Gitiles
Code Review Sign In
code.v1.dodo.cloud / pcloud / 15aa6635e26a1a6c4b9d6dccfd96d6e0c7a3f723 / . / charts / cert-manager-1.19.6 / templates / crd-cert-manager.io_clusterissuers.yaml
blob: a9ecd4f7e241f7d180987d54d8ca4316758fbe1f [file] [log] [blame]
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "clusterissuers.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: ClusterIssuer
18 listKind: ClusterIssuerList
19 plural: clusterissuers
20 shortNames:
21 - ciss
22 singular: clusterissuer
23 scope: Cluster
24 versions:
25 - additionalPrinterColumns:
26 - jsonPath: .status.conditions[?(@.type == "Ready")].status
27 name: Ready
28 type: string
29 - jsonPath: .status.conditions[?(@.type == "Ready")].message
30 name: Status
31 priority: 1
32 type: string
33 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
34 jsonPath: .metadata.creationTimestamp
35 name: Age
36 type: date
37 name: v1
38 schema:
39 openAPIV3Schema:
40 description: |-
41 A ClusterIssuer represents a certificate issuing authority which can be
42 referenced as part of `issuerRef` fields.
43 It is similar to an Issuer, however it is cluster-scoped and therefore can
44 be referenced by resources that exist in *any* namespace, not just the same
45 namespace as the referent.
46 properties:
47 apiVersion:
48 description: |-
49 APIVersion defines the versioned schema of this representation of an object.
50 Servers should convert recognized schemas to the latest internal value, and
51 may reject unrecognized values.
52 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
53 type: string
54 kind:
55 description: |-
56 Kind is a string value representing the REST resource this object represents.
57 Servers may infer this from the endpoint the client submits requests to.
58 Cannot be updated.
59 In CamelCase.
60 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
61 type: string
62 metadata:
63 type: object
64 spec:
65 description: Desired state of the ClusterIssuer resource.
66 properties:
67 acme:
68 description: |-
69 ACME configures this issuer to communicate with a RFC8555 (ACME) server
70 to obtain signed x509 certificates.
71 properties:
72 caBundle:
73 description: |-
74 Base64-encoded bundle of PEM CAs which can be used to validate the certificate
75 chain presented by the ACME server.
76 Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
77 kinds of security vulnerabilities.
78 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
79 the container is used to validate the TLS connection.
80 format: byte
81 type: string
82 disableAccountKeyGeneration:
83 description: |-
84 Enables or disables generating a new ACME account key.
85 If true, the Issuer resource will *not* request a new account but will expect
86 the account key to be supplied via an existing secret.
87 If false, the cert-manager system will generate a new ACME account key
88 for the Issuer.
89 Defaults to false.
90 type: boolean
91 email:
92 description: |-
93 Email is the email address to be associated with the ACME account.
94 This field is optional, but it is strongly recommended to be set.
95 It will be used to contact you in case of issues with your account or
96 certificates, including expiry notification emails.
97 This field may be updated after the account is initially registered.
98 type: string
99 enableDurationFeature:
100 description: |-
101 Enables requesting a Not After date on certificates that matches the
102 duration of the certificate. This is not supported by all ACME servers
103 like Let's Encrypt. If set to true when the ACME server does not support
104 it, it will create an error on the Order.
105 Defaults to false.
106 type: boolean
107 externalAccountBinding:
108 description: |-
109 ExternalAccountBinding is a reference to a CA external account of the ACME
110 server.
111 If set, upon registration cert-manager will attempt to associate the given
112 external account credentials with the registered ACME account.
113 properties:
114 keyAlgorithm:
115 description: |-
116 Deprecated: keyAlgorithm field exists for historical compatibility
117 reasons and should not be used. The algorithm is now hardcoded to HS256
118 in golang/x/crypto/acme.
119 enum:
120 - HS256
121 - HS384
122 - HS512
123 type: string
124 keyID:
125 description: keyID is the ID of the CA key that the External Account is bound to.
126 type: string
127 keySecretRef:
128 description: |-
129 keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
130 Secret which holds the symmetric MAC key of the External Account Binding.
131 The `key` is the index string that is paired with the key data in the
132 Secret and should not be confused with the key data itself, or indeed with
133 the External Account Binding keyID above.
134 The secret key stored in the Secret **must** be un-padded, base64 URL
135 encoded data.
136 properties:
137 key:
138 description: |-
139 The key of the entry in the Secret resource's `data` field to be used.
140 Some instances of this field may be defaulted, in others it may be
141 required.
142 type: string
143 name:
144 description: |-
145 Name of the resource being referred to.
146 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
147 type: string
148 required:
149 - name
150 type: object
151 required:
152 - keyID
153 - keySecretRef
154 type: object
155 preferredChain:
156 description: |-
157 PreferredChain is the chain to use if the ACME server outputs multiple.
158 PreferredChain is no guarantee that this one gets delivered by the ACME
159 endpoint.
160 For example, for Let's Encrypt's DST cross-sign you would use:
161 "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
162 This value picks the first certificate bundle in the combined set of
163 ACME default and alternative chains that has a root-most certificate with
164 this value as its issuer's commonname.
165 maxLength: 64
166 type: string
167 privateKeySecretRef:
168 description: |-
169 PrivateKey is the name of a Kubernetes Secret resource that will be used to
170 store the automatically generated ACME account private key.
171 Optionally, a `key` may be specified to select a specific entry within
172 the named Secret resource.
173 If `key` is not specified, a default of `tls.key` will be used.
174 properties:
175 key:
176 description: |-
177 The key of the entry in the Secret resource's `data` field to be used.
178 Some instances of this field may be defaulted, in others it may be
179 required.
180 type: string
181 name:
182 description: |-
183 Name of the resource being referred to.
184 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
185 type: string
186 required:
187 - name
188 type: object
189 profile:
190 description: |-
191 Profile allows requesting a certificate profile from the ACME server.
192 Supported profiles are listed by the server's ACME directory URL.
193 type: string
194 server:
195 description: |-
196 Server is the URL used to access the ACME server's 'directory' endpoint.
197 For example, for Let's Encrypt's staging endpoint, you would use:
198 "https://acme-staging-v02.api.letsencrypt.org/directory".
199 Only ACME v2 endpoints (i.e. RFC 8555) are supported.
200 type: string
201 skipTLSVerify:
202 description: |-
203 INSECURE: Enables or disables validation of the ACME server TLS certificate.
204 If true, requests to the ACME server will not have the TLS certificate chain
205 validated.
206 Mutually exclusive with CABundle; prefer using CABundle to prevent various
207 kinds of security vulnerabilities.
208 Only enable this option in development environments.
209 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
210 the container is used to validate the TLS connection.
211 Defaults to false.
212 type: boolean
213 solvers:
214 description: |-
215 Solvers is a list of challenge solvers that will be used to solve
216 ACME challenges for the matching domains.
217 Solver configurations must be provided in order to obtain certificates
218 from an ACME server.
219 For more information, see: https://cert-manager.io/docs/configuration/acme/
220 items:
221 description: |-
222 An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
223 A selector may be provided to use different solving strategies for different DNS names.
224 Only one of HTTP01 or DNS01 must be provided.
225 properties:
226 dns01:
227 description: |-
228 Configures cert-manager to attempt to complete authorizations by
229 performing the DNS01 challenge flow.
230 properties:
231 acmeDNS:
232 description: |-
233 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
234 DNS01 challenge records.
235 properties:
236 accountSecretRef:
237 description: |-
238 A reference to a specific 'key' within a Secret resource.
239 In some instances, `key` is a required field.
240 properties:
241 key:
242 description: |-
243 The key of the entry in the Secret resource's `data` field to be used.
244 Some instances of this field may be defaulted, in others it may be
245 required.
246 type: string
247 name:
248 description: |-
249 Name of the resource being referred to.
250 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
251 type: string
252 required:
253 - name
254 type: object
255 host:
256 type: string
257 required:
258 - accountSecretRef
259 - host
260 type: object
261 akamai:
262 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
263 properties:
264 accessTokenSecretRef:
265 description: |-
266 A reference to a specific 'key' within a Secret resource.
267 In some instances, `key` is a required field.
268 properties:
269 key:
270 description: |-
271 The key of the entry in the Secret resource's `data` field to be used.
272 Some instances of this field may be defaulted, in others it may be
273 required.
274 type: string
275 name:
276 description: |-
277 Name of the resource being referred to.
278 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
279 type: string
280 required:
281 - name
282 type: object
283 clientSecretSecretRef:
284 description: |-
285 A reference to a specific 'key' within a Secret resource.
286 In some instances, `key` is a required field.
287 properties:
288 key:
289 description: |-
290 The key of the entry in the Secret resource's `data` field to be used.
291 Some instances of this field may be defaulted, in others it may be
292 required.
293 type: string
294 name:
295 description: |-
296 Name of the resource being referred to.
297 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
298 type: string
299 required:
300 - name
301 type: object
302 clientTokenSecretRef:
303 description: |-
304 A reference to a specific 'key' within a Secret resource.
305 In some instances, `key` is a required field.
306 properties:
307 key:
308 description: |-
309 The key of the entry in the Secret resource's `data` field to be used.
310 Some instances of this field may be defaulted, in others it may be
311 required.
312 type: string
313 name:
314 description: |-
315 Name of the resource being referred to.
316 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
317 type: string
318 required:
319 - name
320 type: object
321 serviceConsumerDomain:
322 type: string
323 required:
324 - accessTokenSecretRef
325 - clientSecretSecretRef
326 - clientTokenSecretRef
327 - serviceConsumerDomain
328 type: object
329 azureDNS:
330 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
331 properties:
332 clientID:
333 description: |-
334 Auth: Azure Service Principal:
335 The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
336 If set, ClientSecret and TenantID must also be set.
337 type: string
338 clientSecretSecretRef:
339 description: |-
340 Auth: Azure Service Principal:
341 A reference to a Secret containing the password associated with the Service Principal.
342 If set, ClientID and TenantID must also be set.
343 properties:
344 key:
345 description: |-
346 The key of the entry in the Secret resource's `data` field to be used.
347 Some instances of this field may be defaulted, in others it may be
348 required.
349 type: string
350 name:
351 description: |-
352 Name of the resource being referred to.
353 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
354 type: string
355 required:
356 - name
357 type: object
358 environment:
359 description: name of the Azure environment (default AzurePublicCloud)
360 enum:
361 - AzurePublicCloud
362 - AzureChinaCloud
363 - AzureGermanCloud
364 - AzureUSGovernmentCloud
365 type: string
366 hostedZoneName:
367 description: name of the DNS zone that should be used
368 type: string
369 managedIdentity:
370 description: |-
371 Auth: Azure Workload Identity or Azure Managed Service Identity:
372 Settings to enable Azure Workload Identity or Azure Managed Service Identity
373 If set, ClientID, ClientSecret and TenantID must not be set.
374 properties:
375 clientID:
376 description: client ID of the managed identity, cannot be used at the same time as resourceID
377 type: string
378 resourceID:
379 description: |-
380 resource ID of the managed identity, cannot be used at the same time as clientID
381 Cannot be used for Azure Managed Service Identity
382 type: string
383 tenantID:
384 description: tenant ID of the managed identity, cannot be used at the same time as resourceID
385 type: string
386 type: object
387 resourceGroupName:
388 description: resource group the DNS zone is located in
389 type: string
390 subscriptionID:
391 description: ID of the Azure subscription
392 type: string
393 tenantID:
394 description: |-
395 Auth: Azure Service Principal:
396 The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
397 If set, ClientID and ClientSecret must also be set.
398 type: string
399 required:
400 - resourceGroupName
401 - subscriptionID
402 type: object
403 cloudDNS:
404 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
405 properties:
406 hostedZoneName:
407 description: |-
408 HostedZoneName is an optional field that tells cert-manager in which
409 Cloud DNS zone the challenge record has to be created.
410 If left empty cert-manager will automatically choose a zone.
411 type: string
412 project:
413 type: string
414 serviceAccountSecretRef:
415 description: |-
416 A reference to a specific 'key' within a Secret resource.
417 In some instances, `key` is a required field.
418 properties:
419 key:
420 description: |-
421 The key of the entry in the Secret resource's `data` field to be used.
422 Some instances of this field may be defaulted, in others it may be
423 required.
424 type: string
425 name:
426 description: |-
427 Name of the resource being referred to.
428 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
429 type: string
430 required:
431 - name
432 type: object
433 required:
434 - project
435 type: object
436 cloudflare:
437 description: Use the Cloudflare API to manage DNS01 challenge records.
438 properties:
439 apiKeySecretRef:
440 description: |-
441 API key to use to authenticate with Cloudflare.
442 Note: using an API token to authenticate is now the recommended method
443 as it allows greater control of permissions.
444 properties:
445 key:
446 description: |-
447 The key of the entry in the Secret resource's `data` field to be used.
448 Some instances of this field may be defaulted, in others it may be
449 required.
450 type: string
451 name:
452 description: |-
453 Name of the resource being referred to.
454 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
455 type: string
456 required:
457 - name
458 type: object
459 apiTokenSecretRef:
460 description: API token used to authenticate with Cloudflare.
461 properties:
462 key:
463 description: |-
464 The key of the entry in the Secret resource's `data` field to be used.
465 Some instances of this field may be defaulted, in others it may be
466 required.
467 type: string
468 name:
469 description: |-
470 Name of the resource being referred to.
471 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
472 type: string
473 required:
474 - name
475 type: object
476 email:
477 description: Email of the account, only required when using API key based authentication.
478 type: string
479 type: object
480 cnameStrategy:
481 description: |-
482 CNAMEStrategy configures how the DNS01 provider should handle CNAME
483 records when found in DNS zones.
484 enum:
485 - None
486 - Follow
487 type: string
488 digitalocean:
489 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
490 properties:
491 tokenSecretRef:
492 description: |-
493 A reference to a specific 'key' within a Secret resource.
494 In some instances, `key` is a required field.
495 properties:
496 key:
497 description: |-
498 The key of the entry in the Secret resource's `data` field to be used.
499 Some instances of this field may be defaulted, in others it may be
500 required.
501 type: string
502 name:
503 description: |-
504 Name of the resource being referred to.
505 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
506 type: string
507 required:
508 - name
509 type: object
510 required:
511 - tokenSecretRef
512 type: object
513 rfc2136:
514 description: |-
515 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
516 to manage DNS01 challenge records.
517 properties:
518 nameserver:
519 description: |-
520 The IP address or hostname of an authoritative DNS server supporting
521 RFC2136 in the form host:port. If the host is an IPv6 address it must be
522 enclosed in square brackets (e.g [2001:db8::1]); port is optional.
523 This field is required.
524 type: string
525 protocol:
526 description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
527 enum:
528 - TCP
529 - UDP
530 type: string
531 tsigAlgorithm:
532 description: |-
533 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
534 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
535 Supported values are (case-insensitive): ``HMACMD5`` (default),
536 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
537 type: string
538 tsigKeyName:
539 description: |-
540 The TSIG Key name configured in the DNS.
541 If ``tsigSecretSecretRef`` is defined, this field is required.
542 type: string
543 tsigSecretSecretRef:
544 description: |-
545 The name of the secret containing the TSIG value.
546 If ``tsigKeyName`` is defined, this field is required.
547 properties:
548 key:
549 description: |-
550 The key of the entry in the Secret resource's `data` field to be used.
551 Some instances of this field may be defaulted, in others it may be
552 required.
553 type: string
554 name:
555 description: |-
556 Name of the resource being referred to.
557 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
558 type: string
559 required:
560 - name
561 type: object
562 required:
563 - nameserver
564 type: object
565 route53:
566 description: Use the AWS Route53 API to manage DNS01 challenge records.
567 properties:
568 accessKeyID:
569 description: |-
570 The AccessKeyID is used for authentication.
571 Cannot be set when SecretAccessKeyID is set.
572 If neither the Access Key nor Key ID are set, we fall-back to using env
573 vars, shared credentials file or AWS Instance metadata,
574 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
575 type: string
576 accessKeyIDSecretRef:
577 description: |-
578 The SecretAccessKey is used for authentication. If set, pull the AWS
579 access key ID from a key within a Kubernetes Secret.
580 Cannot be set when AccessKeyID is set.
581 If neither the Access Key nor Key ID are set, we fall-back to using env
582 vars, shared credentials file or AWS Instance metadata,
583 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
584 properties:
585 key:
586 description: |-
587 The key of the entry in the Secret resource's `data` field to be used.
588 Some instances of this field may be defaulted, in others it may be
589 required.
590 type: string
591 name:
592 description: |-
593 Name of the resource being referred to.
594 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
595 type: string
596 required:
597 - name
598 type: object
599 auth:
600 description: Auth configures how cert-manager authenticates.
601 properties:
602 kubernetes:
603 description: |-
604 Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
605 by passing a bound ServiceAccount token.
606 properties:
607 serviceAccountRef:
608 description: |-
609 A reference to a service account that will be used to request a bound
610 token (also known as "projected token"). To use this field, you must
611 configure an RBAC rule to let cert-manager request a token.
612 properties:
613 audiences:
614 description: |-
615 TokenAudiences is an optional list of audiences to include in the
616 token passed to AWS. The default token consisting of the issuer's namespace
617 and name is always included.
618 If unset the audience defaults to `sts.amazonaws.com`.
619 items:
620 type: string
621 type: array
622 x-kubernetes-list-type: atomic
623 name:
624 description: Name of the ServiceAccount used to request a token.
625 type: string
626 required:
627 - name
628 type: object
629 required:
630 - serviceAccountRef
631 type: object
632 required:
633 - kubernetes
634 type: object
635 hostedZoneID:
636 description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
637 type: string
638 region:
639 description: |-
640 Override the AWS region.
641
642 Route53 is a global service and does not have regional endpoints but the
643 region specified here (or via environment variables) is used as a hint to
644 help compute the correct AWS credential scope and partition when it
645 connects to Route53. See:
646 - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
647 - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
648
649 If you omit this region field, cert-manager will use the region from
650 AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
651 in the cert-manager controller Pod.
652
653 The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
654 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
655 [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
656 In this case this `region` field value is ignored.
657
658 The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
659 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
660 [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
661 In this case this `region` field value is ignored.
662 type: string
663 role:
664 description: |-
665 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
666 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
667 type: string
668 secretAccessKeySecretRef:
669 description: |-
670 The SecretAccessKey is used for authentication.
671 If neither the Access Key nor Key ID are set, we fall-back to using env
672 vars, shared credentials file or AWS Instance metadata,
673 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
674 properties:
675 key:
676 description: |-
677 The key of the entry in the Secret resource's `data` field to be used.
678 Some instances of this field may be defaulted, in others it may be
679 required.
680 type: string
681 name:
682 description: |-
683 Name of the resource being referred to.
684 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
685 type: string
686 required:
687 - name
688 type: object
689 type: object
690 webhook:
691 description: |-
692 Configure an external webhook based DNS01 challenge solver to manage
693 DNS01 challenge records.
694 properties:
695 config:
696 description: |-
697 Additional configuration that should be passed to the webhook apiserver
698 when challenges are processed.
699 This can contain arbitrary JSON data.
700 Secret values should not be specified in this stanza.
701 If secret values are needed (e.g., credentials for a DNS service), you
702 should use a SecretKeySelector to reference a Secret resource.
703 For details on the schema of this field, consult the webhook provider
704 implementation's documentation.
705 x-kubernetes-preserve-unknown-fields: true
706 groupName:
707 description: |-
708 The API group name that should be used when POSTing ChallengePayload
709 resources to the webhook apiserver.
710 This should be the same as the GroupName specified in the webhook
711 provider implementation.
712 type: string
713 solverName:
714 description: |-
715 The name of the solver to use, as defined in the webhook provider
716 implementation.
717 This will typically be the name of the provider, e.g., 'cloudflare'.
718 type: string
719 required:
720 - groupName
721 - solverName
722 type: object
723 type: object
724 http01:
725 description: |-
726 Configures cert-manager to attempt to complete authorizations by
727 performing the HTTP01 challenge flow.
728 It is not possible to obtain certificates for wildcard domain names
729 (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
730 properties:
731 gatewayHTTPRoute:
732 description: |-
733 The Gateway API is a sig-network community API that models service networking
734 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
735 create HTTPRoutes with the specified labels in the same namespace as the challenge.
736 This solver is experimental, and fields / behaviour may change in the future.
737 properties:
738 labels:
739 additionalProperties:
740 type: string
741 description: |-
742 Custom labels that will be applied to HTTPRoutes created by cert-manager
743 while solving HTTP-01 challenges.
744 type: object
745 parentRefs:
746 description: |-
747 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
748 cert-manager needs to know which parentRefs should be used when creating
749 the HTTPRoute. Usually, the parentRef references a Gateway. See:
750 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
751 items:
752 description: |-
753 ParentReference identifies an API object (usually a Gateway) that can be considered
754 a parent of this resource (usually a route). There are two kinds of parent resources
755 with "Core" support:
756
757 * Gateway (Gateway conformance profile)
758 * Service (Mesh conformance profile, ClusterIP Services only)
759
760 This API may be extended in the future to support additional kinds of parent
761 resources.
762
763 The API object must be valid in the cluster; the Group and Kind must
764 be registered in the cluster for this reference to be valid.
765 properties:
766 group:
767 default: gateway.networking.k8s.io
768 description: |-
769 Group is the group of the referent.
770 When unspecified, "gateway.networking.k8s.io" is inferred.
771 To set the core API group (such as for a "Service" kind referent),
772 Group must be explicitly set to "" (empty string).
773
774 Support: Core
775 maxLength: 253
776 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
777 type: string
778 kind:
779 default: Gateway
780 description: |-
781 Kind is kind of the referent.
782
783 There are two kinds of parent resources with "Core" support:
784
785 * Gateway (Gateway conformance profile)
786 * Service (Mesh conformance profile, ClusterIP Services only)
787
788 Support for other resources is Implementation-Specific.
789 maxLength: 63
790 minLength: 1
791 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
792 type: string
793 name:
794 description: |-
795 Name is the name of the referent.
796
797 Support: Core
798 maxLength: 253
799 minLength: 1
800 type: string
801 namespace:
802 description: |-
803 Namespace is the namespace of the referent. When unspecified, this refers
804 to the local namespace of the Route.
805
806 Note that there are specific rules for ParentRefs which cross namespace
807 boundaries. Cross-namespace references are only valid if they are explicitly
808 allowed by something in the namespace they are referring to. For example:
809 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
810 generic way to enable any other kind of cross-namespace reference.
811
812 <gateway:experimental:description>
813 ParentRefs from a Route to a Service in the same namespace are "producer"
814 routes, which apply default routing rules to inbound connections from
815 any namespace to the Service.
816
817 ParentRefs from a Route to a Service in a different namespace are
818 "consumer" routes, and these routing rules are only applied to outbound
819 connections originating from the same namespace as the Route, for which
820 the intended destination of the connections are a Service targeted as a
821 ParentRef of the Route.
822 </gateway:experimental:description>
823
824 Support: Core
825 maxLength: 63
826 minLength: 1
827 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
828 type: string
829 port:
830 description: |-
831 Port is the network port this Route targets. It can be interpreted
832 differently based on the type of parent resource.
833
834 When the parent resource is a Gateway, this targets all listeners
835 listening on the specified port that also support this kind of Route(and
836 select this Route). It's not recommended to set `Port` unless the
837 networking behaviors specified in a Route must apply to a specific port
838 as opposed to a listener(s) whose port(s) may be changed. When both Port
839 and SectionName are specified, the name and port of the selected listener
840 must match both specified values.
841
842 <gateway:experimental:description>
843 When the parent resource is a Service, this targets a specific port in the
844 Service spec. When both Port (experimental) and SectionName are specified,
845 the name and port of the selected port must match both specified values.
846 </gateway:experimental:description>
847
848 Implementations MAY choose to support other parent resources.
849 Implementations supporting other types of parent resources MUST clearly
850 document how/if Port is interpreted.
851
852 For the purpose of status, an attachment is considered successful as
853 long as the parent resource accepts it partially. For example, Gateway
854 listeners can restrict which Routes can attach to them by Route kind,
855 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
856 from the referencing Route, the Route MUST be considered successfully
857 attached. If no Gateway listeners accept attachment from this Route,
858 the Route MUST be considered detached from the Gateway.
859
860 Support: Extended
861 format: int32
862 maximum: 65535
863 minimum: 1
864 type: integer
865 sectionName:
866 description: |-
867 SectionName is the name of a section within the target resource. In the
868 following resources, SectionName is interpreted as the following:
869
870 * Gateway: Listener name. When both Port (experimental) and SectionName
871 are specified, the name and port of the selected listener must match
872 both specified values.
873 * Service: Port name. When both Port (experimental) and SectionName
874 are specified, the name and port of the selected listener must match
875 both specified values.
876
877 Implementations MAY choose to support attaching Routes to other resources.
878 If that is the case, they MUST clearly document how SectionName is
879 interpreted.
880
881 When unspecified (empty string), this will reference the entire resource.
882 For the purpose of status, an attachment is considered successful if at
883 least one section in the parent resource accepts it. For example, Gateway
884 listeners can restrict which Routes can attach to them by Route kind,
885 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
886 the referencing Route, the Route MUST be considered successfully
887 attached. If no Gateway listeners accept attachment from this Route, the
888 Route MUST be considered detached from the Gateway.
889
890 Support: Core
891 maxLength: 253
892 minLength: 1
893 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
894 type: string
895 required:
896 - name
897 type: object
898 type: array
899 x-kubernetes-list-type: atomic
900 podTemplate:
901 description: |-
902 Optional pod template used to configure the ACME challenge solver pods
903 used for HTTP01 challenges.
904 properties:
905 metadata:
906 description: |-
907 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
908 Only the 'labels' and 'annotations' fields may be set.
909 If labels or annotations overlap with in-built values, the values here
910 will override the in-built values.
911 properties:
912 annotations:
913 additionalProperties:
914 type: string
915 description: Annotations that should be added to the created ACME HTTP01 solver pods.
916 type: object
917 labels:
918 additionalProperties:
919 type: string
920 description: Labels that should be added to the created ACME HTTP01 solver pods.
921 type: object
922 type: object
923 spec:
924 description: |-
925 PodSpec defines overrides for the HTTP01 challenge solver pod.
926 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
927 All other fields will be ignored.
928 properties:
929 affinity:
930 description: If specified, the pod's scheduling constraints
931 properties:
932 nodeAffinity:
933 description: Describes node affinity scheduling rules for the pod.
934 properties:
935 preferredDuringSchedulingIgnoredDuringExecution:
936 description: |-
937 The scheduler will prefer to schedule pods to nodes that satisfy
938 the affinity expressions specified by this field, but it may choose
939 a node that violates one or more of the expressions. The node that is
940 most preferred is the one with the greatest sum of weights, i.e.
941 for each node that meets all of the scheduling requirements (resource
942 request, requiredDuringScheduling affinity expressions, etc.),
943 compute a sum by iterating through the elements of this field and adding
944 "weight" to the sum if the node matches the corresponding matchExpressions; the
945 node(s) with the highest sum are the most preferred.
946 items:
947 description: |-
948 An empty preferred scheduling term matches all objects with implicit weight 0
949 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
950 properties:
951 preference:
952 description: A node selector term, associated with the corresponding weight.
953 properties:
954 matchExpressions:
955 description: A list of node selector requirements by node's labels.
956 items:
957 description: |-
958 A node selector requirement is a selector that contains values, a key, and an operator
959 that relates the key and values.
960 properties:
961 key:
962 description: The label key that the selector applies to.
963 type: string
964 operator:
965 description: |-
966 Represents a key's relationship to a set of values.
967 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
968 type: string
969 values:
970 description: |-
971 An array of string values. If the operator is In or NotIn,
972 the values array must be non-empty. If the operator is Exists or DoesNotExist,
973 the values array must be empty. If the operator is Gt or Lt, the values
974 array must have a single element, which will be interpreted as an integer.
975 This array is replaced during a strategic merge patch.
976 items:
977 type: string
978 type: array
979 x-kubernetes-list-type: atomic
980 required:
981 - key
982 - operator
983 type: object
984 type: array
985 x-kubernetes-list-type: atomic
986 matchFields:
987 description: A list of node selector requirements by node's fields.
988 items:
989 description: |-
990 A node selector requirement is a selector that contains values, a key, and an operator
991 that relates the key and values.
992 properties:
993 key:
994 description: The label key that the selector applies to.
995 type: string
996 operator:
997 description: |-
998 Represents a key's relationship to a set of values.
999 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1000 type: string
1001 values:
1002 description: |-
1003 An array of string values. If the operator is In or NotIn,
1004 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1005 the values array must be empty. If the operator is Gt or Lt, the values
1006 array must have a single element, which will be interpreted as an integer.
1007 This array is replaced during a strategic merge patch.
1008 items:
1009 type: string
1010 type: array
1011 x-kubernetes-list-type: atomic
1012 required:
1013 - key
1014 - operator
1015 type: object
1016 type: array
1017 x-kubernetes-list-type: atomic
1018 type: object
1019 x-kubernetes-map-type: atomic
1020 weight:
1021 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
1022 format: int32
1023 type: integer
1024 required:
1025 - preference
1026 - weight
1027 type: object
1028 type: array
1029 x-kubernetes-list-type: atomic
1030 requiredDuringSchedulingIgnoredDuringExecution:
1031 description: |-
1032 If the affinity requirements specified by this field are not met at
1033 scheduling time, the pod will not be scheduled onto the node.
1034 If the affinity requirements specified by this field cease to be met
1035 at some point during pod execution (e.g. due to an update), the system
1036 may or may not try to eventually evict the pod from its node.
1037 properties:
1038 nodeSelectorTerms:
1039 description: Required. A list of node selector terms. The terms are ORed.
1040 items:
1041 description: |-
1042 A null or empty node selector term matches no objects. The requirements of
1043 them are ANDed.
1044 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
1045 properties:
1046 matchExpressions:
1047 description: A list of node selector requirements by node's labels.
1048 items:
1049 description: |-
1050 A node selector requirement is a selector that contains values, a key, and an operator
1051 that relates the key and values.
1052 properties:
1053 key:
1054 description: The label key that the selector applies to.
1055 type: string
1056 operator:
1057 description: |-
1058 Represents a key's relationship to a set of values.
1059 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1060 type: string
1061 values:
1062 description: |-
1063 An array of string values. If the operator is In or NotIn,
1064 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1065 the values array must be empty. If the operator is Gt or Lt, the values
1066 array must have a single element, which will be interpreted as an integer.
1067 This array is replaced during a strategic merge patch.
1068 items:
1069 type: string
1070 type: array
1071 x-kubernetes-list-type: atomic
1072 required:
1073 - key
1074 - operator
1075 type: object
1076 type: array
1077 x-kubernetes-list-type: atomic
1078 matchFields:
1079 description: A list of node selector requirements by node's fields.
1080 items:
1081 description: |-
1082 A node selector requirement is a selector that contains values, a key, and an operator
1083 that relates the key and values.
1084 properties:
1085 key:
1086 description: The label key that the selector applies to.
1087 type: string
1088 operator:
1089 description: |-
1090 Represents a key's relationship to a set of values.
1091 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1092 type: string
1093 values:
1094 description: |-
1095 An array of string values. If the operator is In or NotIn,
1096 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1097 the values array must be empty. If the operator is Gt or Lt, the values
1098 array must have a single element, which will be interpreted as an integer.
1099 This array is replaced during a strategic merge patch.
1100 items:
1101 type: string
1102 type: array
1103 x-kubernetes-list-type: atomic
1104 required:
1105 - key
1106 - operator
1107 type: object
1108 type: array
1109 x-kubernetes-list-type: atomic
1110 type: object
1111 x-kubernetes-map-type: atomic
1112 type: array
1113 x-kubernetes-list-type: atomic
1114 required:
1115 - nodeSelectorTerms
1116 type: object
1117 x-kubernetes-map-type: atomic
1118 type: object
1119 podAffinity:
1120 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
1121 properties:
1122 preferredDuringSchedulingIgnoredDuringExecution:
1123 description: |-
1124 The scheduler will prefer to schedule pods to nodes that satisfy
1125 the affinity expressions specified by this field, but it may choose
1126 a node that violates one or more of the expressions. The node that is
1127 most preferred is the one with the greatest sum of weights, i.e.
1128 for each node that meets all of the scheduling requirements (resource
1129 request, requiredDuringScheduling affinity expressions, etc.),
1130 compute a sum by iterating through the elements of this field and adding
1131 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
1132 node(s) with the highest sum are the most preferred.
1133 items:
1134 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1135 properties:
1136 podAffinityTerm:
1137 description: Required. A pod affinity term, associated with the corresponding weight.
1138 properties:
1139 labelSelector:
1140 description: |-
1141 A label query over a set of resources, in this case pods.
1142 If it's null, this PodAffinityTerm matches with no Pods.
1143 properties:
1144 matchExpressions:
1145 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1146 items:
1147 description: |-
1148 A label selector requirement is a selector that contains values, a key, and an operator that
1149 relates the key and values.
1150 properties:
1151 key:
1152 description: key is the label key that the selector applies to.
1153 type: string
1154 operator:
1155 description: |-
1156 operator represents a key's relationship to a set of values.
1157 Valid operators are In, NotIn, Exists and DoesNotExist.
1158 type: string
1159 values:
1160 description: |-
1161 values is an array of string values. If the operator is In or NotIn,
1162 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1163 the values array must be empty. This array is replaced during a strategic
1164 merge patch.
1165 items:
1166 type: string
1167 type: array
1168 x-kubernetes-list-type: atomic
1169 required:
1170 - key
1171 - operator
1172 type: object
1173 type: array
1174 x-kubernetes-list-type: atomic
1175 matchLabels:
1176 additionalProperties:
1177 type: string
1178 description: |-
1179 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1180 map is equivalent to an element of matchExpressions, whose key field is "key", the
1181 operator is "In", and the values array contains only "value". The requirements are ANDed.
1182 type: object
1183 type: object
1184 x-kubernetes-map-type: atomic
1185 matchLabelKeys:
1186 description: |-
1187 MatchLabelKeys is a set of pod label keys to select which pods will
1188 be taken into consideration. The keys are used to lookup values from the
1189 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1190 to select the group of existing pods which pods will be taken into consideration
1191 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1192 pod labels will be ignored. The default value is empty.
1193 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1194 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1195 items:
1196 type: string
1197 type: array
1198 x-kubernetes-list-type: atomic
1199 mismatchLabelKeys:
1200 description: |-
1201 MismatchLabelKeys is a set of pod label keys to select which pods will
1202 be taken into consideration. The keys are used to lookup values from the
1203 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1204 to select the group of existing pods which pods will be taken into consideration
1205 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1206 pod labels will be ignored. The default value is empty.
1207 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1208 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1209 items:
1210 type: string
1211 type: array
1212 x-kubernetes-list-type: atomic
1213 namespaceSelector:
1214 description: |-
1215 A label query over the set of namespaces that the term applies to.
1216 The term is applied to the union of the namespaces selected by this field
1217 and the ones listed in the namespaces field.
1218 null selector and null or empty namespaces list means "this pod's namespace".
1219 An empty selector ({}) matches all namespaces.
1220 properties:
1221 matchExpressions:
1222 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1223 items:
1224 description: |-
1225 A label selector requirement is a selector that contains values, a key, and an operator that
1226 relates the key and values.
1227 properties:
1228 key:
1229 description: key is the label key that the selector applies to.
1230 type: string
1231 operator:
1232 description: |-
1233 operator represents a key's relationship to a set of values.
1234 Valid operators are In, NotIn, Exists and DoesNotExist.
1235 type: string
1236 values:
1237 description: |-
1238 values is an array of string values. If the operator is In or NotIn,
1239 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1240 the values array must be empty. This array is replaced during a strategic
1241 merge patch.
1242 items:
1243 type: string
1244 type: array
1245 x-kubernetes-list-type: atomic
1246 required:
1247 - key
1248 - operator
1249 type: object
1250 type: array
1251 x-kubernetes-list-type: atomic
1252 matchLabels:
1253 additionalProperties:
1254 type: string
1255 description: |-
1256 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1257 map is equivalent to an element of matchExpressions, whose key field is "key", the
1258 operator is "In", and the values array contains only "value". The requirements are ANDed.
1259 type: object
1260 type: object
1261 x-kubernetes-map-type: atomic
1262 namespaces:
1263 description: |-
1264 namespaces specifies a static list of namespace names that the term applies to.
1265 The term is applied to the union of the namespaces listed in this field
1266 and the ones selected by namespaceSelector.
1267 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1268 items:
1269 type: string
1270 type: array
1271 x-kubernetes-list-type: atomic
1272 topologyKey:
1273 description: |-
1274 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1275 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1276 whose value of the label with key topologyKey matches that of any node on which any of the
1277 selected pods is running.
1278 Empty topologyKey is not allowed.
1279 type: string
1280 required:
1281 - topologyKey
1282 type: object
1283 weight:
1284 description: |-
1285 weight associated with matching the corresponding podAffinityTerm,
1286 in the range 1-100.
1287 format: int32
1288 type: integer
1289 required:
1290 - podAffinityTerm
1291 - weight
1292 type: object
1293 type: array
1294 x-kubernetes-list-type: atomic
1295 requiredDuringSchedulingIgnoredDuringExecution:
1296 description: |-
1297 If the affinity requirements specified by this field are not met at
1298 scheduling time, the pod will not be scheduled onto the node.
1299 If the affinity requirements specified by this field cease to be met
1300 at some point during pod execution (e.g. due to a pod label update), the
1301 system may or may not try to eventually evict the pod from its node.
1302 When there are multiple elements, the lists of nodes corresponding to each
1303 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1304 items:
1305 description: |-
1306 Defines a set of pods (namely those matching the labelSelector
1307 relative to the given namespace(s)) that this pod should be
1308 co-located (affinity) or not co-located (anti-affinity) with,
1309 where co-located is defined as running on a node whose value of
1310 the label with key <topologyKey> matches that of any node on which
1311 a pod of the set of pods is running
1312 properties:
1313 labelSelector:
1314 description: |-
1315 A label query over a set of resources, in this case pods.
1316 If it's null, this PodAffinityTerm matches with no Pods.
1317 properties:
1318 matchExpressions:
1319 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1320 items:
1321 description: |-
1322 A label selector requirement is a selector that contains values, a key, and an operator that
1323 relates the key and values.
1324 properties:
1325 key:
1326 description: key is the label key that the selector applies to.
1327 type: string
1328 operator:
1329 description: |-
1330 operator represents a key's relationship to a set of values.
1331 Valid operators are In, NotIn, Exists and DoesNotExist.
1332 type: string
1333 values:
1334 description: |-
1335 values is an array of string values. If the operator is In or NotIn,
1336 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1337 the values array must be empty. This array is replaced during a strategic
1338 merge patch.
1339 items:
1340 type: string
1341 type: array
1342 x-kubernetes-list-type: atomic
1343 required:
1344 - key
1345 - operator
1346 type: object
1347 type: array
1348 x-kubernetes-list-type: atomic
1349 matchLabels:
1350 additionalProperties:
1351 type: string
1352 description: |-
1353 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1354 map is equivalent to an element of matchExpressions, whose key field is "key", the
1355 operator is "In", and the values array contains only "value". The requirements are ANDed.
1356 type: object
1357 type: object
1358 x-kubernetes-map-type: atomic
1359 matchLabelKeys:
1360 description: |-
1361 MatchLabelKeys is a set of pod label keys to select which pods will
1362 be taken into consideration. The keys are used to lookup values from the
1363 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1364 to select the group of existing pods which pods will be taken into consideration
1365 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1366 pod labels will be ignored. The default value is empty.
1367 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1368 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1369 items:
1370 type: string
1371 type: array
1372 x-kubernetes-list-type: atomic
1373 mismatchLabelKeys:
1374 description: |-
1375 MismatchLabelKeys is a set of pod label keys to select which pods will
1376 be taken into consideration. The keys are used to lookup values from the
1377 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1378 to select the group of existing pods which pods will be taken into consideration
1379 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1380 pod labels will be ignored. The default value is empty.
1381 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1382 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1383 items:
1384 type: string
1385 type: array
1386 x-kubernetes-list-type: atomic
1387 namespaceSelector:
1388 description: |-
1389 A label query over the set of namespaces that the term applies to.
1390 The term is applied to the union of the namespaces selected by this field
1391 and the ones listed in the namespaces field.
1392 null selector and null or empty namespaces list means "this pod's namespace".
1393 An empty selector ({}) matches all namespaces.
1394 properties:
1395 matchExpressions:
1396 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1397 items:
1398 description: |-
1399 A label selector requirement is a selector that contains values, a key, and an operator that
1400 relates the key and values.
1401 properties:
1402 key:
1403 description: key is the label key that the selector applies to.
1404 type: string
1405 operator:
1406 description: |-
1407 operator represents a key's relationship to a set of values.
1408 Valid operators are In, NotIn, Exists and DoesNotExist.
1409 type: string
1410 values:
1411 description: |-
1412 values is an array of string values. If the operator is In or NotIn,
1413 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1414 the values array must be empty. This array is replaced during a strategic
1415 merge patch.
1416 items:
1417 type: string
1418 type: array
1419 x-kubernetes-list-type: atomic
1420 required:
1421 - key
1422 - operator
1423 type: object
1424 type: array
1425 x-kubernetes-list-type: atomic
1426 matchLabels:
1427 additionalProperties:
1428 type: string
1429 description: |-
1430 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1431 map is equivalent to an element of matchExpressions, whose key field is "key", the
1432 operator is "In", and the values array contains only "value". The requirements are ANDed.
1433 type: object
1434 type: object
1435 x-kubernetes-map-type: atomic
1436 namespaces:
1437 description: |-
1438 namespaces specifies a static list of namespace names that the term applies to.
1439 The term is applied to the union of the namespaces listed in this field
1440 and the ones selected by namespaceSelector.
1441 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1442 items:
1443 type: string
1444 type: array
1445 x-kubernetes-list-type: atomic
1446 topologyKey:
1447 description: |-
1448 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1449 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1450 whose value of the label with key topologyKey matches that of any node on which any of the
1451 selected pods is running.
1452 Empty topologyKey is not allowed.
1453 type: string
1454 required:
1455 - topologyKey
1456 type: object
1457 type: array
1458 x-kubernetes-list-type: atomic
1459 type: object
1460 podAntiAffinity:
1461 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
1462 properties:
1463 preferredDuringSchedulingIgnoredDuringExecution:
1464 description: |-
1465 The scheduler will prefer to schedule pods to nodes that satisfy
1466 the anti-affinity expressions specified by this field, but it may choose
1467 a node that violates one or more of the expressions. The node that is
1468 most preferred is the one with the greatest sum of weights, i.e.
1469 for each node that meets all of the scheduling requirements (resource
1470 request, requiredDuringScheduling anti-affinity expressions, etc.),
1471 compute a sum by iterating through the elements of this field and subtracting
1472 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
1473 node(s) with the highest sum are the most preferred.
1474 items:
1475 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1476 properties:
1477 podAffinityTerm:
1478 description: Required. A pod affinity term, associated with the corresponding weight.
1479 properties:
1480 labelSelector:
1481 description: |-
1482 A label query over a set of resources, in this case pods.
1483 If it's null, this PodAffinityTerm matches with no Pods.
1484 properties:
1485 matchExpressions:
1486 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1487 items:
1488 description: |-
1489 A label selector requirement is a selector that contains values, a key, and an operator that
1490 relates the key and values.
1491 properties:
1492 key:
1493 description: key is the label key that the selector applies to.
1494 type: string
1495 operator:
1496 description: |-
1497 operator represents a key's relationship to a set of values.
1498 Valid operators are In, NotIn, Exists and DoesNotExist.
1499 type: string
1500 values:
1501 description: |-
1502 values is an array of string values. If the operator is In or NotIn,
1503 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1504 the values array must be empty. This array is replaced during a strategic
1505 merge patch.
1506 items:
1507 type: string
1508 type: array
1509 x-kubernetes-list-type: atomic
1510 required:
1511 - key
1512 - operator
1513 type: object
1514 type: array
1515 x-kubernetes-list-type: atomic
1516 matchLabels:
1517 additionalProperties:
1518 type: string
1519 description: |-
1520 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1521 map is equivalent to an element of matchExpressions, whose key field is "key", the
1522 operator is "In", and the values array contains only "value". The requirements are ANDed.
1523 type: object
1524 type: object
1525 x-kubernetes-map-type: atomic
1526 matchLabelKeys:
1527 description: |-
1528 MatchLabelKeys is a set of pod label keys to select which pods will
1529 be taken into consideration. The keys are used to lookup values from the
1530 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1531 to select the group of existing pods which pods will be taken into consideration
1532 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1533 pod labels will be ignored. The default value is empty.
1534 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1535 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1536 items:
1537 type: string
1538 type: array
1539 x-kubernetes-list-type: atomic
1540 mismatchLabelKeys:
1541 description: |-
1542 MismatchLabelKeys is a set of pod label keys to select which pods will
1543 be taken into consideration. The keys are used to lookup values from the
1544 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1545 to select the group of existing pods which pods will be taken into consideration
1546 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1547 pod labels will be ignored. The default value is empty.
1548 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1549 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1550 items:
1551 type: string
1552 type: array
1553 x-kubernetes-list-type: atomic
1554 namespaceSelector:
1555 description: |-
1556 A label query over the set of namespaces that the term applies to.
1557 The term is applied to the union of the namespaces selected by this field
1558 and the ones listed in the namespaces field.
1559 null selector and null or empty namespaces list means "this pod's namespace".
1560 An empty selector ({}) matches all namespaces.
1561 properties:
1562 matchExpressions:
1563 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1564 items:
1565 description: |-
1566 A label selector requirement is a selector that contains values, a key, and an operator that
1567 relates the key and values.
1568 properties:
1569 key:
1570 description: key is the label key that the selector applies to.
1571 type: string
1572 operator:
1573 description: |-
1574 operator represents a key's relationship to a set of values.
1575 Valid operators are In, NotIn, Exists and DoesNotExist.
1576 type: string
1577 values:
1578 description: |-
1579 values is an array of string values. If the operator is In or NotIn,
1580 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1581 the values array must be empty. This array is replaced during a strategic
1582 merge patch.
1583 items:
1584 type: string
1585 type: array
1586 x-kubernetes-list-type: atomic
1587 required:
1588 - key
1589 - operator
1590 type: object
1591 type: array
1592 x-kubernetes-list-type: atomic
1593 matchLabels:
1594 additionalProperties:
1595 type: string
1596 description: |-
1597 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1598 map is equivalent to an element of matchExpressions, whose key field is "key", the
1599 operator is "In", and the values array contains only "value". The requirements are ANDed.
1600 type: object
1601 type: object
1602 x-kubernetes-map-type: atomic
1603 namespaces:
1604 description: |-
1605 namespaces specifies a static list of namespace names that the term applies to.
1606 The term is applied to the union of the namespaces listed in this field
1607 and the ones selected by namespaceSelector.
1608 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1609 items:
1610 type: string
1611 type: array
1612 x-kubernetes-list-type: atomic
1613 topologyKey:
1614 description: |-
1615 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1616 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1617 whose value of the label with key topologyKey matches that of any node on which any of the
1618 selected pods is running.
1619 Empty topologyKey is not allowed.
1620 type: string
1621 required:
1622 - topologyKey
1623 type: object
1624 weight:
1625 description: |-
1626 weight associated with matching the corresponding podAffinityTerm,
1627 in the range 1-100.
1628 format: int32
1629 type: integer
1630 required:
1631 - podAffinityTerm
1632 - weight
1633 type: object
1634 type: array
1635 x-kubernetes-list-type: atomic
1636 requiredDuringSchedulingIgnoredDuringExecution:
1637 description: |-
1638 If the anti-affinity requirements specified by this field are not met at
1639 scheduling time, the pod will not be scheduled onto the node.
1640 If the anti-affinity requirements specified by this field cease to be met
1641 at some point during pod execution (e.g. due to a pod label update), the
1642 system may or may not try to eventually evict the pod from its node.
1643 When there are multiple elements, the lists of nodes corresponding to each
1644 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1645 items:
1646 description: |-
1647 Defines a set of pods (namely those matching the labelSelector
1648 relative to the given namespace(s)) that this pod should be
1649 co-located (affinity) or not co-located (anti-affinity) with,
1650 where co-located is defined as running on a node whose value of
1651 the label with key <topologyKey> matches that of any node on which
1652 a pod of the set of pods is running
1653 properties:
1654 labelSelector:
1655 description: |-
1656 A label query over a set of resources, in this case pods.
1657 If it's null, this PodAffinityTerm matches with no Pods.
1658 properties:
1659 matchExpressions:
1660 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1661 items:
1662 description: |-
1663 A label selector requirement is a selector that contains values, a key, and an operator that
1664 relates the key and values.
1665 properties:
1666 key:
1667 description: key is the label key that the selector applies to.
1668 type: string
1669 operator:
1670 description: |-
1671 operator represents a key's relationship to a set of values.
1672 Valid operators are In, NotIn, Exists and DoesNotExist.
1673 type: string
1674 values:
1675 description: |-
1676 values is an array of string values. If the operator is In or NotIn,
1677 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1678 the values array must be empty. This array is replaced during a strategic
1679 merge patch.
1680 items:
1681 type: string
1682 type: array
1683 x-kubernetes-list-type: atomic
1684 required:
1685 - key
1686 - operator
1687 type: object
1688 type: array
1689 x-kubernetes-list-type: atomic
1690 matchLabels:
1691 additionalProperties:
1692 type: string
1693 description: |-
1694 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1695 map is equivalent to an element of matchExpressions, whose key field is "key", the
1696 operator is "In", and the values array contains only "value". The requirements are ANDed.
1697 type: object
1698 type: object
1699 x-kubernetes-map-type: atomic
1700 matchLabelKeys:
1701 description: |-
1702 MatchLabelKeys is a set of pod label keys to select which pods will
1703 be taken into consideration. The keys are used to lookup values from the
1704 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1705 to select the group of existing pods which pods will be taken into consideration
1706 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1707 pod labels will be ignored. The default value is empty.
1708 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1709 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1710 items:
1711 type: string
1712 type: array
1713 x-kubernetes-list-type: atomic
1714 mismatchLabelKeys:
1715 description: |-
1716 MismatchLabelKeys is a set of pod label keys to select which pods will
1717 be taken into consideration. The keys are used to lookup values from the
1718 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1719 to select the group of existing pods which pods will be taken into consideration
1720 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1721 pod labels will be ignored. The default value is empty.
1722 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1723 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1724 items:
1725 type: string
1726 type: array
1727 x-kubernetes-list-type: atomic
1728 namespaceSelector:
1729 description: |-
1730 A label query over the set of namespaces that the term applies to.
1731 The term is applied to the union of the namespaces selected by this field
1732 and the ones listed in the namespaces field.
1733 null selector and null or empty namespaces list means "this pod's namespace".
1734 An empty selector ({}) matches all namespaces.
1735 properties:
1736 matchExpressions:
1737 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1738 items:
1739 description: |-
1740 A label selector requirement is a selector that contains values, a key, and an operator that
1741 relates the key and values.
1742 properties:
1743 key:
1744 description: key is the label key that the selector applies to.
1745 type: string
1746 operator:
1747 description: |-
1748 operator represents a key's relationship to a set of values.
1749 Valid operators are In, NotIn, Exists and DoesNotExist.
1750 type: string
1751 values:
1752 description: |-
1753 values is an array of string values. If the operator is In or NotIn,
1754 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1755 the values array must be empty. This array is replaced during a strategic
1756 merge patch.
1757 items:
1758 type: string
1759 type: array
1760 x-kubernetes-list-type: atomic
1761 required:
1762 - key
1763 - operator
1764 type: object
1765 type: array
1766 x-kubernetes-list-type: atomic
1767 matchLabels:
1768 additionalProperties:
1769 type: string
1770 description: |-
1771 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1772 map is equivalent to an element of matchExpressions, whose key field is "key", the
1773 operator is "In", and the values array contains only "value". The requirements are ANDed.
1774 type: object
1775 type: object
1776 x-kubernetes-map-type: atomic
1777 namespaces:
1778 description: |-
1779 namespaces specifies a static list of namespace names that the term applies to.
1780 The term is applied to the union of the namespaces listed in this field
1781 and the ones selected by namespaceSelector.
1782 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1783 items:
1784 type: string
1785 type: array
1786 x-kubernetes-list-type: atomic
1787 topologyKey:
1788 description: |-
1789 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1790 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1791 whose value of the label with key topologyKey matches that of any node on which any of the
1792 selected pods is running.
1793 Empty topologyKey is not allowed.
1794 type: string
1795 required:
1796 - topologyKey
1797 type: object
1798 type: array
1799 x-kubernetes-list-type: atomic
1800 type: object
1801 type: object
1802 imagePullSecrets:
1803 description: If specified, the pod's imagePullSecrets
1804 items:
1805 description: |-
1806 LocalObjectReference contains enough information to let you locate the
1807 referenced object inside the same namespace.
1808 properties:
1809 name:
1810 default: ""
1811 description: |-
1812 Name of the referent.
1813 This field is effectively required, but due to backwards compatibility is
1814 allowed to be empty. Instances of this type with an empty value here are
1815 almost certainly wrong.
1816 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1817 type: string
1818 type: object
1819 x-kubernetes-map-type: atomic
1820 type: array
1821 x-kubernetes-list-map-keys:
1822 - name
1823 x-kubernetes-list-type: map
1824 nodeSelector:
1825 additionalProperties:
1826 type: string
1827 description: |-
1828 NodeSelector is a selector which must be true for the pod to fit on a node.
1829 Selector which must match a node's labels for the pod to be scheduled on that node.
1830 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
1831 type: object
1832 priorityClassName:
1833 description: If specified, the pod's priorityClassName.
1834 type: string
1835 resources:
1836 description: |-
1837 If specified, the pod's resource requirements.
1838 These values override the global resource configuration flags.
1839 Note that when only specifying resource limits, ensure they are greater than or equal
1840 to the corresponding global resource requests configured via controller flags
1841 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
1842 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
1843 properties:
1844 limits:
1845 additionalProperties:
1846 anyOf:
1847 - type: integer
1848 - type: string
1849 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1850 x-kubernetes-int-or-string: true
1851 description: |-
1852 Limits describes the maximum amount of compute resources allowed.
1853 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1854 type: object
1855 requests:
1856 additionalProperties:
1857 anyOf:
1858 - type: integer
1859 - type: string
1860 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1861 x-kubernetes-int-or-string: true
1862 description: |-
1863 Requests describes the minimum amount of compute resources required.
1864 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
1865 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
1866 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1867 type: object
1868 type: object
1869 securityContext:
1870 description: If specified, the pod's security context
1871 properties:
1872 fsGroup:
1873 description: |-
1874 A special supplemental group that applies to all containers in a pod.
1875 Some volume types allow the Kubelet to change the ownership of that volume
1876 to be owned by the pod:
1877
1878 1. The owning GID will be the FSGroup
1879 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
1880 3. The permission bits are OR'd with rw-rw----
1881
1882 If unset, the Kubelet will not modify the ownership and permissions of any volume.
1883 Note that this field cannot be set when spec.os.name is windows.
1884 format: int64
1885 type: integer
1886 fsGroupChangePolicy:
1887 description: |-
1888 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
1889 before being exposed inside Pod. This field will only apply to
1890 volume types which support fsGroup based ownership(and permissions).
1891 It will have no effect on ephemeral volume types such as: secret, configmaps
1892 and emptydir.
1893 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
1894 Note that this field cannot be set when spec.os.name is windows.
1895 type: string
1896 runAsGroup:
1897 description: |-
1898 The GID to run the entrypoint of the container process.
1899 Uses runtime default if unset.
1900 May also be set in SecurityContext. If set in both SecurityContext and
1901 PodSecurityContext, the value specified in SecurityContext takes precedence
1902 for that container.
1903 Note that this field cannot be set when spec.os.name is windows.
1904 format: int64
1905 type: integer
1906 runAsNonRoot:
1907 description: |-
1908 Indicates that the container must run as a non-root user.
1909 If true, the Kubelet will validate the image at runtime to ensure that it
1910 does not run as UID 0 (root) and fail to start the container if it does.
1911 If unset or false, no such validation will be performed.
1912 May also be set in SecurityContext. If set in both SecurityContext and
1913 PodSecurityContext, the value specified in SecurityContext takes precedence.
1914 type: boolean
1915 runAsUser:
1916 description: |-
1917 The UID to run the entrypoint of the container process.
1918 Defaults to user specified in image metadata if unspecified.
1919 May also be set in SecurityContext. If set in both SecurityContext and
1920 PodSecurityContext, the value specified in SecurityContext takes precedence
1921 for that container.
1922 Note that this field cannot be set when spec.os.name is windows.
1923 format: int64
1924 type: integer
1925 seLinuxOptions:
1926 description: |-
1927 The SELinux context to be applied to all containers.
1928 If unspecified, the container runtime will allocate a random SELinux context for each
1929 container. May also be set in SecurityContext. If set in
1930 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
1931 takes precedence for that container.
1932 Note that this field cannot be set when spec.os.name is windows.
1933 properties:
1934 level:
1935 description: Level is SELinux level label that applies to the container.
1936 type: string
1937 role:
1938 description: Role is a SELinux role label that applies to the container.
1939 type: string
1940 type:
1941 description: Type is a SELinux type label that applies to the container.
1942 type: string
1943 user:
1944 description: User is a SELinux user label that applies to the container.
1945 type: string
1946 type: object
1947 seccompProfile:
1948 description: |-
1949 The seccomp options to use by the containers in this pod.
1950 Note that this field cannot be set when spec.os.name is windows.
1951 properties:
1952 localhostProfile:
1953 description: |-
1954 localhostProfile indicates a profile defined in a file on the node should be used.
1955 The profile must be preconfigured on the node to work.
1956 Must be a descending path, relative to the kubelet's configured seccomp profile location.
1957 Must be set if type is "Localhost". Must NOT be set for any other type.
1958 type: string
1959 type:
1960 description: |-
1961 type indicates which kind of seccomp profile will be applied.
1962 Valid options are:
1963
1964 Localhost - a profile defined in a file on the node should be used.
1965 RuntimeDefault - the container runtime default profile should be used.
1966 Unconfined - no profile should be applied.
1967 type: string
1968 required:
1969 - type
1970 type: object
1971 supplementalGroups:
1972 description: |-
1973 A list of groups applied to the first process run in each container, in addition
1974 to the container's primary GID, the fsGroup (if specified), and group memberships
1975 defined in the container image for the uid of the container process. If unspecified,
1976 no additional groups are added to any container. Note that group memberships
1977 defined in the container image for the uid of the container process are still effective,
1978 even if they are not included in this list.
1979 Note that this field cannot be set when spec.os.name is windows.
1980 items:
1981 format: int64
1982 type: integer
1983 type: array
1984 x-kubernetes-list-type: atomic
1985 sysctls:
1986 description: |-
1987 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
1988 sysctls (by the container runtime) might fail to launch.
1989 Note that this field cannot be set when spec.os.name is windows.
1990 items:
1991 description: Sysctl defines a kernel parameter to be set
1992 properties:
1993 name:
1994 description: Name of a property to set
1995 type: string
1996 value:
1997 description: Value of a property to set
1998 type: string
1999 required:
2000 - name
2001 - value
2002 type: object
2003 type: array
2004 x-kubernetes-list-type: atomic
2005 type: object
2006 serviceAccountName:
2007 description: If specified, the pod's service account
2008 type: string
2009 tolerations:
2010 description: If specified, the pod's tolerations.
2011 items:
2012 description: |-
2013 The pod this Toleration is attached to tolerates any taint that matches
2014 the triple <key,value,effect> using the matching operator <operator>.
2015 properties:
2016 effect:
2017 description: |-
2018 Effect indicates the taint effect to match. Empty means match all taint effects.
2019 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
2020 type: string
2021 key:
2022 description: |-
2023 Key is the taint key that the toleration applies to. Empty means match all taint keys.
2024 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
2025 type: string
2026 operator:
2027 description: |-
2028 Operator represents a key's relationship to the value.
2029 Valid operators are Exists and Equal. Defaults to Equal.
2030 Exists is equivalent to wildcard for value, so that a pod can
2031 tolerate all taints of a particular category.
2032 type: string
2033 tolerationSeconds:
2034 description: |-
2035 TolerationSeconds represents the period of time the toleration (which must be
2036 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
2037 it is not set, which means tolerate the taint forever (do not evict). Zero and
2038 negative values will be treated as 0 (evict immediately) by the system.
2039 format: int64
2040 type: integer
2041 value:
2042 description: |-
2043 Value is the taint value the toleration matches to.
2044 If the operator is Exists, the value should be empty, otherwise just a regular string.
2045 type: string
2046 type: object
2047 type: array
2048 x-kubernetes-list-type: atomic
2049 type: object
2050 type: object
2051 serviceType:
2052 description: |-
2053 Optional service type for Kubernetes solver service. Supported values
2054 are NodePort or ClusterIP. If unset, defaults to NodePort.
2055 type: string
2056 type: object
2057 ingress:
2058 description: |-
2059 The ingress based HTTP01 challenge solver will solve challenges by
2060 creating or modifying Ingress resources in order to route requests for
2061 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
2062 provisioned by cert-manager for each Challenge to be completed.
2063 properties:
2064 class:
2065 description: |-
2066 This field configures the annotation `kubernetes.io/ingress.class` when
2067 creating Ingress resources to solve ACME challenges that use this
2068 challenge solver. Only one of `class`, `name` or `ingressClassName` may
2069 be specified.
2070 type: string
2071 ingressClassName:
2072 description: |-
2073 This field configures the field `ingressClassName` on the created Ingress
2074 resources used to solve ACME challenges that use this challenge solver.
2075 This is the recommended way of configuring the ingress class. Only one of
2076 `class`, `name` or `ingressClassName` may be specified.
2077 type: string
2078 ingressTemplate:
2079 description: |-
2080 Optional ingress template used to configure the ACME challenge solver
2081 ingress used for HTTP01 challenges.
2082 properties:
2083 metadata:
2084 description: |-
2085 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
2086 Only the 'labels' and 'annotations' fields may be set.
2087 If labels or annotations overlap with in-built values, the values here
2088 will override the in-built values.
2089 properties:
2090 annotations:
2091 additionalProperties:
2092 type: string
2093 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
2094 type: object
2095 labels:
2096 additionalProperties:
2097 type: string
2098 description: Labels that should be added to the created ACME HTTP01 solver ingress.
2099 type: object
2100 type: object
2101 type: object
2102 name:
2103 description: |-
2104 The name of the ingress resource that should have ACME challenge solving
2105 routes inserted into it in order to solve HTTP01 challenges.
2106 This is typically used in conjunction with ingress controllers like
2107 ingress-gce, which maintains a 1:1 mapping between external IPs and
2108 ingress resources. Only one of `class`, `name` or `ingressClassName` may
2109 be specified.
2110 type: string
2111 podTemplate:
2112 description: |-
2113 Optional pod template used to configure the ACME challenge solver pods
2114 used for HTTP01 challenges.
2115 properties:
2116 metadata:
2117 description: |-
2118 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
2119 Only the 'labels' and 'annotations' fields may be set.
2120 If labels or annotations overlap with in-built values, the values here
2121 will override the in-built values.
2122 properties:
2123 annotations:
2124 additionalProperties:
2125 type: string
2126 description: Annotations that should be added to the created ACME HTTP01 solver pods.
2127 type: object
2128 labels:
2129 additionalProperties:
2130 type: string
2131 description: Labels that should be added to the created ACME HTTP01 solver pods.
2132 type: object
2133 type: object
2134 spec:
2135 description: |-
2136 PodSpec defines overrides for the HTTP01 challenge solver pod.
2137 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
2138 All other fields will be ignored.
2139 properties:
2140 affinity:
2141 description: If specified, the pod's scheduling constraints
2142 properties:
2143 nodeAffinity:
2144 description: Describes node affinity scheduling rules for the pod.
2145 properties:
2146 preferredDuringSchedulingIgnoredDuringExecution:
2147 description: |-
2148 The scheduler will prefer to schedule pods to nodes that satisfy
2149 the affinity expressions specified by this field, but it may choose
2150 a node that violates one or more of the expressions. The node that is
2151 most preferred is the one with the greatest sum of weights, i.e.
2152 for each node that meets all of the scheduling requirements (resource
2153 request, requiredDuringScheduling affinity expressions, etc.),
2154 compute a sum by iterating through the elements of this field and adding
2155 "weight" to the sum if the node matches the corresponding matchExpressions; the
2156 node(s) with the highest sum are the most preferred.
2157 items:
2158 description: |-
2159 An empty preferred scheduling term matches all objects with implicit weight 0
2160 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
2161 properties:
2162 preference:
2163 description: A node selector term, associated with the corresponding weight.
2164 properties:
2165 matchExpressions:
2166 description: A list of node selector requirements by node's labels.
2167 items:
2168 description: |-
2169 A node selector requirement is a selector that contains values, a key, and an operator
2170 that relates the key and values.
2171 properties:
2172 key:
2173 description: The label key that the selector applies to.
2174 type: string
2175 operator:
2176 description: |-
2177 Represents a key's relationship to a set of values.
2178 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2179 type: string
2180 values:
2181 description: |-
2182 An array of string values. If the operator is In or NotIn,
2183 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2184 the values array must be empty. If the operator is Gt or Lt, the values
2185 array must have a single element, which will be interpreted as an integer.
2186 This array is replaced during a strategic merge patch.
2187 items:
2188 type: string
2189 type: array
2190 x-kubernetes-list-type: atomic
2191 required:
2192 - key
2193 - operator
2194 type: object
2195 type: array
2196 x-kubernetes-list-type: atomic
2197 matchFields:
2198 description: A list of node selector requirements by node's fields.
2199 items:
2200 description: |-
2201 A node selector requirement is a selector that contains values, a key, and an operator
2202 that relates the key and values.
2203 properties:
2204 key:
2205 description: The label key that the selector applies to.
2206 type: string
2207 operator:
2208 description: |-
2209 Represents a key's relationship to a set of values.
2210 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2211 type: string
2212 values:
2213 description: |-
2214 An array of string values. If the operator is In or NotIn,
2215 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2216 the values array must be empty. If the operator is Gt or Lt, the values
2217 array must have a single element, which will be interpreted as an integer.
2218 This array is replaced during a strategic merge patch.
2219 items:
2220 type: string
2221 type: array
2222 x-kubernetes-list-type: atomic
2223 required:
2224 - key
2225 - operator
2226 type: object
2227 type: array
2228 x-kubernetes-list-type: atomic
2229 type: object
2230 x-kubernetes-map-type: atomic
2231 weight:
2232 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
2233 format: int32
2234 type: integer
2235 required:
2236 - preference
2237 - weight
2238 type: object
2239 type: array
2240 x-kubernetes-list-type: atomic
2241 requiredDuringSchedulingIgnoredDuringExecution:
2242 description: |-
2243 If the affinity requirements specified by this field are not met at
2244 scheduling time, the pod will not be scheduled onto the node.
2245 If the affinity requirements specified by this field cease to be met
2246 at some point during pod execution (e.g. due to an update), the system
2247 may or may not try to eventually evict the pod from its node.
2248 properties:
2249 nodeSelectorTerms:
2250 description: Required. A list of node selector terms. The terms are ORed.
2251 items:
2252 description: |-
2253 A null or empty node selector term matches no objects. The requirements of
2254 them are ANDed.
2255 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
2256 properties:
2257 matchExpressions:
2258 description: A list of node selector requirements by node's labels.
2259 items:
2260 description: |-
2261 A node selector requirement is a selector that contains values, a key, and an operator
2262 that relates the key and values.
2263 properties:
2264 key:
2265 description: The label key that the selector applies to.
2266 type: string
2267 operator:
2268 description: |-
2269 Represents a key's relationship to a set of values.
2270 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2271 type: string
2272 values:
2273 description: |-
2274 An array of string values. If the operator is In or NotIn,
2275 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2276 the values array must be empty. If the operator is Gt or Lt, the values
2277 array must have a single element, which will be interpreted as an integer.
2278 This array is replaced during a strategic merge patch.
2279 items:
2280 type: string
2281 type: array
2282 x-kubernetes-list-type: atomic
2283 required:
2284 - key
2285 - operator
2286 type: object
2287 type: array
2288 x-kubernetes-list-type: atomic
2289 matchFields:
2290 description: A list of node selector requirements by node's fields.
2291 items:
2292 description: |-
2293 A node selector requirement is a selector that contains values, a key, and an operator
2294 that relates the key and values.
2295 properties:
2296 key:
2297 description: The label key that the selector applies to.
2298 type: string
2299 operator:
2300 description: |-
2301 Represents a key's relationship to a set of values.
2302 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2303 type: string
2304 values:
2305 description: |-
2306 An array of string values. If the operator is In or NotIn,
2307 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2308 the values array must be empty. If the operator is Gt or Lt, the values
2309 array must have a single element, which will be interpreted as an integer.
2310 This array is replaced during a strategic merge patch.
2311 items:
2312 type: string
2313 type: array
2314 x-kubernetes-list-type: atomic
2315 required:
2316 - key
2317 - operator
2318 type: object
2319 type: array
2320 x-kubernetes-list-type: atomic
2321 type: object
2322 x-kubernetes-map-type: atomic
2323 type: array
2324 x-kubernetes-list-type: atomic
2325 required:
2326 - nodeSelectorTerms
2327 type: object
2328 x-kubernetes-map-type: atomic
2329 type: object
2330 podAffinity:
2331 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
2332 properties:
2333 preferredDuringSchedulingIgnoredDuringExecution:
2334 description: |-
2335 The scheduler will prefer to schedule pods to nodes that satisfy
2336 the affinity expressions specified by this field, but it may choose
2337 a node that violates one or more of the expressions. The node that is
2338 most preferred is the one with the greatest sum of weights, i.e.
2339 for each node that meets all of the scheduling requirements (resource
2340 request, requiredDuringScheduling affinity expressions, etc.),
2341 compute a sum by iterating through the elements of this field and adding
2342 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
2343 node(s) with the highest sum are the most preferred.
2344 items:
2345 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2346 properties:
2347 podAffinityTerm:
2348 description: Required. A pod affinity term, associated with the corresponding weight.
2349 properties:
2350 labelSelector:
2351 description: |-
2352 A label query over a set of resources, in this case pods.
2353 If it's null, this PodAffinityTerm matches with no Pods.
2354 properties:
2355 matchExpressions:
2356 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2357 items:
2358 description: |-
2359 A label selector requirement is a selector that contains values, a key, and an operator that
2360 relates the key and values.
2361 properties:
2362 key:
2363 description: key is the label key that the selector applies to.
2364 type: string
2365 operator:
2366 description: |-
2367 operator represents a key's relationship to a set of values.
2368 Valid operators are In, NotIn, Exists and DoesNotExist.
2369 type: string
2370 values:
2371 description: |-
2372 values is an array of string values. If the operator is In or NotIn,
2373 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2374 the values array must be empty. This array is replaced during a strategic
2375 merge patch.
2376 items:
2377 type: string
2378 type: array
2379 x-kubernetes-list-type: atomic
2380 required:
2381 - key
2382 - operator
2383 type: object
2384 type: array
2385 x-kubernetes-list-type: atomic
2386 matchLabels:
2387 additionalProperties:
2388 type: string
2389 description: |-
2390 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2391 map is equivalent to an element of matchExpressions, whose key field is "key", the
2392 operator is "In", and the values array contains only "value". The requirements are ANDed.
2393 type: object
2394 type: object
2395 x-kubernetes-map-type: atomic
2396 matchLabelKeys:
2397 description: |-
2398 MatchLabelKeys is a set of pod label keys to select which pods will
2399 be taken into consideration. The keys are used to lookup values from the
2400 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2401 to select the group of existing pods which pods will be taken into consideration
2402 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2403 pod labels will be ignored. The default value is empty.
2404 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2405 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2406 items:
2407 type: string
2408 type: array
2409 x-kubernetes-list-type: atomic
2410 mismatchLabelKeys:
2411 description: |-
2412 MismatchLabelKeys is a set of pod label keys to select which pods will
2413 be taken into consideration. The keys are used to lookup values from the
2414 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2415 to select the group of existing pods which pods will be taken into consideration
2416 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2417 pod labels will be ignored. The default value is empty.
2418 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2419 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2420 items:
2421 type: string
2422 type: array
2423 x-kubernetes-list-type: atomic
2424 namespaceSelector:
2425 description: |-
2426 A label query over the set of namespaces that the term applies to.
2427 The term is applied to the union of the namespaces selected by this field
2428 and the ones listed in the namespaces field.
2429 null selector and null or empty namespaces list means "this pod's namespace".
2430 An empty selector ({}) matches all namespaces.
2431 properties:
2432 matchExpressions:
2433 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2434 items:
2435 description: |-
2436 A label selector requirement is a selector that contains values, a key, and an operator that
2437 relates the key and values.
2438 properties:
2439 key:
2440 description: key is the label key that the selector applies to.
2441 type: string
2442 operator:
2443 description: |-
2444 operator represents a key's relationship to a set of values.
2445 Valid operators are In, NotIn, Exists and DoesNotExist.
2446 type: string
2447 values:
2448 description: |-
2449 values is an array of string values. If the operator is In or NotIn,
2450 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2451 the values array must be empty. This array is replaced during a strategic
2452 merge patch.
2453 items:
2454 type: string
2455 type: array
2456 x-kubernetes-list-type: atomic
2457 required:
2458 - key
2459 - operator
2460 type: object
2461 type: array
2462 x-kubernetes-list-type: atomic
2463 matchLabels:
2464 additionalProperties:
2465 type: string
2466 description: |-
2467 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2468 map is equivalent to an element of matchExpressions, whose key field is "key", the
2469 operator is "In", and the values array contains only "value". The requirements are ANDed.
2470 type: object
2471 type: object
2472 x-kubernetes-map-type: atomic
2473 namespaces:
2474 description: |-
2475 namespaces specifies a static list of namespace names that the term applies to.
2476 The term is applied to the union of the namespaces listed in this field
2477 and the ones selected by namespaceSelector.
2478 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2479 items:
2480 type: string
2481 type: array
2482 x-kubernetes-list-type: atomic
2483 topologyKey:
2484 description: |-
2485 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2486 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2487 whose value of the label with key topologyKey matches that of any node on which any of the
2488 selected pods is running.
2489 Empty topologyKey is not allowed.
2490 type: string
2491 required:
2492 - topologyKey
2493 type: object
2494 weight:
2495 description: |-
2496 weight associated with matching the corresponding podAffinityTerm,
2497 in the range 1-100.
2498 format: int32
2499 type: integer
2500 required:
2501 - podAffinityTerm
2502 - weight
2503 type: object
2504 type: array
2505 x-kubernetes-list-type: atomic
2506 requiredDuringSchedulingIgnoredDuringExecution:
2507 description: |-
2508 If the affinity requirements specified by this field are not met at
2509 scheduling time, the pod will not be scheduled onto the node.
2510 If the affinity requirements specified by this field cease to be met
2511 at some point during pod execution (e.g. due to a pod label update), the
2512 system may or may not try to eventually evict the pod from its node.
2513 When there are multiple elements, the lists of nodes corresponding to each
2514 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2515 items:
2516 description: |-
2517 Defines a set of pods (namely those matching the labelSelector
2518 relative to the given namespace(s)) that this pod should be
2519 co-located (affinity) or not co-located (anti-affinity) with,
2520 where co-located is defined as running on a node whose value of
2521 the label with key <topologyKey> matches that of any node on which
2522 a pod of the set of pods is running
2523 properties:
2524 labelSelector:
2525 description: |-
2526 A label query over a set of resources, in this case pods.
2527 If it's null, this PodAffinityTerm matches with no Pods.
2528 properties:
2529 matchExpressions:
2530 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2531 items:
2532 description: |-
2533 A label selector requirement is a selector that contains values, a key, and an operator that
2534 relates the key and values.
2535 properties:
2536 key:
2537 description: key is the label key that the selector applies to.
2538 type: string
2539 operator:
2540 description: |-
2541 operator represents a key's relationship to a set of values.
2542 Valid operators are In, NotIn, Exists and DoesNotExist.
2543 type: string
2544 values:
2545 description: |-
2546 values is an array of string values. If the operator is In or NotIn,
2547 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2548 the values array must be empty. This array is replaced during a strategic
2549 merge patch.
2550 items:
2551 type: string
2552 type: array
2553 x-kubernetes-list-type: atomic
2554 required:
2555 - key
2556 - operator
2557 type: object
2558 type: array
2559 x-kubernetes-list-type: atomic
2560 matchLabels:
2561 additionalProperties:
2562 type: string
2563 description: |-
2564 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2565 map is equivalent to an element of matchExpressions, whose key field is "key", the
2566 operator is "In", and the values array contains only "value". The requirements are ANDed.
2567 type: object
2568 type: object
2569 x-kubernetes-map-type: atomic
2570 matchLabelKeys:
2571 description: |-
2572 MatchLabelKeys is a set of pod label keys to select which pods will
2573 be taken into consideration. The keys are used to lookup values from the
2574 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2575 to select the group of existing pods which pods will be taken into consideration
2576 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2577 pod labels will be ignored. The default value is empty.
2578 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2579 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2580 items:
2581 type: string
2582 type: array
2583 x-kubernetes-list-type: atomic
2584 mismatchLabelKeys:
2585 description: |-
2586 MismatchLabelKeys is a set of pod label keys to select which pods will
2587 be taken into consideration. The keys are used to lookup values from the
2588 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2589 to select the group of existing pods which pods will be taken into consideration
2590 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2591 pod labels will be ignored. The default value is empty.
2592 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2593 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2594 items:
2595 type: string
2596 type: array
2597 x-kubernetes-list-type: atomic
2598 namespaceSelector:
2599 description: |-
2600 A label query over the set of namespaces that the term applies to.
2601 The term is applied to the union of the namespaces selected by this field
2602 and the ones listed in the namespaces field.
2603 null selector and null or empty namespaces list means "this pod's namespace".
2604 An empty selector ({}) matches all namespaces.
2605 properties:
2606 matchExpressions:
2607 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2608 items:
2609 description: |-
2610 A label selector requirement is a selector that contains values, a key, and an operator that
2611 relates the key and values.
2612 properties:
2613 key:
2614 description: key is the label key that the selector applies to.
2615 type: string
2616 operator:
2617 description: |-
2618 operator represents a key's relationship to a set of values.
2619 Valid operators are In, NotIn, Exists and DoesNotExist.
2620 type: string
2621 values:
2622 description: |-
2623 values is an array of string values. If the operator is In or NotIn,
2624 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2625 the values array must be empty. This array is replaced during a strategic
2626 merge patch.
2627 items:
2628 type: string
2629 type: array
2630 x-kubernetes-list-type: atomic
2631 required:
2632 - key
2633 - operator
2634 type: object
2635 type: array
2636 x-kubernetes-list-type: atomic
2637 matchLabels:
2638 additionalProperties:
2639 type: string
2640 description: |-
2641 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2642 map is equivalent to an element of matchExpressions, whose key field is "key", the
2643 operator is "In", and the values array contains only "value". The requirements are ANDed.
2644 type: object
2645 type: object
2646 x-kubernetes-map-type: atomic
2647 namespaces:
2648 description: |-
2649 namespaces specifies a static list of namespace names that the term applies to.
2650 The term is applied to the union of the namespaces listed in this field
2651 and the ones selected by namespaceSelector.
2652 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2653 items:
2654 type: string
2655 type: array
2656 x-kubernetes-list-type: atomic
2657 topologyKey:
2658 description: |-
2659 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2660 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2661 whose value of the label with key topologyKey matches that of any node on which any of the
2662 selected pods is running.
2663 Empty topologyKey is not allowed.
2664 type: string
2665 required:
2666 - topologyKey
2667 type: object
2668 type: array
2669 x-kubernetes-list-type: atomic
2670 type: object
2671 podAntiAffinity:
2672 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
2673 properties:
2674 preferredDuringSchedulingIgnoredDuringExecution:
2675 description: |-
2676 The scheduler will prefer to schedule pods to nodes that satisfy
2677 the anti-affinity expressions specified by this field, but it may choose
2678 a node that violates one or more of the expressions. The node that is
2679 most preferred is the one with the greatest sum of weights, i.e.
2680 for each node that meets all of the scheduling requirements (resource
2681 request, requiredDuringScheduling anti-affinity expressions, etc.),
2682 compute a sum by iterating through the elements of this field and subtracting
2683 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
2684 node(s) with the highest sum are the most preferred.
2685 items:
2686 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2687 properties:
2688 podAffinityTerm:
2689 description: Required. A pod affinity term, associated with the corresponding weight.
2690 properties:
2691 labelSelector:
2692 description: |-
2693 A label query over a set of resources, in this case pods.
2694 If it's null, this PodAffinityTerm matches with no Pods.
2695 properties:
2696 matchExpressions:
2697 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2698 items:
2699 description: |-
2700 A label selector requirement is a selector that contains values, a key, and an operator that
2701 relates the key and values.
2702 properties:
2703 key:
2704 description: key is the label key that the selector applies to.
2705 type: string
2706 operator:
2707 description: |-
2708 operator represents a key's relationship to a set of values.
2709 Valid operators are In, NotIn, Exists and DoesNotExist.
2710 type: string
2711 values:
2712 description: |-
2713 values is an array of string values. If the operator is In or NotIn,
2714 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2715 the values array must be empty. This array is replaced during a strategic
2716 merge patch.
2717 items:
2718 type: string
2719 type: array
2720 x-kubernetes-list-type: atomic
2721 required:
2722 - key
2723 - operator
2724 type: object
2725 type: array
2726 x-kubernetes-list-type: atomic
2727 matchLabels:
2728 additionalProperties:
2729 type: string
2730 description: |-
2731 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2732 map is equivalent to an element of matchExpressions, whose key field is "key", the
2733 operator is "In", and the values array contains only "value". The requirements are ANDed.
2734 type: object
2735 type: object
2736 x-kubernetes-map-type: atomic
2737 matchLabelKeys:
2738 description: |-
2739 MatchLabelKeys is a set of pod label keys to select which pods will
2740 be taken into consideration. The keys are used to lookup values from the
2741 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2742 to select the group of existing pods which pods will be taken into consideration
2743 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2744 pod labels will be ignored. The default value is empty.
2745 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2746 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2747 items:
2748 type: string
2749 type: array
2750 x-kubernetes-list-type: atomic
2751 mismatchLabelKeys:
2752 description: |-
2753 MismatchLabelKeys is a set of pod label keys to select which pods will
2754 be taken into consideration. The keys are used to lookup values from the
2755 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2756 to select the group of existing pods which pods will be taken into consideration
2757 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2758 pod labels will be ignored. The default value is empty.
2759 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2760 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2761 items:
2762 type: string
2763 type: array
2764 x-kubernetes-list-type: atomic
2765 namespaceSelector:
2766 description: |-
2767 A label query over the set of namespaces that the term applies to.
2768 The term is applied to the union of the namespaces selected by this field
2769 and the ones listed in the namespaces field.
2770 null selector and null or empty namespaces list means "this pod's namespace".
2771 An empty selector ({}) matches all namespaces.
2772 properties:
2773 matchExpressions:
2774 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2775 items:
2776 description: |-
2777 A label selector requirement is a selector that contains values, a key, and an operator that
2778 relates the key and values.
2779 properties:
2780 key:
2781 description: key is the label key that the selector applies to.
2782 type: string
2783 operator:
2784 description: |-
2785 operator represents a key's relationship to a set of values.
2786 Valid operators are In, NotIn, Exists and DoesNotExist.
2787 type: string
2788 values:
2789 description: |-
2790 values is an array of string values. If the operator is In or NotIn,
2791 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2792 the values array must be empty. This array is replaced during a strategic
2793 merge patch.
2794 items:
2795 type: string
2796 type: array
2797 x-kubernetes-list-type: atomic
2798 required:
2799 - key
2800 - operator
2801 type: object
2802 type: array
2803 x-kubernetes-list-type: atomic
2804 matchLabels:
2805 additionalProperties:
2806 type: string
2807 description: |-
2808 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2809 map is equivalent to an element of matchExpressions, whose key field is "key", the
2810 operator is "In", and the values array contains only "value". The requirements are ANDed.
2811 type: object
2812 type: object
2813 x-kubernetes-map-type: atomic
2814 namespaces:
2815 description: |-
2816 namespaces specifies a static list of namespace names that the term applies to.
2817 The term is applied to the union of the namespaces listed in this field
2818 and the ones selected by namespaceSelector.
2819 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2820 items:
2821 type: string
2822 type: array
2823 x-kubernetes-list-type: atomic
2824 topologyKey:
2825 description: |-
2826 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2827 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2828 whose value of the label with key topologyKey matches that of any node on which any of the
2829 selected pods is running.
2830 Empty topologyKey is not allowed.
2831 type: string
2832 required:
2833 - topologyKey
2834 type: object
2835 weight:
2836 description: |-
2837 weight associated with matching the corresponding podAffinityTerm,
2838 in the range 1-100.
2839 format: int32
2840 type: integer
2841 required:
2842 - podAffinityTerm
2843 - weight
2844 type: object
2845 type: array
2846 x-kubernetes-list-type: atomic
2847 requiredDuringSchedulingIgnoredDuringExecution:
2848 description: |-
2849 If the anti-affinity requirements specified by this field are not met at
2850 scheduling time, the pod will not be scheduled onto the node.
2851 If the anti-affinity requirements specified by this field cease to be met
2852 at some point during pod execution (e.g. due to a pod label update), the
2853 system may or may not try to eventually evict the pod from its node.
2854 When there are multiple elements, the lists of nodes corresponding to each
2855 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2856 items:
2857 description: |-
2858 Defines a set of pods (namely those matching the labelSelector
2859 relative to the given namespace(s)) that this pod should be
2860 co-located (affinity) or not co-located (anti-affinity) with,
2861 where co-located is defined as running on a node whose value of
2862 the label with key <topologyKey> matches that of any node on which
2863 a pod of the set of pods is running
2864 properties:
2865 labelSelector:
2866 description: |-
2867 A label query over a set of resources, in this case pods.
2868 If it's null, this PodAffinityTerm matches with no Pods.
2869 properties:
2870 matchExpressions:
2871 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2872 items:
2873 description: |-
2874 A label selector requirement is a selector that contains values, a key, and an operator that
2875 relates the key and values.
2876 properties:
2877 key:
2878 description: key is the label key that the selector applies to.
2879 type: string
2880 operator:
2881 description: |-
2882 operator represents a key's relationship to a set of values.
2883 Valid operators are In, NotIn, Exists and DoesNotExist.
2884 type: string
2885 values:
2886 description: |-
2887 values is an array of string values. If the operator is In or NotIn,
2888 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2889 the values array must be empty. This array is replaced during a strategic
2890 merge patch.
2891 items:
2892 type: string
2893 type: array
2894 x-kubernetes-list-type: atomic
2895 required:
2896 - key
2897 - operator
2898 type: object
2899 type: array
2900 x-kubernetes-list-type: atomic
2901 matchLabels:
2902 additionalProperties:
2903 type: string
2904 description: |-
2905 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2906 map is equivalent to an element of matchExpressions, whose key field is "key", the
2907 operator is "In", and the values array contains only "value". The requirements are ANDed.
2908 type: object
2909 type: object
2910 x-kubernetes-map-type: atomic
2911 matchLabelKeys:
2912 description: |-
2913 MatchLabelKeys is a set of pod label keys to select which pods will
2914 be taken into consideration. The keys are used to lookup values from the
2915 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2916 to select the group of existing pods which pods will be taken into consideration
2917 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2918 pod labels will be ignored. The default value is empty.
2919 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2920 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2921 items:
2922 type: string
2923 type: array
2924 x-kubernetes-list-type: atomic
2925 mismatchLabelKeys:
2926 description: |-
2927 MismatchLabelKeys is a set of pod label keys to select which pods will
2928 be taken into consideration. The keys are used to lookup values from the
2929 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2930 to select the group of existing pods which pods will be taken into consideration
2931 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2932 pod labels will be ignored. The default value is empty.
2933 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2934 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2935 items:
2936 type: string
2937 type: array
2938 x-kubernetes-list-type: atomic
2939 namespaceSelector:
2940 description: |-
2941 A label query over the set of namespaces that the term applies to.
2942 The term is applied to the union of the namespaces selected by this field
2943 and the ones listed in the namespaces field.
2944 null selector and null or empty namespaces list means "this pod's namespace".
2945 An empty selector ({}) matches all namespaces.
2946 properties:
2947 matchExpressions:
2948 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2949 items:
2950 description: |-
2951 A label selector requirement is a selector that contains values, a key, and an operator that
2952 relates the key and values.
2953 properties:
2954 key:
2955 description: key is the label key that the selector applies to.
2956 type: string
2957 operator:
2958 description: |-
2959 operator represents a key's relationship to a set of values.
2960 Valid operators are In, NotIn, Exists and DoesNotExist.
2961 type: string
2962 values:
2963 description: |-
2964 values is an array of string values. If the operator is In or NotIn,
2965 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2966 the values array must be empty. This array is replaced during a strategic
2967 merge patch.
2968 items:
2969 type: string
2970 type: array
2971 x-kubernetes-list-type: atomic
2972 required:
2973 - key
2974 - operator
2975 type: object
2976 type: array
2977 x-kubernetes-list-type: atomic
2978 matchLabels:
2979 additionalProperties:
2980 type: string
2981 description: |-
2982 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2983 map is equivalent to an element of matchExpressions, whose key field is "key", the
2984 operator is "In", and the values array contains only "value". The requirements are ANDed.
2985 type: object
2986 type: object
2987 x-kubernetes-map-type: atomic
2988 namespaces:
2989 description: |-
2990 namespaces specifies a static list of namespace names that the term applies to.
2991 The term is applied to the union of the namespaces listed in this field
2992 and the ones selected by namespaceSelector.
2993 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2994 items:
2995 type: string
2996 type: array
2997 x-kubernetes-list-type: atomic
2998 topologyKey:
2999 description: |-
3000 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
3001 the labelSelector in the specified namespaces, where co-located is defined as running on a node
3002 whose value of the label with key topologyKey matches that of any node on which any of the
3003 selected pods is running.
3004 Empty topologyKey is not allowed.
3005 type: string
3006 required:
3007 - topologyKey
3008 type: object
3009 type: array
3010 x-kubernetes-list-type: atomic
3011 type: object
3012 type: object
3013 imagePullSecrets:
3014 description: If specified, the pod's imagePullSecrets
3015 items:
3016 description: |-
3017 LocalObjectReference contains enough information to let you locate the
3018 referenced object inside the same namespace.
3019 properties:
3020 name:
3021 default: ""
3022 description: |-
3023 Name of the referent.
3024 This field is effectively required, but due to backwards compatibility is
3025 allowed to be empty. Instances of this type with an empty value here are
3026 almost certainly wrong.
3027 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3028 type: string
3029 type: object
3030 x-kubernetes-map-type: atomic
3031 type: array
3032 x-kubernetes-list-map-keys:
3033 - name
3034 x-kubernetes-list-type: map
3035 nodeSelector:
3036 additionalProperties:
3037 type: string
3038 description: |-
3039 NodeSelector is a selector which must be true for the pod to fit on a node.
3040 Selector which must match a node's labels for the pod to be scheduled on that node.
3041 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
3042 type: object
3043 priorityClassName:
3044 description: If specified, the pod's priorityClassName.
3045 type: string
3046 resources:
3047 description: |-
3048 If specified, the pod's resource requirements.
3049 These values override the global resource configuration flags.
3050 Note that when only specifying resource limits, ensure they are greater than or equal
3051 to the corresponding global resource requests configured via controller flags
3052 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
3053 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
3054 properties:
3055 limits:
3056 additionalProperties:
3057 anyOf:
3058 - type: integer
3059 - type: string
3060 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3061 x-kubernetes-int-or-string: true
3062 description: |-
3063 Limits describes the maximum amount of compute resources allowed.
3064 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3065 type: object
3066 requests:
3067 additionalProperties:
3068 anyOf:
3069 - type: integer
3070 - type: string
3071 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3072 x-kubernetes-int-or-string: true
3073 description: |-
3074 Requests describes the minimum amount of compute resources required.
3075 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
3076 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
3077 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3078 type: object
3079 type: object
3080 securityContext:
3081 description: If specified, the pod's security context
3082 properties:
3083 fsGroup:
3084 description: |-
3085 A special supplemental group that applies to all containers in a pod.
3086 Some volume types allow the Kubelet to change the ownership of that volume
3087 to be owned by the pod:
3088
3089 1. The owning GID will be the FSGroup
3090 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3091 3. The permission bits are OR'd with rw-rw----
3092
3093 If unset, the Kubelet will not modify the ownership and permissions of any volume.
3094 Note that this field cannot be set when spec.os.name is windows.
3095 format: int64
3096 type: integer
3097 fsGroupChangePolicy:
3098 description: |-
3099 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
3100 before being exposed inside Pod. This field will only apply to
3101 volume types which support fsGroup based ownership(and permissions).
3102 It will have no effect on ephemeral volume types such as: secret, configmaps
3103 and emptydir.
3104 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
3105 Note that this field cannot be set when spec.os.name is windows.
3106 type: string
3107 runAsGroup:
3108 description: |-
3109 The GID to run the entrypoint of the container process.
3110 Uses runtime default if unset.
3111 May also be set in SecurityContext. If set in both SecurityContext and
3112 PodSecurityContext, the value specified in SecurityContext takes precedence
3113 for that container.
3114 Note that this field cannot be set when spec.os.name is windows.
3115 format: int64
3116 type: integer
3117 runAsNonRoot:
3118 description: |-
3119 Indicates that the container must run as a non-root user.
3120 If true, the Kubelet will validate the image at runtime to ensure that it
3121 does not run as UID 0 (root) and fail to start the container if it does.
3122 If unset or false, no such validation will be performed.
3123 May also be set in SecurityContext. If set in both SecurityContext and
3124 PodSecurityContext, the value specified in SecurityContext takes precedence.
3125 type: boolean
3126 runAsUser:
3127 description: |-
3128 The UID to run the entrypoint of the container process.
3129 Defaults to user specified in image metadata if unspecified.
3130 May also be set in SecurityContext. If set in both SecurityContext and
3131 PodSecurityContext, the value specified in SecurityContext takes precedence
3132 for that container.
3133 Note that this field cannot be set when spec.os.name is windows.
3134 format: int64
3135 type: integer
3136 seLinuxOptions:
3137 description: |-
3138 The SELinux context to be applied to all containers.
3139 If unspecified, the container runtime will allocate a random SELinux context for each
3140 container. May also be set in SecurityContext. If set in
3141 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
3142 takes precedence for that container.
3143 Note that this field cannot be set when spec.os.name is windows.
3144 properties:
3145 level:
3146 description: Level is SELinux level label that applies to the container.
3147 type: string
3148 role:
3149 description: Role is a SELinux role label that applies to the container.
3150 type: string
3151 type:
3152 description: Type is a SELinux type label that applies to the container.
3153 type: string
3154 user:
3155 description: User is a SELinux user label that applies to the container.
3156 type: string
3157 type: object
3158 seccompProfile:
3159 description: |-
3160 The seccomp options to use by the containers in this pod.
3161 Note that this field cannot be set when spec.os.name is windows.
3162 properties:
3163 localhostProfile:
3164 description: |-
3165 localhostProfile indicates a profile defined in a file on the node should be used.
3166 The profile must be preconfigured on the node to work.
3167 Must be a descending path, relative to the kubelet's configured seccomp profile location.
3168 Must be set if type is "Localhost". Must NOT be set for any other type.
3169 type: string
3170 type:
3171 description: |-
3172 type indicates which kind of seccomp profile will be applied.
3173 Valid options are:
3174
3175 Localhost - a profile defined in a file on the node should be used.
3176 RuntimeDefault - the container runtime default profile should be used.
3177 Unconfined - no profile should be applied.
3178 type: string
3179 required:
3180 - type
3181 type: object
3182 supplementalGroups:
3183 description: |-
3184 A list of groups applied to the first process run in each container, in addition
3185 to the container's primary GID, the fsGroup (if specified), and group memberships
3186 defined in the container image for the uid of the container process. If unspecified,
3187 no additional groups are added to any container. Note that group memberships
3188 defined in the container image for the uid of the container process are still effective,
3189 even if they are not included in this list.
3190 Note that this field cannot be set when spec.os.name is windows.
3191 items:
3192 format: int64
3193 type: integer
3194 type: array
3195 x-kubernetes-list-type: atomic
3196 sysctls:
3197 description: |-
3198 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
3199 sysctls (by the container runtime) might fail to launch.
3200 Note that this field cannot be set when spec.os.name is windows.
3201 items:
3202 description: Sysctl defines a kernel parameter to be set
3203 properties:
3204 name:
3205 description: Name of a property to set
3206 type: string
3207 value:
3208 description: Value of a property to set
3209 type: string
3210 required:
3211 - name
3212 - value
3213 type: object
3214 type: array
3215 x-kubernetes-list-type: atomic
3216 type: object
3217 serviceAccountName:
3218 description: If specified, the pod's service account
3219 type: string
3220 tolerations:
3221 description: If specified, the pod's tolerations.
3222 items:
3223 description: |-
3224 The pod this Toleration is attached to tolerates any taint that matches
3225 the triple <key,value,effect> using the matching operator <operator>.
3226 properties:
3227 effect:
3228 description: |-
3229 Effect indicates the taint effect to match. Empty means match all taint effects.
3230 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
3231 type: string
3232 key:
3233 description: |-
3234 Key is the taint key that the toleration applies to. Empty means match all taint keys.
3235 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
3236 type: string
3237 operator:
3238 description: |-
3239 Operator represents a key's relationship to the value.
3240 Valid operators are Exists and Equal. Defaults to Equal.
3241 Exists is equivalent to wildcard for value, so that a pod can
3242 tolerate all taints of a particular category.
3243 type: string
3244 tolerationSeconds:
3245 description: |-
3246 TolerationSeconds represents the period of time the toleration (which must be
3247 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
3248 it is not set, which means tolerate the taint forever (do not evict). Zero and
3249 negative values will be treated as 0 (evict immediately) by the system.
3250 format: int64
3251 type: integer
3252 value:
3253 description: |-
3254 Value is the taint value the toleration matches to.
3255 If the operator is Exists, the value should be empty, otherwise just a regular string.
3256 type: string
3257 type: object
3258 type: array
3259 x-kubernetes-list-type: atomic
3260 type: object
3261 type: object
3262 serviceType:
3263 description: |-
3264 Optional service type for Kubernetes solver service. Supported values
3265 are NodePort or ClusterIP. If unset, defaults to NodePort.
3266 type: string
3267 type: object
3268 type: object
3269 selector:
3270 description: |-
3271 Selector selects a set of DNSNames on the Certificate resource that
3272 should be solved using this challenge solver.
3273 If not specified, the solver will be treated as the 'default' solver
3274 with the lowest priority, i.e. if any other solver has a more specific
3275 match, it will be used instead.
3276 properties:
3277 dnsNames:
3278 description: |-
3279 List of DNSNames that this solver will be used to solve.
3280 If specified and a match is found, a dnsNames selector will take
3281 precedence over a dnsZones selector.
3282 If multiple solvers match with the same dnsNames value, the solver
3283 with the most matching labels in matchLabels will be selected.
3284 If neither has more matches, the solver defined earlier in the list
3285 will be selected.
3286 items:
3287 type: string
3288 type: array
3289 x-kubernetes-list-type: atomic
3290 dnsZones:
3291 description: |-
3292 List of DNSZones that this solver will be used to solve.
3293 The most specific DNS zone match specified here will take precedence
3294 over other DNS zone matches, so a solver specifying sys.example.com
3295 will be selected over one specifying example.com for the domain
3296 www.sys.example.com.
3297 If multiple solvers match with the same dnsZones value, the solver
3298 with the most matching labels in matchLabels will be selected.
3299 If neither has more matches, the solver defined earlier in the list
3300 will be selected.
3301 items:
3302 type: string
3303 type: array
3304 x-kubernetes-list-type: atomic
3305 matchLabels:
3306 additionalProperties:
3307 type: string
3308 description: |-
3309 A label selector that is used to refine the set of certificate's that
3310 this challenge solver will apply to.
3311 type: object
3312 type: object
3313 type: object
3314 type: array
3315 x-kubernetes-list-type: atomic
3316 required:
3317 - privateKeySecretRef
3318 - server
3319 type: object
3320 ca:
3321 description: |-
3322 CA configures this issuer to sign certificates using a signing CA keypair
3323 stored in a Secret resource.
3324 This is used to build internal PKIs that are managed by cert-manager.
3325 properties:
3326 crlDistributionPoints:
3327 description: |-
3328 The CRL distribution points is an X.509 v3 certificate extension which identifies
3329 the location of the CRL from which the revocation of this certificate can be checked.
3330 If not set, certificates will be issued without distribution points set.
3331 items:
3332 type: string
3333 type: array
3334 x-kubernetes-list-type: atomic
3335 issuingCertificateURLs:
3336 description: |-
3337 IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
3338 it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
3339 As an example, such a URL might be "http://ca.domain.com/ca.crt".
3340 items:
3341 type: string
3342 type: array
3343 x-kubernetes-list-type: atomic
3344 ocspServers:
3345 description: |-
3346 The OCSP server list is an X.509 v3 extension that defines a list of
3347 URLs of OCSP responders. The OCSP responders can be queried for the
3348 revocation status of an issued certificate. If not set, the
3349 certificate will be issued with no OCSP servers set. For example, an
3350 OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
3351 items:
3352 type: string
3353 type: array
3354 x-kubernetes-list-type: atomic
3355 secretName:
3356 description: |-
3357 SecretName is the name of the secret used to sign Certificates issued
3358 by this Issuer.
3359 type: string
3360 required:
3361 - secretName
3362 type: object
3363 selfSigned:
3364 description: |-
3365 SelfSigned configures this issuer to 'self sign' certificates using the
3366 private key used to create the CertificateRequest object.
3367 properties:
3368 crlDistributionPoints:
3369 description: |-
3370 The CRL distribution points is an X.509 v3 certificate extension which identifies
3371 the location of the CRL from which the revocation of this certificate can be checked.
3372 If not set certificate will be issued without CDP. Values are strings.
3373 items:
3374 type: string
3375 type: array
3376 x-kubernetes-list-type: atomic
3377 type: object
3378 vault:
3379 description: |-
3380 Vault configures this issuer to sign certificates using a HashiCorp Vault
3381 PKI backend.
3382 properties:
3383 auth:
3384 description: Auth configures how cert-manager authenticates with the Vault server.
3385 properties:
3386 appRole:
3387 description: |-
3388 AppRole authenticates with Vault using the App Role auth mechanism,
3389 with the role and secret stored in a Kubernetes Secret resource.
3390 properties:
3391 path:
3392 description: |-
3393 Path where the App Role authentication backend is mounted in Vault, e.g:
3394 "approle"
3395 type: string
3396 roleId:
3397 description: |-
3398 RoleID configured in the App Role authentication backend when setting
3399 up the authentication backend in Vault.
3400 type: string
3401 secretRef:
3402 description: |-
3403 Reference to a key in a Secret that contains the App Role secret used
3404 to authenticate with Vault.
3405 The `key` field must be specified and denotes which entry within the Secret
3406 resource is used as the app role secret.
3407 properties:
3408 key:
3409 description: |-
3410 The key of the entry in the Secret resource's `data` field to be used.
3411 Some instances of this field may be defaulted, in others it may be
3412 required.
3413 type: string
3414 name:
3415 description: |-
3416 Name of the resource being referred to.
3417 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3418 type: string
3419 required:
3420 - name
3421 type: object
3422 required:
3423 - path
3424 - roleId
3425 - secretRef
3426 type: object
3427 clientCertificate:
3428 description: |-
3429 ClientCertificate authenticates with Vault by presenting a client
3430 certificate during the request's TLS handshake.
3431 Works only when using HTTPS protocol.
3432 properties:
3433 mountPath:
3434 description: |-
3435 The Vault mountPath here is the mount path to use when authenticating with
3436 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3437 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3438 default value "/v1/auth/cert" will be used.
3439 type: string
3440 name:
3441 description: |-
3442 Name of the certificate role to authenticate against.
3443 If not set, matching any certificate role, if available.
3444 type: string
3445 secretName:
3446 description: |-
3447 Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
3448 tls.crt and tls.key) used to authenticate to Vault using TLS client
3449 authentication.
3450 type: string
3451 type: object
3452 kubernetes:
3453 description: |-
3454 Kubernetes authenticates with Vault by passing the ServiceAccount
3455 token stored in the named Secret resource to the Vault server.
3456 properties:
3457 mountPath:
3458 description: |-
3459 The Vault mountPath here is the mount path to use when authenticating with
3460 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3461 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3462 default value "/v1/auth/kubernetes" will be used.
3463 type: string
3464 role:
3465 description: |-
3466 A required field containing the Vault Role to assume. A Role binds a
3467 Kubernetes ServiceAccount with a set of Vault policies.
3468 type: string
3469 secretRef:
3470 description: |-
3471 The required Secret field containing a Kubernetes ServiceAccount JWT used
3472 for authenticating with Vault. Use of 'ambient credentials' is not
3473 supported.
3474 properties:
3475 key:
3476 description: |-
3477 The key of the entry in the Secret resource's `data` field to be used.
3478 Some instances of this field may be defaulted, in others it may be
3479 required.
3480 type: string
3481 name:
3482 description: |-
3483 Name of the resource being referred to.
3484 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3485 type: string
3486 required:
3487 - name
3488 type: object
3489 serviceAccountRef:
3490 description: |-
3491 A reference to a service account that will be used to request a bound
3492 token (also known as "projected token"). Compared to using "secretRef",
3493 using this field means that you don't rely on statically bound tokens. To
3494 use this field, you must configure an RBAC rule to let cert-manager
3495 request a token.
3496 properties:
3497 audiences:
3498 description: |-
3499 TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
3500 consisting of the issuer's namespace and name is always included.
3501 items:
3502 type: string
3503 type: array
3504 x-kubernetes-list-type: atomic
3505 name:
3506 description: Name of the ServiceAccount used to request a token.
3507 type: string
3508 required:
3509 - name
3510 type: object
3511 required:
3512 - role
3513 type: object
3514 tokenSecretRef:
3515 description: TokenSecretRef authenticates with Vault by presenting a token.
3516 properties:
3517 key:
3518 description: |-
3519 The key of the entry in the Secret resource's `data` field to be used.
3520 Some instances of this field may be defaulted, in others it may be
3521 required.
3522 type: string
3523 name:
3524 description: |-
3525 Name of the resource being referred to.
3526 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3527 type: string
3528 required:
3529 - name
3530 type: object
3531 type: object
3532 caBundle:
3533 description: |-
3534 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3535 chain presented by Vault. Only used if using HTTPS to connect to Vault and
3536 ignored for HTTP connections.
3537 Mutually exclusive with CABundleSecretRef.
3538 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3539 the cert-manager controller container is used to validate the TLS connection.
3540 format: byte
3541 type: string
3542 caBundleSecretRef:
3543 description: |-
3544 Reference to a Secret containing a bundle of PEM-encoded CAs to use when
3545 verifying the certificate chain presented by Vault when using HTTPS.
3546 Mutually exclusive with CABundle.
3547 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3548 the cert-manager controller container is used to validate the TLS connection.
3549 If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
3550 properties:
3551 key:
3552 description: |-
3553 The key of the entry in the Secret resource's `data` field to be used.
3554 Some instances of this field may be defaulted, in others it may be
3555 required.
3556 type: string
3557 name:
3558 description: |-
3559 Name of the resource being referred to.
3560 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3561 type: string
3562 required:
3563 - name
3564 type: object
3565 clientCertSecretRef:
3566 description: |-
3567 Reference to a Secret containing a PEM-encoded Client Certificate to use when the
3568 Vault server requires mTLS.
3569 properties:
3570 key:
3571 description: |-
3572 The key of the entry in the Secret resource's `data` field to be used.
3573 Some instances of this field may be defaulted, in others it may be
3574 required.
3575 type: string
3576 name:
3577 description: |-
3578 Name of the resource being referred to.
3579 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3580 type: string
3581 required:
3582 - name
3583 type: object
3584 clientKeySecretRef:
3585 description: |-
3586 Reference to a Secret containing a PEM-encoded Client Private Key to use when the
3587 Vault server requires mTLS.
3588 properties:
3589 key:
3590 description: |-
3591 The key of the entry in the Secret resource's `data` field to be used.
3592 Some instances of this field may be defaulted, in others it may be
3593 required.
3594 type: string
3595 name:
3596 description: |-
3597 Name of the resource being referred to.
3598 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3599 type: string
3600 required:
3601 - name
3602 type: object
3603 namespace:
3604 description: |-
3605 Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
3606 More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
3607 type: string
3608 path:
3609 description: |-
3610 Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
3611 "my_pki_mount/sign/my-role-name".
3612 type: string
3613 server:
3614 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
3615 type: string
3616 serverName:
3617 description: |-
3618 ServerName is used to verify the hostname on the returned certificates
3619 by the Vault server.
3620 type: string
3621 required:
3622 - auth
3623 - path
3624 - server
3625 type: object
3626 venafi:
3627 description: |-
3628 Venafi configures this issuer to sign certificates using a Venafi TPP
3629 or Venafi Cloud policy zone.
3630 properties:
3631 cloud:
3632 description: |-
3633 Cloud specifies the Venafi cloud configuration settings.
3634 Only one of TPP or Cloud may be specified.
3635 properties:
3636 apiTokenSecretRef:
3637 description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
3638 properties:
3639 key:
3640 description: |-
3641 The key of the entry in the Secret resource's `data` field to be used.
3642 Some instances of this field may be defaulted, in others it may be
3643 required.
3644 type: string
3645 name:
3646 description: |-
3647 Name of the resource being referred to.
3648 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3649 type: string
3650 required:
3651 - name
3652 type: object
3653 url:
3654 description: |-
3655 URL is the base URL for Venafi Cloud.
3656 Defaults to "https://api.venafi.cloud/".
3657 type: string
3658 required:
3659 - apiTokenSecretRef
3660 type: object
3661 tpp:
3662 description: |-
3663 TPP specifies Trust Protection Platform configuration settings.
3664 Only one of TPP or Cloud may be specified.
3665 properties:
3666 caBundle:
3667 description: |-
3668 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3669 chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
3670 If undefined, the certificate bundle in the cert-manager controller container
3671 is used to validate the chain.
3672 format: byte
3673 type: string
3674 caBundleSecretRef:
3675 description: |-
3676 Reference to a Secret containing a base64-encoded bundle of PEM CAs
3677 which will be used to validate the certificate chain presented by the TPP server.
3678 Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
3679 If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
3680 the cert-manager controller container is used to validate the TLS connection.
3681 properties:
3682 key:
3683 description: |-
3684 The key of the entry in the Secret resource's `data` field to be used.
3685 Some instances of this field may be defaulted, in others it may be
3686 required.
3687 type: string
3688 name:
3689 description: |-
3690 Name of the resource being referred to.
3691 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3692 type: string
3693 required:
3694 - name
3695 type: object
3696 credentialsRef:
3697 description: |-
3698 CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
3699 The secret must contain the key 'access-token' for the Access Token Authentication,
3700 or two keys, 'username' and 'password' for the API Keys Authentication.
3701 properties:
3702 name:
3703 description: |-
3704 Name of the resource being referred to.
3705 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3706 type: string
3707 required:
3708 - name
3709 type: object
3710 url:
3711 description: |-
3712 URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
3713 for example: "https://tpp.example.com/vedsdk".
3714 type: string
3715 required:
3716 - credentialsRef
3717 - url
3718 type: object
3719 zone:
3720 description: |-
3721 Zone is the Venafi Policy Zone to use for this issuer.
3722 All requests made to the Venafi platform will be restricted by the named
3723 zone policy.
3724 This field is required.
3725 type: string
3726 required:
3727 - zone
3728 type: object
3729 type: object
3730 status:
3731 description: Status of the ClusterIssuer. This is set and managed automatically.
3732 properties:
3733 acme:
3734 description: |-
3735 ACME specific status options.
3736 This field should only be set if the Issuer is configured to use an ACME
3737 server to issue certificates.
3738 properties:
3739 lastPrivateKeyHash:
3740 description: |-
3741 LastPrivateKeyHash is a hash of the private key associated with the latest
3742 registered ACME account, in order to track changes made to registered account
3743 associated with the Issuer
3744 type: string
3745 lastRegisteredEmail:
3746 description: |-
3747 LastRegisteredEmail is the email associated with the latest registered
3748 ACME account, in order to track changes made to registered account
3749 associated with the Issuer
3750 type: string
3751 uri:
3752 description: |-
3753 URI is the unique account identifier, which can also be used to retrieve
3754 account details from the CA
3755 type: string
3756 type: object
3757 conditions:
3758 description: |-
3759 List of status conditions to indicate the status of a CertificateRequest.
3760 Known condition types are `Ready`.
3761 items:
3762 description: IssuerCondition contains condition information for an Issuer.
3763 properties:
3764 lastTransitionTime:
3765 description: |-
3766 LastTransitionTime is the timestamp corresponding to the last status
3767 change of this condition.
3768 format: date-time
3769 type: string
3770 message:
3771 description: |-
3772 Message is a human readable description of the details of the last
3773 transition, complementing reason.
3774 type: string
3775 observedGeneration:
3776 description: |-
3777 If set, this represents the .metadata.generation that the condition was
3778 set based upon.
3779 For instance, if .metadata.generation is currently 12, but the
3780 .status.condition[x].observedGeneration is 9, the condition is out of date
3781 with respect to the current state of the Issuer.
3782 format: int64
3783 type: integer
3784 reason:
3785 description: |-
3786 Reason is a brief machine readable explanation for the condition's last
3787 transition.
3788 type: string
3789 status:
3790 description: Status of the condition, one of (`True`, `False`, `Unknown`).
3791 enum:
3792 - "True"
3793 - "False"
3794 - Unknown
3795 type: string
3796 type:
3797 description: Type of the condition, known values are (`Ready`).
3798 type: string
3799 required:
3800 - status
3801 - type
3802 type: object
3803 type: array
3804 x-kubernetes-list-map-keys:
3805 - type
3806 x-kubernetes-list-type: map
3807 type: object
3808 required:
3809 - spec
3810 type: object
3811 served: true
3812 storage: true
3813 subresources:
3814 status: {}
3815{{- end }}