of the Order
- validation process.
- This field must match the corresponding field on the DER encoded CSR.
- type: array
- items:
- type: string
- issuerRef:
- description: |-
- IssuerRef references a properly configured ACME-type Issuer which should
- be used to create this Order.
- If the Issuer does not exist, processing will be retried.
- If the Issuer is not an 'ACME' Issuer, an error will be returned and the
- Order will be marked as failed.
- type: object
- required:
- - name
- properties:
- group:
- description: Group of the resource being referred to.
- type: string
- kind:
- description: Kind of the resource being referred to.
- type: string
- name:
- description: Name of the resource being referred to.
- type: string
- profile:
- description: |-
- Profile allows requesting a certificate profile from the ACME server.
- Supported profiles are listed by the server's ACME directory URL.
- type: string
- request:
- description: |-
- Certificate signing request bytes in DER encoding.
- This will be used when finalizing the order.
- This field must be set on the order.
- type: string
- format: byte
- status:
- type: object
- properties:
- authorizations:
- description: |-
- Authorizations contains data returned from the ACME server on what
- authorizations must be completed in order to validate the DNS names
- specified on the Order.
- type: array
- items:
- description: |-
- ACMEAuthorization contains data returned from the ACME server on an
- authorization that must be completed in order validate a DNS name on an ACME
- Order resource.
- type: object
- required:
- - url
- properties:
- challenges:
- description: |-
- Challenges specifies the challenge types offered by the ACME server.
- One of these challenge types will be selected when validating the DNS
- name and an appropriate Challenge resource will be created to perform
- the ACME challenge process.
- type: array
- items:
- description: |-
- Challenge specifies a challenge offered by the ACME server for an Order.
- An appropriate Challenge resource can be created to perform the ACME
- challenge process.
- type: object
- required:
- - token
- - type
- - url
- properties:
- token:
- description: |-
- Token is the token that must be presented for this challenge.
- This is used to compute the 'key' that must also be presented.
- type: string
- type:
- description: |-
- Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
- 'tls-sni-01', etc.
- This is the raw value retrieved from the ACME server.
- Only 'http-01' and 'dns-01' are supported by cert-manager, other values
- will be ignored.
- type: string
- url:
- description: |-
- URL is the URL of this challenge. It can be used to retrieve additional
- metadata about the Challenge from the ACME server.
- type: string
- identifier:
- description: Identifier is the DNS name to be validated as part of this authorization
- type: string
- initialState:
- description: |-
- InitialState is the initial state of the ACME authorization when first
- fetched from the ACME server.
- If an Authorization is already 'valid', the Order controller will not
- create a Challenge resource for the authorization. This will occur when
- working with an ACME server that enables 'authz reuse' (such as Let's
- Encrypt's production endpoint).
- If not set and 'identifier' is set, the state is assumed to be pending
- and a Challenge will be created.
- type: string
- enum:
- - valid
- - ready
- - pending
- - processing
- - invalid
- - expired
- - errored
- url:
- description: URL is the URL of the Authorization that must be completed
- type: string
- wildcard:
- description: |-
- Wildcard will be true if this authorization is for a wildcard DNS name.
- If this is true, the identifier will be the *non-wildcard* version of
- the DNS name.
- For example, if '*.example.com' is the DNS name being validated, this
- field will be 'true' and the 'identifier' field will be 'example.com'.
- type: boolean
- certificate:
- description: |-
- Certificate is a copy of the PEM encoded certificate for this Order.
- This field will be populated after the order has been successfully
- finalized with the ACME server, and the order has transitioned to the
- 'valid' state.
- type: string
- format: byte
- failureTime:
- description: |-
- FailureTime stores the time that this order failed.
- This is used to influence garbage collection and back-off.
- type: string
- format: date-time
- finalizeURL:
- description: |-
- FinalizeURL of the Order.
- This is used to obtain certificates for this order once it has been completed.
- type: string
- reason:
- description: |-
- Reason optionally provides more information about a why the order is in
- the current state.
- type: string
- state:
- description: |-
- State contains the current state of this Order resource.
- States 'success' and 'expired' are 'final'
- type: string
- enum:
- - valid
- - ready
- - pending
- - processing
- - invalid
- - expired
- - errored
- url:
- description: |-
- URL of the Order.
- This will initially be empty when the resource is first created.
- The Order controller will populate this field when the Order is first processed.
- This field will be immutable after it is initially set.
- type: string
- served: true
- storage: true
-
-# END crd {{- end }}
diff --git a/charts/cert-manager/templates/deployment.yaml b/charts/cert-manager/templates/deployment.yaml
index b1af927..453e823 100644
--- a/charts/cert-manager/templates/deployment.yaml
+++ b/charts/cert-manager/templates/deployment.yaml
@@ -66,6 +66,9 @@
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
+ {{- if (hasKey .Values.global "hostUsers") }}
+ hostUsers: {{ .Values.global.hostUsers }}
+ {{- end }}
{{- with .Values.securityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
@@ -209,7 +212,9 @@
failureThreshold: {{ .failureThreshold }}
{{- end }}
{{- end }}
- {{- with .Values.nodeSelector }}
+ {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+ {{- $nodeSelector = merge $nodeSelector (.Values.nodeSelector | default dict) }}
+ {{- with $nodeSelector }}
nodeSelector:
{{- range $key, $value := . }}
{{ $key }}: {{ $value | quote }}
@@ -236,4 +241,4 @@
{{- end }}
{{- with .Values.hostAliases }}
hostAliases: {{ toYaml . | nindent 8 }}
- {{- end }}
\ No newline at end of file
+ {{- end }}
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index baae425..076fd05 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -49,7 +49,7 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
- name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ name: {{ template "cert-manager.fullname" . }}-tokenrequest
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
@@ -69,7 +69,7 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
- name: {{ include "cert-manager.fullname" . }}-{{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ name: {{ include "cert-manager.fullname" . }}-tokenrequest
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
@@ -80,7 +80,7 @@
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
- name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ name: {{ template "cert-manager.fullname" . }}-tokenrequest
subjects:
- kind: ServiceAccount
name: {{ template "cert-manager.serviceAccountName" . }}
@@ -256,8 +256,8 @@
- apiGroups: ["networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
- - apiGroups: [ "gateway.networking.k8s.io" ]
- resources: [ "httproutes" ]
+ - apiGroups: ["gateway.networking.k8s.io"]
+ resources: ["httproutes"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
# We require the ability to specify a custom hostname when we are creating
# new ingress resources.
@@ -511,9 +511,23 @@
- apiGroups: ["cert-manager.io"]
resources: ["certificates/status"]
verbs: ["update"]
+ {{- /*
+ Challenge and Order resources are not intended to be created or
+ modified directly by users.
+
+ Challenges: "create" is excluded. "patch" and "update" are retained
+ because spec is immutable after creation (ValidateChallengeUpdate)
+ and because users need them to remove stuck finalizers
+ (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
+
+ Orders: "create", "patch", and "update" are excluded.
+ */}}
- apiGroups: ["acme.cert-manager.io"]
- resources: ["challenges", "orders"]
- verbs: ["create", "delete", "deletecollection", "patch", "update"]
+ resources: ["challenges"]
+ verbs: ["delete", "deletecollection", "patch", "update"]
+ - apiGroups: ["acme.cert-manager.io"]
+ resources: ["orders"]
+ verbs: ["delete", "deletecollection"]
---
diff --git a/charts/cert-manager/templates/startupapicheck-job.yaml b/charts/cert-manager/templates/startupapicheck-job.yaml
index 606cc1e..f68d540 100644
--- a/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -41,6 +41,9 @@
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
+ {{- if (hasKey .Values.global "hostUsers") }}
+ hostUsers: {{ .Values.global.hostUsers }}
+ {{- end }}
{{- with .Values.startupapicheck.securityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
@@ -76,7 +79,9 @@
volumeMounts:
{{- toYaml . | nindent 12 }}
{{- end }}
- {{- with .Values.startupapicheck.nodeSelector }}
+ {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+ {{- $nodeSelector = merge $nodeSelector (.Values.startupapicheck.nodeSelector | default dict) }}
+ {{- with $nodeSelector }}
nodeSelector:
{{- range $key, $value := . }}
{{ $key }}: {{ $value | quote }}
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index f237c2d..d2b10ae 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -66,6 +66,9 @@
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
+ {{- if (hasKey .Values.global "hostUsers") }}
+ hostUsers: {{ .Values.global.hostUsers }}
+ {{- end }}
{{- with .Values.webhook.securityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
@@ -102,7 +105,7 @@
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE)
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE).svc
- {{ if .Values.webhook.url.host }}
+ {{- if .Values.webhook.url.host }}
- --dynamic-serving-dns-names={{ .Values.webhook.url.host }}
{{- end }}
{{- end }}
@@ -180,7 +183,9 @@
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
- {{- with .Values.webhook.nodeSelector }}
+ {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+ {{- $nodeSelector = merge $nodeSelector (.Values.webhook.nodeSelector | default dict) }}
+ {{- with $nodeSelector }}
nodeSelector:
{{- range $key, $value := . }}
{{ $key }}: {{ $value | quote }}