Gitiles
Code Review Sign In
code.v1.dodo.cloud / pcloud / 15aa6635e26a1a6c4b9d6dccfd96d6e0c7a3f723 / . / charts / cert-manager / templates / crd-cert-manager.io_clusterissuers.yaml
blob: f5de226121f0bce71d2f53c1285c39245e28682a [file] [log] [blame]
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "clusterissuers.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: ClusterIssuer
18 listKind: ClusterIssuerList
19 plural: clusterissuers
20 shortNames:
21 - ciss
22 singular: clusterissuer
23 scope: Cluster
24 versions:
25 - additionalPrinterColumns:
26 - jsonPath: .status.conditions[?(@.type == "Ready")].status
27 name: Ready
28 type: string
29 - jsonPath: .status.conditions[?(@.type == "Ready")].message
30 name: Status
31 priority: 1
32 type: string
33 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
34 jsonPath: .metadata.creationTimestamp
35 name: Age
36 type: date
37 name: v1
38 schema:
39 openAPIV3Schema:
40 description: |-
41 A ClusterIssuer represents a certificate issuing authority which can be
42 referenced as part of `issuerRef` fields.
43 It is similar to an Issuer, however it is cluster-scoped and therefore can
44 be referenced by resources that exist in *any* namespace, not just the same
45 namespace as the referent.
46 properties:
47 apiVersion:
48 description: |-
49 APIVersion defines the versioned schema of this representation of an object.
50 Servers should convert recognized schemas to the latest internal value, and
51 may reject unrecognized values.
52 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
53 type: string
54 kind:
55 description: |-
56 Kind is a string value representing the REST resource this object represents.
57 Servers may infer this from the endpoint the client submits requests to.
58 Cannot be updated.
59 In CamelCase.
60 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
61 type: string
62 metadata:
63 type: object
64 spec:
65 description: Desired state of the ClusterIssuer resource.
66 properties:
67 acme:
68 description: |-
69 ACME configures this issuer to communicate with a RFC8555 (ACME) server
70 to obtain signed x509 certificates.
71 properties:
72 caBundle:
73 description: |-
74 Base64-encoded bundle of PEM CAs which can be used to validate the certificate
75 chain presented by the ACME server.
76 Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
77 kinds of security vulnerabilities.
78 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
79 the container is used to validate the TLS connection.
80 format: byte
81 type: string
82 disableAccountKeyGeneration:
83 description: |-
84 Enables or disables generating a new ACME account key.
85 If true, the Issuer resource will *not* request a new account but will expect
86 the account key to be supplied via an existing secret.
87 If false, the cert-manager system will generate a new ACME account key
88 for the Issuer.
89 Defaults to false.
90 type: boolean
91 email:
92 description: |-
93 Email is the email address to be associated with the ACME account.
94 This field is optional, but it is strongly recommended to be set.
95 It will be used to contact you in case of issues with your account or
96 certificates, including expiry notification emails.
97 This field may be updated after the account is initially registered.
98 type: string
99 enableDurationFeature:
100 description: |-
101 Enables requesting a Not After date on certificates that matches the
102 duration of the certificate. This is not supported by all ACME servers
103 like Let's Encrypt. If set to true when the ACME server does not support
104 it, it will create an error on the Order.
105 Defaults to false.
106 type: boolean
107 externalAccountBinding:
108 description: |-
109 ExternalAccountBinding is a reference to a CA external account of the ACME
110 server.
111 If set, upon registration cert-manager will attempt to associate the given
112 external account credentials with the registered ACME account.
113 properties:
114 keyAlgorithm:
115 description: |-
116 Deprecated: keyAlgorithm field exists for historical compatibility
117 reasons and should not be used. The algorithm is now hardcoded to HS256
118 in golang/x/crypto/acme.
119 enum:
120 - HS256
121 - HS384
122 - HS512
123 type: string
124 keyID:
125 description: keyID is the ID of the CA key that the External Account is bound to.
126 type: string
127 keySecretRef:
128 description: |-
129 keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
130 Secret which holds the symmetric MAC key of the External Account Binding.
131 The `key` is the index string that is paired with the key data in the
132 Secret and should not be confused with the key data itself, or indeed with
133 the External Account Binding keyID above.
134 The secret key stored in the Secret **must** be un-padded, base64 URL
135 encoded data.
136 properties:
137 key:
138 description: |-
139 The key of the entry in the Secret resource's `data` field to be used.
140 Some instances of this field may be defaulted, in others it may be
141 required.
142 type: string
143 name:
144 description: |-
145 Name of the resource being referred to.
146 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
147 type: string
148 required:
149 - name
150 type: object
151 required:
152 - keyID
153 - keySecretRef
154 type: object
155 preferredChain:
156 description: |-
157 PreferredChain is the chain to use if the ACME server outputs multiple.
158 PreferredChain is no guarantee that this one gets delivered by the ACME
159 endpoint.
160 For example, for Let's Encrypt's DST cross-sign you would use:
161 "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
162 This value picks the first certificate bundle in the combined set of
163 ACME default and alternative chains that has a root-most certificate with
164 this value as its issuer's commonname.
165 maxLength: 64
166 type: string
167 privateKeySecretRef:
168 description: |-
169 PrivateKey is the name of a Kubernetes Secret resource that will be used to
170 store the automatically generated ACME account private key.
171 Optionally, a `key` may be specified to select a specific entry within
172 the named Secret resource.
173 If `key` is not specified, a default of `tls.key` will be used.
174 properties:
175 key:
176 description: |-
177 The key of the entry in the Secret resource's `data` field to be used.
178 Some instances of this field may be defaulted, in others it may be
179 required.
180 type: string
181 name:
182 description: |-
183 Name of the resource being referred to.
184 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
185 type: string
186 required:
187 - name
188 type: object
189 profile:
190 description: |-
191 Profile allows requesting a certificate profile from the ACME server.
192 Supported profiles are listed by the server's ACME directory URL.
193 type: string
194 server:
195 description: |-
196 Server is the URL used to access the ACME server's 'directory' endpoint.
197 For example, for Let's Encrypt's staging endpoint, you would use:
198 "https://acme-staging-v02.api.letsencrypt.org/directory".
199 Only ACME v2 endpoints (i.e. RFC 8555) are supported.
200 type: string
201 skipTLSVerify:
202 description: |-
203 INSECURE: Enables or disables validation of the ACME server TLS certificate.
204 If true, requests to the ACME server will not have the TLS certificate chain
205 validated.
206 Mutually exclusive with CABundle; prefer using CABundle to prevent various
207 kinds of security vulnerabilities.
208 Only enable this option in development environments.
209 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
210 the container is used to validate the TLS connection.
211 Defaults to false.
212 type: boolean
213 solvers:
214 description: |-
215 Solvers is a list of challenge solvers that will be used to solve
216 ACME challenges for the matching domains.
217 Solver configurations must be provided in order to obtain certificates
218 from an ACME server.
219 For more information, see: https://cert-manager.io/docs/configuration/acme/
220 items:
221 description: |-
222 An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
223 A selector may be provided to use different solving strategies for different DNS names.
224 Only one of HTTP01 or DNS01 must be provided.
225 properties:
226 dns01:
227 description: |-
228 Configures cert-manager to attempt to complete authorizations by
229 performing the DNS01 challenge flow.
230 properties:
231 acmeDNS:
232 description: |-
233 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
234 DNS01 challenge records.
235 properties:
236 accountSecretRef:
237 description: |-
238 A reference to a specific 'key' within a Secret resource.
239 In some instances, `key` is a required field.
240 properties:
241 key:
242 description: |-
243 The key of the entry in the Secret resource's `data` field to be used.
244 Some instances of this field may be defaulted, in others it may be
245 required.
246 type: string
247 name:
248 description: |-
249 Name of the resource being referred to.
250 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
251 type: string
252 required:
253 - name
254 type: object
255 host:
256 type: string
257 required:
258 - accountSecretRef
259 - host
260 type: object
261 akamai:
262 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
263 properties:
264 accessTokenSecretRef:
265 description: |-
266 A reference to a specific 'key' within a Secret resource.
267 In some instances, `key` is a required field.
268 properties:
269 key:
270 description: |-
271 The key of the entry in the Secret resource's `data` field to be used.
272 Some instances of this field may be defaulted, in others it may be
273 required.
274 type: string
275 name:
276 description: |-
277 Name of the resource being referred to.
278 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
279 type: string
280 required:
281 - name
282 type: object
283 clientSecretSecretRef:
284 description: |-
285 A reference to a specific 'key' within a Secret resource.
286 In some instances, `key` is a required field.
287 properties:
288 key:
289 description: |-
290 The key of the entry in the Secret resource's `data` field to be used.
291 Some instances of this field may be defaulted, in others it may be
292 required.
293 type: string
294 name:
295 description: |-
296 Name of the resource being referred to.
297 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
298 type: string
299 required:
300 - name
301 type: object
302 clientTokenSecretRef:
303 description: |-
304 A reference to a specific 'key' within a Secret resource.
305 In some instances, `key` is a required field.
306 properties:
307 key:
308 description: |-
309 The key of the entry in the Secret resource's `data` field to be used.
310 Some instances of this field may be defaulted, in others it may be
311 required.
312 type: string
313 name:
314 description: |-
315 Name of the resource being referred to.
316 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
317 type: string
318 required:
319 - name
320 type: object
321 serviceConsumerDomain:
322 type: string
323 required:
324 - accessTokenSecretRef
325 - clientSecretSecretRef
326 - clientTokenSecretRef
327 - serviceConsumerDomain
328 type: object
329 azureDNS:
330 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
331 properties:
332 clientID:
333 description: |-
334 Auth: Azure Service Principal:
335 The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
336 If set, ClientSecret and TenantID must also be set.
337 type: string
338 clientSecretSecretRef:
339 description: |-
340 Auth: Azure Service Principal:
341 A reference to a Secret containing the password associated with the Service Principal.
342 If set, ClientID and TenantID must also be set.
343 properties:
344 key:
345 description: |-
346 The key of the entry in the Secret resource's `data` field to be used.
347 Some instances of this field may be defaulted, in others it may be
348 required.
349 type: string
350 name:
351 description: |-
352 Name of the resource being referred to.
353 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
354 type: string
355 required:
356 - name
357 type: object
358 environment:
359 description: name of the Azure environment (default AzurePublicCloud)
360 enum:
361 - AzurePublicCloud
362 - AzureChinaCloud
363 - AzureGermanCloud
364 - AzureUSGovernmentCloud
365 type: string
366 hostedZoneName:
367 description: name of the DNS zone that should be used
368 type: string
369 managedIdentity:
370 description: |-
371 Auth: Azure Workload Identity or Azure Managed Service Identity:
372 Settings to enable Azure Workload Identity or Azure Managed Service Identity
373 If set, ClientID, ClientSecret and TenantID must not be set.
374 properties:
375 clientID:
376 description: client ID of the managed identity, cannot be used at the same time as resourceID
377 type: string
378 resourceID:
379 description: |-
380 resource ID of the managed identity, cannot be used at the same time as clientID
381 Cannot be used for Azure Managed Service Identity
382 type: string
383 tenantID:
384 description: tenant ID of the managed identity, cannot be used at the same time as resourceID
385 type: string
386 type: object
387 resourceGroupName:
388 description: resource group the DNS zone is located in
389 type: string
390 subscriptionID:
391 description: ID of the Azure subscription
392 type: string
393 tenantID:
394 description: |-
395 Auth: Azure Service Principal:
396 The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
397 If set, ClientID and ClientSecret must also be set.
398 type: string
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]399 zoneType:
400 description: |-
401 ZoneType determines which type of Azure DNS zone to use.
402
403 Valid values are:
404 - AzurePublicZone (default): Use a public Azure DNS zone.
405 - AzurePrivateZone: Use an Azure Private DNS zone.
406
407 If not specified, AzurePublicZone is used.
408
409 Support for Azure Private DNS zones is currently
410 experimental and may change in future releases.
411 enum:
412 - AzurePublicZone
413 - AzurePrivateZone
414 type: string
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]415 required:
416 - resourceGroupName
417 - subscriptionID
418 type: object
419 cloudDNS:
420 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
421 properties:
422 hostedZoneName:
423 description: |-
424 HostedZoneName is an optional field that tells cert-manager in which
425 Cloud DNS zone the challenge record has to be created.
426 If left empty cert-manager will automatically choose a zone.
427 type: string
428 project:
429 type: string
430 serviceAccountSecretRef:
431 description: |-
432 A reference to a specific 'key' within a Secret resource.
433 In some instances, `key` is a required field.
434 properties:
435 key:
436 description: |-
437 The key of the entry in the Secret resource's `data` field to be used.
438 Some instances of this field may be defaulted, in others it may be
439 required.
440 type: string
441 name:
442 description: |-
443 Name of the resource being referred to.
444 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
445 type: string
446 required:
447 - name
448 type: object
449 required:
450 - project
451 type: object
452 cloudflare:
453 description: Use the Cloudflare API to manage DNS01 challenge records.
454 properties:
455 apiKeySecretRef:
456 description: |-
457 API key to use to authenticate with Cloudflare.
458 Note: using an API token to authenticate is now the recommended method
459 as it allows greater control of permissions.
460 properties:
461 key:
462 description: |-
463 The key of the entry in the Secret resource's `data` field to be used.
464 Some instances of this field may be defaulted, in others it may be
465 required.
466 type: string
467 name:
468 description: |-
469 Name of the resource being referred to.
470 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
471 type: string
472 required:
473 - name
474 type: object
475 apiTokenSecretRef:
476 description: API token used to authenticate with Cloudflare.
477 properties:
478 key:
479 description: |-
480 The key of the entry in the Secret resource's `data` field to be used.
481 Some instances of this field may be defaulted, in others it may be
482 required.
483 type: string
484 name:
485 description: |-
486 Name of the resource being referred to.
487 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
488 type: string
489 required:
490 - name
491 type: object
492 email:
493 description: Email of the account, only required when using API key based authentication.
494 type: string
495 type: object
496 cnameStrategy:
497 description: |-
498 CNAMEStrategy configures how the DNS01 provider should handle CNAME
499 records when found in DNS zones.
500 enum:
501 - None
502 - Follow
503 type: string
504 digitalocean:
505 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
506 properties:
507 tokenSecretRef:
508 description: |-
509 A reference to a specific 'key' within a Secret resource.
510 In some instances, `key` is a required field.
511 properties:
512 key:
513 description: |-
514 The key of the entry in the Secret resource's `data` field to be used.
515 Some instances of this field may be defaulted, in others it may be
516 required.
517 type: string
518 name:
519 description: |-
520 Name of the resource being referred to.
521 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
522 type: string
523 required:
524 - name
525 type: object
526 required:
527 - tokenSecretRef
528 type: object
529 rfc2136:
530 description: |-
531 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
532 to manage DNS01 challenge records.
533 properties:
534 nameserver:
535 description: |-
536 The IP address or hostname of an authoritative DNS server supporting
537 RFC2136 in the form host:port. If the host is an IPv6 address it must be
538 enclosed in square brackets (e.g [2001:db8::1]); port is optional.
539 This field is required.
540 type: string
541 protocol:
542 description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
543 enum:
544 - TCP
545 - UDP
546 type: string
547 tsigAlgorithm:
548 description: |-
549 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
550 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
551 Supported values are (case-insensitive): ``HMACMD5`` (default),
552 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
553 type: string
554 tsigKeyName:
555 description: |-
556 The TSIG Key name configured in the DNS.
557 If ``tsigSecretSecretRef`` is defined, this field is required.
558 type: string
559 tsigSecretSecretRef:
560 description: |-
561 The name of the secret containing the TSIG value.
562 If ``tsigKeyName`` is defined, this field is required.
563 properties:
564 key:
565 description: |-
566 The key of the entry in the Secret resource's `data` field to be used.
567 Some instances of this field may be defaulted, in others it may be
568 required.
569 type: string
570 name:
571 description: |-
572 Name of the resource being referred to.
573 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
574 type: string
575 required:
576 - name
577 type: object
578 required:
579 - nameserver
580 type: object
581 route53:
582 description: Use the AWS Route53 API to manage DNS01 challenge records.
583 properties:
584 accessKeyID:
585 description: |-
586 The AccessKeyID is used for authentication.
587 Cannot be set when SecretAccessKeyID is set.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]588 If neither the Access Key nor Key ID are set, we fall back to using env
589 vars, shared credentials file, or AWS Instance metadata,
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]590 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
591 type: string
592 accessKeyIDSecretRef:
593 description: |-
594 The SecretAccessKey is used for authentication. If set, pull the AWS
595 access key ID from a key within a Kubernetes Secret.
596 Cannot be set when AccessKeyID is set.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]597 If neither the Access Key nor Key ID are set, we fall back to using env
598 vars, shared credentials file, or AWS Instance metadata,
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]599 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
600 properties:
601 key:
602 description: |-
603 The key of the entry in the Secret resource's `data` field to be used.
604 Some instances of this field may be defaulted, in others it may be
605 required.
606 type: string
607 name:
608 description: |-
609 Name of the resource being referred to.
610 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
611 type: string
612 required:
613 - name
614 type: object
615 auth:
616 description: Auth configures how cert-manager authenticates.
617 properties:
618 kubernetes:
619 description: |-
620 Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
621 by passing a bound ServiceAccount token.
622 properties:
623 serviceAccountRef:
624 description: |-
625 A reference to a service account that will be used to request a bound
626 token (also known as "projected token"). To use this field, you must
627 configure an RBAC rule to let cert-manager request a token.
628 properties:
629 audiences:
630 description: |-
631 TokenAudiences is an optional list of audiences to include in the
632 token passed to AWS. The default token consisting of the issuer's namespace
633 and name is always included.
634 If unset the audience defaults to `sts.amazonaws.com`.
635 items:
636 type: string
637 type: array
638 x-kubernetes-list-type: atomic
639 name:
640 description: Name of the ServiceAccount used to request a token.
641 type: string
642 required:
643 - name
644 type: object
645 required:
646 - serviceAccountRef
647 type: object
648 required:
649 - kubernetes
650 type: object
651 hostedZoneID:
652 description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
653 type: string
654 region:
655 description: |-
656 Override the AWS region.
657
658 Route53 is a global service and does not have regional endpoints but the
659 region specified here (or via environment variables) is used as a hint to
660 help compute the correct AWS credential scope and partition when it
661 connects to Route53. See:
662 - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
663 - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
664
665 If you omit this region field, cert-manager will use the region from
666 AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
667 in the cert-manager controller Pod.
668
669 The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
670 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
671 [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
672 In this case this `region` field value is ignored.
673
674 The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
675 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
676 [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
677 In this case this `region` field value is ignored.
678 type: string
679 role:
680 description: |-
681 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
682 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
683 type: string
684 secretAccessKeySecretRef:
685 description: |-
686 The SecretAccessKey is used for authentication.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]687 If neither the Access Key nor Key ID are set, we fall back to using env
688 vars, shared credentials file, or AWS Instance metadata,
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]689 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
690 properties:
691 key:
692 description: |-
693 The key of the entry in the Secret resource's `data` field to be used.
694 Some instances of this field may be defaulted, in others it may be
695 required.
696 type: string
697 name:
698 description: |-
699 Name of the resource being referred to.
700 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
701 type: string
702 required:
703 - name
704 type: object
705 type: object
706 webhook:
707 description: |-
708 Configure an external webhook based DNS01 challenge solver to manage
709 DNS01 challenge records.
710 properties:
711 config:
712 description: |-
713 Additional configuration that should be passed to the webhook apiserver
714 when challenges are processed.
715 This can contain arbitrary JSON data.
716 Secret values should not be specified in this stanza.
717 If secret values are needed (e.g., credentials for a DNS service), you
718 should use a SecretKeySelector to reference a Secret resource.
719 For details on the schema of this field, consult the webhook provider
720 implementation's documentation.
721 x-kubernetes-preserve-unknown-fields: true
722 groupName:
723 description: |-
724 The API group name that should be used when POSTing ChallengePayload
725 resources to the webhook apiserver.
726 This should be the same as the GroupName specified in the webhook
727 provider implementation.
728 type: string
729 solverName:
730 description: |-
731 The name of the solver to use, as defined in the webhook provider
732 implementation.
733 This will typically be the name of the provider, e.g., 'cloudflare'.
734 type: string
735 required:
736 - groupName
737 - solverName
738 type: object
739 type: object
740 http01:
741 description: |-
742 Configures cert-manager to attempt to complete authorizations by
743 performing the HTTP01 challenge flow.
744 It is not possible to obtain certificates for wildcard domain names
745 (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
746 properties:
747 gatewayHTTPRoute:
748 description: |-
749 The Gateway API is a sig-network community API that models service networking
750 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
751 create HTTPRoutes with the specified labels in the same namespace as the challenge.
752 This solver is experimental, and fields / behaviour may change in the future.
753 properties:
754 labels:
755 additionalProperties:
756 type: string
757 description: |-
758 Custom labels that will be applied to HTTPRoutes created by cert-manager
759 while solving HTTP-01 challenges.
760 type: object
761 parentRefs:
762 description: |-
763 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
764 cert-manager needs to know which parentRefs should be used when creating
765 the HTTPRoute. Usually, the parentRef references a Gateway. See:
766 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
767 items:
768 description: |-
769 ParentReference identifies an API object (usually a Gateway) that can be considered
770 a parent of this resource (usually a route). There are two kinds of parent resources
771 with "Core" support:
772
773 * Gateway (Gateway conformance profile)
774 * Service (Mesh conformance profile, ClusterIP Services only)
775
776 This API may be extended in the future to support additional kinds of parent
777 resources.
778
779 The API object must be valid in the cluster; the Group and Kind must
780 be registered in the cluster for this reference to be valid.
781 properties:
782 group:
783 default: gateway.networking.k8s.io
784 description: |-
785 Group is the group of the referent.
786 When unspecified, "gateway.networking.k8s.io" is inferred.
787 To set the core API group (such as for a "Service" kind referent),
788 Group must be explicitly set to "" (empty string).
789
790 Support: Core
791 maxLength: 253
792 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
793 type: string
794 kind:
795 default: Gateway
796 description: |-
797 Kind is kind of the referent.
798
799 There are two kinds of parent resources with "Core" support:
800
801 * Gateway (Gateway conformance profile)
802 * Service (Mesh conformance profile, ClusterIP Services only)
803
804 Support for other resources is Implementation-Specific.
805 maxLength: 63
806 minLength: 1
807 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
808 type: string
809 name:
810 description: |-
811 Name is the name of the referent.
812
813 Support: Core
814 maxLength: 253
815 minLength: 1
816 type: string
817 namespace:
818 description: |-
819 Namespace is the namespace of the referent. When unspecified, this refers
820 to the local namespace of the Route.
821
822 Note that there are specific rules for ParentRefs which cross namespace
823 boundaries. Cross-namespace references are only valid if they are explicitly
824 allowed by something in the namespace they are referring to. For example:
825 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
826 generic way to enable any other kind of cross-namespace reference.
827
828 <gateway:experimental:description>
829 ParentRefs from a Route to a Service in the same namespace are "producer"
830 routes, which apply default routing rules to inbound connections from
831 any namespace to the Service.
832
833 ParentRefs from a Route to a Service in a different namespace are
834 "consumer" routes, and these routing rules are only applied to outbound
835 connections originating from the same namespace as the Route, for which
836 the intended destination of the connections are a Service targeted as a
837 ParentRef of the Route.
838 </gateway:experimental:description>
839
840 Support: Core
841 maxLength: 63
842 minLength: 1
843 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
844 type: string
845 port:
846 description: |-
847 Port is the network port this Route targets. It can be interpreted
848 differently based on the type of parent resource.
849
850 When the parent resource is a Gateway, this targets all listeners
851 listening on the specified port that also support this kind of Route(and
852 select this Route). It's not recommended to set `Port` unless the
853 networking behaviors specified in a Route must apply to a specific port
854 as opposed to a listener(s) whose port(s) may be changed. When both Port
855 and SectionName are specified, the name and port of the selected listener
856 must match both specified values.
857
858 <gateway:experimental:description>
859 When the parent resource is a Service, this targets a specific port in the
860 Service spec. When both Port (experimental) and SectionName are specified,
861 the name and port of the selected port must match both specified values.
862 </gateway:experimental:description>
863
864 Implementations MAY choose to support other parent resources.
865 Implementations supporting other types of parent resources MUST clearly
866 document how/if Port is interpreted.
867
868 For the purpose of status, an attachment is considered successful as
869 long as the parent resource accepts it partially. For example, Gateway
870 listeners can restrict which Routes can attach to them by Route kind,
871 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
872 from the referencing Route, the Route MUST be considered successfully
873 attached. If no Gateway listeners accept attachment from this Route,
874 the Route MUST be considered detached from the Gateway.
875
876 Support: Extended
877 format: int32
878 maximum: 65535
879 minimum: 1
880 type: integer
881 sectionName:
882 description: |-
883 SectionName is the name of a section within the target resource. In the
884 following resources, SectionName is interpreted as the following:
885
886 * Gateway: Listener name. When both Port (experimental) and SectionName
887 are specified, the name and port of the selected listener must match
888 both specified values.
889 * Service: Port name. When both Port (experimental) and SectionName
890 are specified, the name and port of the selected listener must match
891 both specified values.
892
893 Implementations MAY choose to support attaching Routes to other resources.
894 If that is the case, they MUST clearly document how SectionName is
895 interpreted.
896
897 When unspecified (empty string), this will reference the entire resource.
898 For the purpose of status, an attachment is considered successful if at
899 least one section in the parent resource accepts it. For example, Gateway
900 listeners can restrict which Routes can attach to them by Route kind,
901 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
902 the referencing Route, the Route MUST be considered successfully
903 attached. If no Gateway listeners accept attachment from this Route, the
904 Route MUST be considered detached from the Gateway.
905
906 Support: Core
907 maxLength: 253
908 minLength: 1
909 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
910 type: string
911 required:
912 - name
913 type: object
914 type: array
915 x-kubernetes-list-type: atomic
916 podTemplate:
917 description: |-
918 Optional pod template used to configure the ACME challenge solver pods
919 used for HTTP01 challenges.
920 properties:
921 metadata:
922 description: |-
923 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
924 Only the 'labels' and 'annotations' fields may be set.
925 If labels or annotations overlap with in-built values, the values here
926 will override the in-built values.
927 properties:
928 annotations:
929 additionalProperties:
930 type: string
931 description: Annotations that should be added to the created ACME HTTP01 solver pods.
932 type: object
933 labels:
934 additionalProperties:
935 type: string
936 description: Labels that should be added to the created ACME HTTP01 solver pods.
937 type: object
938 type: object
939 spec:
940 description: |-
941 PodSpec defines overrides for the HTTP01 challenge solver pod.
942 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
943 All other fields will be ignored.
944 properties:
945 affinity:
946 description: If specified, the pod's scheduling constraints
947 properties:
948 nodeAffinity:
949 description: Describes node affinity scheduling rules for the pod.
950 properties:
951 preferredDuringSchedulingIgnoredDuringExecution:
952 description: |-
953 The scheduler will prefer to schedule pods to nodes that satisfy
954 the affinity expressions specified by this field, but it may choose
955 a node that violates one or more of the expressions. The node that is
956 most preferred is the one with the greatest sum of weights, i.e.
957 for each node that meets all of the scheduling requirements (resource
958 request, requiredDuringScheduling affinity expressions, etc.),
959 compute a sum by iterating through the elements of this field and adding
960 "weight" to the sum if the node matches the corresponding matchExpressions; the
961 node(s) with the highest sum are the most preferred.
962 items:
963 description: |-
964 An empty preferred scheduling term matches all objects with implicit weight 0
965 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
966 properties:
967 preference:
968 description: A node selector term, associated with the corresponding weight.
969 properties:
970 matchExpressions:
971 description: A list of node selector requirements by node's labels.
972 items:
973 description: |-
974 A node selector requirement is a selector that contains values, a key, and an operator
975 that relates the key and values.
976 properties:
977 key:
978 description: The label key that the selector applies to.
979 type: string
980 operator:
981 description: |-
982 Represents a key's relationship to a set of values.
983 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
984 type: string
985 values:
986 description: |-
987 An array of string values. If the operator is In or NotIn,
988 the values array must be non-empty. If the operator is Exists or DoesNotExist,
989 the values array must be empty. If the operator is Gt or Lt, the values
990 array must have a single element, which will be interpreted as an integer.
991 This array is replaced during a strategic merge patch.
992 items:
993 type: string
994 type: array
995 x-kubernetes-list-type: atomic
996 required:
997 - key
998 - operator
999 type: object
1000 type: array
1001 x-kubernetes-list-type: atomic
1002 matchFields:
1003 description: A list of node selector requirements by node's fields.
1004 items:
1005 description: |-
1006 A node selector requirement is a selector that contains values, a key, and an operator
1007 that relates the key and values.
1008 properties:
1009 key:
1010 description: The label key that the selector applies to.
1011 type: string
1012 operator:
1013 description: |-
1014 Represents a key's relationship to a set of values.
1015 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1016 type: string
1017 values:
1018 description: |-
1019 An array of string values. If the operator is In or NotIn,
1020 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1021 the values array must be empty. If the operator is Gt or Lt, the values
1022 array must have a single element, which will be interpreted as an integer.
1023 This array is replaced during a strategic merge patch.
1024 items:
1025 type: string
1026 type: array
1027 x-kubernetes-list-type: atomic
1028 required:
1029 - key
1030 - operator
1031 type: object
1032 type: array
1033 x-kubernetes-list-type: atomic
1034 type: object
1035 x-kubernetes-map-type: atomic
1036 weight:
1037 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
1038 format: int32
1039 type: integer
1040 required:
1041 - preference
1042 - weight
1043 type: object
1044 type: array
1045 x-kubernetes-list-type: atomic
1046 requiredDuringSchedulingIgnoredDuringExecution:
1047 description: |-
1048 If the affinity requirements specified by this field are not met at
1049 scheduling time, the pod will not be scheduled onto the node.
1050 If the affinity requirements specified by this field cease to be met
1051 at some point during pod execution (e.g. due to an update), the system
1052 may or may not try to eventually evict the pod from its node.
1053 properties:
1054 nodeSelectorTerms:
1055 description: Required. A list of node selector terms. The terms are ORed.
1056 items:
1057 description: |-
1058 A null or empty node selector term matches no objects. The requirements of
1059 them are ANDed.
1060 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
1061 properties:
1062 matchExpressions:
1063 description: A list of node selector requirements by node's labels.
1064 items:
1065 description: |-
1066 A node selector requirement is a selector that contains values, a key, and an operator
1067 that relates the key and values.
1068 properties:
1069 key:
1070 description: The label key that the selector applies to.
1071 type: string
1072 operator:
1073 description: |-
1074 Represents a key's relationship to a set of values.
1075 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1076 type: string
1077 values:
1078 description: |-
1079 An array of string values. If the operator is In or NotIn,
1080 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1081 the values array must be empty. If the operator is Gt or Lt, the values
1082 array must have a single element, which will be interpreted as an integer.
1083 This array is replaced during a strategic merge patch.
1084 items:
1085 type: string
1086 type: array
1087 x-kubernetes-list-type: atomic
1088 required:
1089 - key
1090 - operator
1091 type: object
1092 type: array
1093 x-kubernetes-list-type: atomic
1094 matchFields:
1095 description: A list of node selector requirements by node's fields.
1096 items:
1097 description: |-
1098 A node selector requirement is a selector that contains values, a key, and an operator
1099 that relates the key and values.
1100 properties:
1101 key:
1102 description: The label key that the selector applies to.
1103 type: string
1104 operator:
1105 description: |-
1106 Represents a key's relationship to a set of values.
1107 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1108 type: string
1109 values:
1110 description: |-
1111 An array of string values. If the operator is In or NotIn,
1112 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1113 the values array must be empty. If the operator is Gt or Lt, the values
1114 array must have a single element, which will be interpreted as an integer.
1115 This array is replaced during a strategic merge patch.
1116 items:
1117 type: string
1118 type: array
1119 x-kubernetes-list-type: atomic
1120 required:
1121 - key
1122 - operator
1123 type: object
1124 type: array
1125 x-kubernetes-list-type: atomic
1126 type: object
1127 x-kubernetes-map-type: atomic
1128 type: array
1129 x-kubernetes-list-type: atomic
1130 required:
1131 - nodeSelectorTerms
1132 type: object
1133 x-kubernetes-map-type: atomic
1134 type: object
1135 podAffinity:
1136 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
1137 properties:
1138 preferredDuringSchedulingIgnoredDuringExecution:
1139 description: |-
1140 The scheduler will prefer to schedule pods to nodes that satisfy
1141 the affinity expressions specified by this field, but it may choose
1142 a node that violates one or more of the expressions. The node that is
1143 most preferred is the one with the greatest sum of weights, i.e.
1144 for each node that meets all of the scheduling requirements (resource
1145 request, requiredDuringScheduling affinity expressions, etc.),
1146 compute a sum by iterating through the elements of this field and adding
1147 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
1148 node(s) with the highest sum are the most preferred.
1149 items:
1150 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1151 properties:
1152 podAffinityTerm:
1153 description: Required. A pod affinity term, associated with the corresponding weight.
1154 properties:
1155 labelSelector:
1156 description: |-
1157 A label query over a set of resources, in this case pods.
1158 If it's null, this PodAffinityTerm matches with no Pods.
1159 properties:
1160 matchExpressions:
1161 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1162 items:
1163 description: |-
1164 A label selector requirement is a selector that contains values, a key, and an operator that
1165 relates the key and values.
1166 properties:
1167 key:
1168 description: key is the label key that the selector applies to.
1169 type: string
1170 operator:
1171 description: |-
1172 operator represents a key's relationship to a set of values.
1173 Valid operators are In, NotIn, Exists and DoesNotExist.
1174 type: string
1175 values:
1176 description: |-
1177 values is an array of string values. If the operator is In or NotIn,
1178 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1179 the values array must be empty. This array is replaced during a strategic
1180 merge patch.
1181 items:
1182 type: string
1183 type: array
1184 x-kubernetes-list-type: atomic
1185 required:
1186 - key
1187 - operator
1188 type: object
1189 type: array
1190 x-kubernetes-list-type: atomic
1191 matchLabels:
1192 additionalProperties:
1193 type: string
1194 description: |-
1195 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1196 map is equivalent to an element of matchExpressions, whose key field is "key", the
1197 operator is "In", and the values array contains only "value". The requirements are ANDed.
1198 type: object
1199 type: object
1200 x-kubernetes-map-type: atomic
1201 matchLabelKeys:
1202 description: |-
1203 MatchLabelKeys is a set of pod label keys to select which pods will
1204 be taken into consideration. The keys are used to lookup values from the
1205 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1206 to select the group of existing pods which pods will be taken into consideration
1207 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1208 pod labels will be ignored. The default value is empty.
1209 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1210 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1211 items:
1212 type: string
1213 type: array
1214 x-kubernetes-list-type: atomic
1215 mismatchLabelKeys:
1216 description: |-
1217 MismatchLabelKeys is a set of pod label keys to select which pods will
1218 be taken into consideration. The keys are used to lookup values from the
1219 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1220 to select the group of existing pods which pods will be taken into consideration
1221 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1222 pod labels will be ignored. The default value is empty.
1223 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1224 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1225 items:
1226 type: string
1227 type: array
1228 x-kubernetes-list-type: atomic
1229 namespaceSelector:
1230 description: |-
1231 A label query over the set of namespaces that the term applies to.
1232 The term is applied to the union of the namespaces selected by this field
1233 and the ones listed in the namespaces field.
1234 null selector and null or empty namespaces list means "this pod's namespace".
1235 An empty selector ({}) matches all namespaces.
1236 properties:
1237 matchExpressions:
1238 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1239 items:
1240 description: |-
1241 A label selector requirement is a selector that contains values, a key, and an operator that
1242 relates the key and values.
1243 properties:
1244 key:
1245 description: key is the label key that the selector applies to.
1246 type: string
1247 operator:
1248 description: |-
1249 operator represents a key's relationship to a set of values.
1250 Valid operators are In, NotIn, Exists and DoesNotExist.
1251 type: string
1252 values:
1253 description: |-
1254 values is an array of string values. If the operator is In or NotIn,
1255 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1256 the values array must be empty. This array is replaced during a strategic
1257 merge patch.
1258 items:
1259 type: string
1260 type: array
1261 x-kubernetes-list-type: atomic
1262 required:
1263 - key
1264 - operator
1265 type: object
1266 type: array
1267 x-kubernetes-list-type: atomic
1268 matchLabels:
1269 additionalProperties:
1270 type: string
1271 description: |-
1272 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1273 map is equivalent to an element of matchExpressions, whose key field is "key", the
1274 operator is "In", and the values array contains only "value". The requirements are ANDed.
1275 type: object
1276 type: object
1277 x-kubernetes-map-type: atomic
1278 namespaces:
1279 description: |-
1280 namespaces specifies a static list of namespace names that the term applies to.
1281 The term is applied to the union of the namespaces listed in this field
1282 and the ones selected by namespaceSelector.
1283 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1284 items:
1285 type: string
1286 type: array
1287 x-kubernetes-list-type: atomic
1288 topologyKey:
1289 description: |-
1290 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1291 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1292 whose value of the label with key topologyKey matches that of any node on which any of the
1293 selected pods is running.
1294 Empty topologyKey is not allowed.
1295 type: string
1296 required:
1297 - topologyKey
1298 type: object
1299 weight:
1300 description: |-
1301 weight associated with matching the corresponding podAffinityTerm,
1302 in the range 1-100.
1303 format: int32
1304 type: integer
1305 required:
1306 - podAffinityTerm
1307 - weight
1308 type: object
1309 type: array
1310 x-kubernetes-list-type: atomic
1311 requiredDuringSchedulingIgnoredDuringExecution:
1312 description: |-
1313 If the affinity requirements specified by this field are not met at
1314 scheduling time, the pod will not be scheduled onto the node.
1315 If the affinity requirements specified by this field cease to be met
1316 at some point during pod execution (e.g. due to a pod label update), the
1317 system may or may not try to eventually evict the pod from its node.
1318 When there are multiple elements, the lists of nodes corresponding to each
1319 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1320 items:
1321 description: |-
1322 Defines a set of pods (namely those matching the labelSelector
1323 relative to the given namespace(s)) that this pod should be
1324 co-located (affinity) or not co-located (anti-affinity) with,
1325 where co-located is defined as running on a node whose value of
1326 the label with key <topologyKey> matches that of any node on which
1327 a pod of the set of pods is running
1328 properties:
1329 labelSelector:
1330 description: |-
1331 A label query over a set of resources, in this case pods.
1332 If it's null, this PodAffinityTerm matches with no Pods.
1333 properties:
1334 matchExpressions:
1335 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1336 items:
1337 description: |-
1338 A label selector requirement is a selector that contains values, a key, and an operator that
1339 relates the key and values.
1340 properties:
1341 key:
1342 description: key is the label key that the selector applies to.
1343 type: string
1344 operator:
1345 description: |-
1346 operator represents a key's relationship to a set of values.
1347 Valid operators are In, NotIn, Exists and DoesNotExist.
1348 type: string
1349 values:
1350 description: |-
1351 values is an array of string values. If the operator is In or NotIn,
1352 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1353 the values array must be empty. This array is replaced during a strategic
1354 merge patch.
1355 items:
1356 type: string
1357 type: array
1358 x-kubernetes-list-type: atomic
1359 required:
1360 - key
1361 - operator
1362 type: object
1363 type: array
1364 x-kubernetes-list-type: atomic
1365 matchLabels:
1366 additionalProperties:
1367 type: string
1368 description: |-
1369 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1370 map is equivalent to an element of matchExpressions, whose key field is "key", the
1371 operator is "In", and the values array contains only "value". The requirements are ANDed.
1372 type: object
1373 type: object
1374 x-kubernetes-map-type: atomic
1375 matchLabelKeys:
1376 description: |-
1377 MatchLabelKeys is a set of pod label keys to select which pods will
1378 be taken into consideration. The keys are used to lookup values from the
1379 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1380 to select the group of existing pods which pods will be taken into consideration
1381 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1382 pod labels will be ignored. The default value is empty.
1383 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1384 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1385 items:
1386 type: string
1387 type: array
1388 x-kubernetes-list-type: atomic
1389 mismatchLabelKeys:
1390 description: |-
1391 MismatchLabelKeys is a set of pod label keys to select which pods will
1392 be taken into consideration. The keys are used to lookup values from the
1393 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1394 to select the group of existing pods which pods will be taken into consideration
1395 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1396 pod labels will be ignored. The default value is empty.
1397 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1398 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1399 items:
1400 type: string
1401 type: array
1402 x-kubernetes-list-type: atomic
1403 namespaceSelector:
1404 description: |-
1405 A label query over the set of namespaces that the term applies to.
1406 The term is applied to the union of the namespaces selected by this field
1407 and the ones listed in the namespaces field.
1408 null selector and null or empty namespaces list means "this pod's namespace".
1409 An empty selector ({}) matches all namespaces.
1410 properties:
1411 matchExpressions:
1412 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1413 items:
1414 description: |-
1415 A label selector requirement is a selector that contains values, a key, and an operator that
1416 relates the key and values.
1417 properties:
1418 key:
1419 description: key is the label key that the selector applies to.
1420 type: string
1421 operator:
1422 description: |-
1423 operator represents a key's relationship to a set of values.
1424 Valid operators are In, NotIn, Exists and DoesNotExist.
1425 type: string
1426 values:
1427 description: |-
1428 values is an array of string values. If the operator is In or NotIn,
1429 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1430 the values array must be empty. This array is replaced during a strategic
1431 merge patch.
1432 items:
1433 type: string
1434 type: array
1435 x-kubernetes-list-type: atomic
1436 required:
1437 - key
1438 - operator
1439 type: object
1440 type: array
1441 x-kubernetes-list-type: atomic
1442 matchLabels:
1443 additionalProperties:
1444 type: string
1445 description: |-
1446 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1447 map is equivalent to an element of matchExpressions, whose key field is "key", the
1448 operator is "In", and the values array contains only "value". The requirements are ANDed.
1449 type: object
1450 type: object
1451 x-kubernetes-map-type: atomic
1452 namespaces:
1453 description: |-
1454 namespaces specifies a static list of namespace names that the term applies to.
1455 The term is applied to the union of the namespaces listed in this field
1456 and the ones selected by namespaceSelector.
1457 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1458 items:
1459 type: string
1460 type: array
1461 x-kubernetes-list-type: atomic
1462 topologyKey:
1463 description: |-
1464 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1465 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1466 whose value of the label with key topologyKey matches that of any node on which any of the
1467 selected pods is running.
1468 Empty topologyKey is not allowed.
1469 type: string
1470 required:
1471 - topologyKey
1472 type: object
1473 type: array
1474 x-kubernetes-list-type: atomic
1475 type: object
1476 podAntiAffinity:
1477 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
1478 properties:
1479 preferredDuringSchedulingIgnoredDuringExecution:
1480 description: |-
1481 The scheduler will prefer to schedule pods to nodes that satisfy
1482 the anti-affinity expressions specified by this field, but it may choose
1483 a node that violates one or more of the expressions. The node that is
1484 most preferred is the one with the greatest sum of weights, i.e.
1485 for each node that meets all of the scheduling requirements (resource
1486 request, requiredDuringScheduling anti-affinity expressions, etc.),
1487 compute a sum by iterating through the elements of this field and subtracting
1488 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
1489 node(s) with the highest sum are the most preferred.
1490 items:
1491 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1492 properties:
1493 podAffinityTerm:
1494 description: Required. A pod affinity term, associated with the corresponding weight.
1495 properties:
1496 labelSelector:
1497 description: |-
1498 A label query over a set of resources, in this case pods.
1499 If it's null, this PodAffinityTerm matches with no Pods.
1500 properties:
1501 matchExpressions:
1502 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1503 items:
1504 description: |-
1505 A label selector requirement is a selector that contains values, a key, and an operator that
1506 relates the key and values.
1507 properties:
1508 key:
1509 description: key is the label key that the selector applies to.
1510 type: string
1511 operator:
1512 description: |-
1513 operator represents a key's relationship to a set of values.
1514 Valid operators are In, NotIn, Exists and DoesNotExist.
1515 type: string
1516 values:
1517 description: |-
1518 values is an array of string values. If the operator is In or NotIn,
1519 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1520 the values array must be empty. This array is replaced during a strategic
1521 merge patch.
1522 items:
1523 type: string
1524 type: array
1525 x-kubernetes-list-type: atomic
1526 required:
1527 - key
1528 - operator
1529 type: object
1530 type: array
1531 x-kubernetes-list-type: atomic
1532 matchLabels:
1533 additionalProperties:
1534 type: string
1535 description: |-
1536 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1537 map is equivalent to an element of matchExpressions, whose key field is "key", the
1538 operator is "In", and the values array contains only "value". The requirements are ANDed.
1539 type: object
1540 type: object
1541 x-kubernetes-map-type: atomic
1542 matchLabelKeys:
1543 description: |-
1544 MatchLabelKeys is a set of pod label keys to select which pods will
1545 be taken into consideration. The keys are used to lookup values from the
1546 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1547 to select the group of existing pods which pods will be taken into consideration
1548 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1549 pod labels will be ignored. The default value is empty.
1550 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1551 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1552 items:
1553 type: string
1554 type: array
1555 x-kubernetes-list-type: atomic
1556 mismatchLabelKeys:
1557 description: |-
1558 MismatchLabelKeys is a set of pod label keys to select which pods will
1559 be taken into consideration. The keys are used to lookup values from the
1560 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1561 to select the group of existing pods which pods will be taken into consideration
1562 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1563 pod labels will be ignored. The default value is empty.
1564 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1565 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1566 items:
1567 type: string
1568 type: array
1569 x-kubernetes-list-type: atomic
1570 namespaceSelector:
1571 description: |-
1572 A label query over the set of namespaces that the term applies to.
1573 The term is applied to the union of the namespaces selected by this field
1574 and the ones listed in the namespaces field.
1575 null selector and null or empty namespaces list means "this pod's namespace".
1576 An empty selector ({}) matches all namespaces.
1577 properties:
1578 matchExpressions:
1579 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1580 items:
1581 description: |-
1582 A label selector requirement is a selector that contains values, a key, and an operator that
1583 relates the key and values.
1584 properties:
1585 key:
1586 description: key is the label key that the selector applies to.
1587 type: string
1588 operator:
1589 description: |-
1590 operator represents a key's relationship to a set of values.
1591 Valid operators are In, NotIn, Exists and DoesNotExist.
1592 type: string
1593 values:
1594 description: |-
1595 values is an array of string values. If the operator is In or NotIn,
1596 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1597 the values array must be empty. This array is replaced during a strategic
1598 merge patch.
1599 items:
1600 type: string
1601 type: array
1602 x-kubernetes-list-type: atomic
1603 required:
1604 - key
1605 - operator
1606 type: object
1607 type: array
1608 x-kubernetes-list-type: atomic
1609 matchLabels:
1610 additionalProperties:
1611 type: string
1612 description: |-
1613 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1614 map is equivalent to an element of matchExpressions, whose key field is "key", the
1615 operator is "In", and the values array contains only "value". The requirements are ANDed.
1616 type: object
1617 type: object
1618 x-kubernetes-map-type: atomic
1619 namespaces:
1620 description: |-
1621 namespaces specifies a static list of namespace names that the term applies to.
1622 The term is applied to the union of the namespaces listed in this field
1623 and the ones selected by namespaceSelector.
1624 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1625 items:
1626 type: string
1627 type: array
1628 x-kubernetes-list-type: atomic
1629 topologyKey:
1630 description: |-
1631 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1632 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1633 whose value of the label with key topologyKey matches that of any node on which any of the
1634 selected pods is running.
1635 Empty topologyKey is not allowed.
1636 type: string
1637 required:
1638 - topologyKey
1639 type: object
1640 weight:
1641 description: |-
1642 weight associated with matching the corresponding podAffinityTerm,
1643 in the range 1-100.
1644 format: int32
1645 type: integer
1646 required:
1647 - podAffinityTerm
1648 - weight
1649 type: object
1650 type: array
1651 x-kubernetes-list-type: atomic
1652 requiredDuringSchedulingIgnoredDuringExecution:
1653 description: |-
1654 If the anti-affinity requirements specified by this field are not met at
1655 scheduling time, the pod will not be scheduled onto the node.
1656 If the anti-affinity requirements specified by this field cease to be met
1657 at some point during pod execution (e.g. due to a pod label update), the
1658 system may or may not try to eventually evict the pod from its node.
1659 When there are multiple elements, the lists of nodes corresponding to each
1660 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1661 items:
1662 description: |-
1663 Defines a set of pods (namely those matching the labelSelector
1664 relative to the given namespace(s)) that this pod should be
1665 co-located (affinity) or not co-located (anti-affinity) with,
1666 where co-located is defined as running on a node whose value of
1667 the label with key <topologyKey> matches that of any node on which
1668 a pod of the set of pods is running
1669 properties:
1670 labelSelector:
1671 description: |-
1672 A label query over a set of resources, in this case pods.
1673 If it's null, this PodAffinityTerm matches with no Pods.
1674 properties:
1675 matchExpressions:
1676 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1677 items:
1678 description: |-
1679 A label selector requirement is a selector that contains values, a key, and an operator that
1680 relates the key and values.
1681 properties:
1682 key:
1683 description: key is the label key that the selector applies to.
1684 type: string
1685 operator:
1686 description: |-
1687 operator represents a key's relationship to a set of values.
1688 Valid operators are In, NotIn, Exists and DoesNotExist.
1689 type: string
1690 values:
1691 description: |-
1692 values is an array of string values. If the operator is In or NotIn,
1693 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1694 the values array must be empty. This array is replaced during a strategic
1695 merge patch.
1696 items:
1697 type: string
1698 type: array
1699 x-kubernetes-list-type: atomic
1700 required:
1701 - key
1702 - operator
1703 type: object
1704 type: array
1705 x-kubernetes-list-type: atomic
1706 matchLabels:
1707 additionalProperties:
1708 type: string
1709 description: |-
1710 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1711 map is equivalent to an element of matchExpressions, whose key field is "key", the
1712 operator is "In", and the values array contains only "value". The requirements are ANDed.
1713 type: object
1714 type: object
1715 x-kubernetes-map-type: atomic
1716 matchLabelKeys:
1717 description: |-
1718 MatchLabelKeys is a set of pod label keys to select which pods will
1719 be taken into consideration. The keys are used to lookup values from the
1720 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1721 to select the group of existing pods which pods will be taken into consideration
1722 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1723 pod labels will be ignored. The default value is empty.
1724 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1725 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1726 items:
1727 type: string
1728 type: array
1729 x-kubernetes-list-type: atomic
1730 mismatchLabelKeys:
1731 description: |-
1732 MismatchLabelKeys is a set of pod label keys to select which pods will
1733 be taken into consideration. The keys are used to lookup values from the
1734 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1735 to select the group of existing pods which pods will be taken into consideration
1736 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1737 pod labels will be ignored. The default value is empty.
1738 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1739 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1740 items:
1741 type: string
1742 type: array
1743 x-kubernetes-list-type: atomic
1744 namespaceSelector:
1745 description: |-
1746 A label query over the set of namespaces that the term applies to.
1747 The term is applied to the union of the namespaces selected by this field
1748 and the ones listed in the namespaces field.
1749 null selector and null or empty namespaces list means "this pod's namespace".
1750 An empty selector ({}) matches all namespaces.
1751 properties:
1752 matchExpressions:
1753 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1754 items:
1755 description: |-
1756 A label selector requirement is a selector that contains values, a key, and an operator that
1757 relates the key and values.
1758 properties:
1759 key:
1760 description: key is the label key that the selector applies to.
1761 type: string
1762 operator:
1763 description: |-
1764 operator represents a key's relationship to a set of values.
1765 Valid operators are In, NotIn, Exists and DoesNotExist.
1766 type: string
1767 values:
1768 description: |-
1769 values is an array of string values. If the operator is In or NotIn,
1770 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1771 the values array must be empty. This array is replaced during a strategic
1772 merge patch.
1773 items:
1774 type: string
1775 type: array
1776 x-kubernetes-list-type: atomic
1777 required:
1778 - key
1779 - operator
1780 type: object
1781 type: array
1782 x-kubernetes-list-type: atomic
1783 matchLabels:
1784 additionalProperties:
1785 type: string
1786 description: |-
1787 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1788 map is equivalent to an element of matchExpressions, whose key field is "key", the
1789 operator is "In", and the values array contains only "value". The requirements are ANDed.
1790 type: object
1791 type: object
1792 x-kubernetes-map-type: atomic
1793 namespaces:
1794 description: |-
1795 namespaces specifies a static list of namespace names that the term applies to.
1796 The term is applied to the union of the namespaces listed in this field
1797 and the ones selected by namespaceSelector.
1798 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1799 items:
1800 type: string
1801 type: array
1802 x-kubernetes-list-type: atomic
1803 topologyKey:
1804 description: |-
1805 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1806 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1807 whose value of the label with key topologyKey matches that of any node on which any of the
1808 selected pods is running.
1809 Empty topologyKey is not allowed.
1810 type: string
1811 required:
1812 - topologyKey
1813 type: object
1814 type: array
1815 x-kubernetes-list-type: atomic
1816 type: object
1817 type: object
1818 imagePullSecrets:
1819 description: If specified, the pod's imagePullSecrets
1820 items:
1821 description: |-
1822 LocalObjectReference contains enough information to let you locate the
1823 referenced object inside the same namespace.
1824 properties:
1825 name:
1826 default: ""
1827 description: |-
1828 Name of the referent.
1829 This field is effectively required, but due to backwards compatibility is
1830 allowed to be empty. Instances of this type with an empty value here are
1831 almost certainly wrong.
1832 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1833 type: string
1834 type: object
1835 x-kubernetes-map-type: atomic
1836 type: array
1837 x-kubernetes-list-map-keys:
1838 - name
1839 x-kubernetes-list-type: map
1840 nodeSelector:
1841 additionalProperties:
1842 type: string
1843 description: |-
1844 NodeSelector is a selector which must be true for the pod to fit on a node.
1845 Selector which must match a node's labels for the pod to be scheduled on that node.
1846 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
1847 type: object
1848 priorityClassName:
1849 description: If specified, the pod's priorityClassName.
1850 type: string
1851 resources:
1852 description: |-
1853 If specified, the pod's resource requirements.
1854 These values override the global resource configuration flags.
1855 Note that when only specifying resource limits, ensure they are greater than or equal
1856 to the corresponding global resource requests configured via controller flags
1857 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
1858 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
1859 properties:
1860 limits:
1861 additionalProperties:
1862 anyOf:
1863 - type: integer
1864 - type: string
1865 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1866 x-kubernetes-int-or-string: true
1867 description: |-
1868 Limits describes the maximum amount of compute resources allowed.
1869 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1870 type: object
1871 requests:
1872 additionalProperties:
1873 anyOf:
1874 - type: integer
1875 - type: string
1876 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1877 x-kubernetes-int-or-string: true
1878 description: |-
1879 Requests describes the minimum amount of compute resources required.
1880 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
1881 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
1882 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1883 type: object
1884 type: object
1885 securityContext:
1886 description: If specified, the pod's security context
1887 properties:
1888 fsGroup:
1889 description: |-
1890 A special supplemental group that applies to all containers in a pod.
1891 Some volume types allow the Kubelet to change the ownership of that volume
1892 to be owned by the pod:
1893
1894 1. The owning GID will be the FSGroup
1895 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
1896 3. The permission bits are OR'd with rw-rw----
1897
1898 If unset, the Kubelet will not modify the ownership and permissions of any volume.
1899 Note that this field cannot be set when spec.os.name is windows.
1900 format: int64
1901 type: integer
1902 fsGroupChangePolicy:
1903 description: |-
1904 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
1905 before being exposed inside Pod. This field will only apply to
1906 volume types which support fsGroup based ownership(and permissions).
1907 It will have no effect on ephemeral volume types such as: secret, configmaps
1908 and emptydir.
1909 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
1910 Note that this field cannot be set when spec.os.name is windows.
1911 type: string
1912 runAsGroup:
1913 description: |-
1914 The GID to run the entrypoint of the container process.
1915 Uses runtime default if unset.
1916 May also be set in SecurityContext. If set in both SecurityContext and
1917 PodSecurityContext, the value specified in SecurityContext takes precedence
1918 for that container.
1919 Note that this field cannot be set when spec.os.name is windows.
1920 format: int64
1921 type: integer
1922 runAsNonRoot:
1923 description: |-
1924 Indicates that the container must run as a non-root user.
1925 If true, the Kubelet will validate the image at runtime to ensure that it
1926 does not run as UID 0 (root) and fail to start the container if it does.
1927 If unset or false, no such validation will be performed.
1928 May also be set in SecurityContext. If set in both SecurityContext and
1929 PodSecurityContext, the value specified in SecurityContext takes precedence.
1930 type: boolean
1931 runAsUser:
1932 description: |-
1933 The UID to run the entrypoint of the container process.
1934 Defaults to user specified in image metadata if unspecified.
1935 May also be set in SecurityContext. If set in both SecurityContext and
1936 PodSecurityContext, the value specified in SecurityContext takes precedence
1937 for that container.
1938 Note that this field cannot be set when spec.os.name is windows.
1939 format: int64
1940 type: integer
1941 seLinuxOptions:
1942 description: |-
1943 The SELinux context to be applied to all containers.
1944 If unspecified, the container runtime will allocate a random SELinux context for each
1945 container. May also be set in SecurityContext. If set in
1946 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
1947 takes precedence for that container.
1948 Note that this field cannot be set when spec.os.name is windows.
1949 properties:
1950 level:
1951 description: Level is SELinux level label that applies to the container.
1952 type: string
1953 role:
1954 description: Role is a SELinux role label that applies to the container.
1955 type: string
1956 type:
1957 description: Type is a SELinux type label that applies to the container.
1958 type: string
1959 user:
1960 description: User is a SELinux user label that applies to the container.
1961 type: string
1962 type: object
1963 seccompProfile:
1964 description: |-
1965 The seccomp options to use by the containers in this pod.
1966 Note that this field cannot be set when spec.os.name is windows.
1967 properties:
1968 localhostProfile:
1969 description: |-
1970 localhostProfile indicates a profile defined in a file on the node should be used.
1971 The profile must be preconfigured on the node to work.
1972 Must be a descending path, relative to the kubelet's configured seccomp profile location.
1973 Must be set if type is "Localhost". Must NOT be set for any other type.
1974 type: string
1975 type:
1976 description: |-
1977 type indicates which kind of seccomp profile will be applied.
1978 Valid options are:
1979
1980 Localhost - a profile defined in a file on the node should be used.
1981 RuntimeDefault - the container runtime default profile should be used.
1982 Unconfined - no profile should be applied.
1983 type: string
1984 required:
1985 - type
1986 type: object
1987 supplementalGroups:
1988 description: |-
1989 A list of groups applied to the first process run in each container, in addition
1990 to the container's primary GID, the fsGroup (if specified), and group memberships
1991 defined in the container image for the uid of the container process. If unspecified,
1992 no additional groups are added to any container. Note that group memberships
1993 defined in the container image for the uid of the container process are still effective,
1994 even if they are not included in this list.
1995 Note that this field cannot be set when spec.os.name is windows.
1996 items:
1997 format: int64
1998 type: integer
1999 type: array
2000 x-kubernetes-list-type: atomic
2001 sysctls:
2002 description: |-
2003 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
2004 sysctls (by the container runtime) might fail to launch.
2005 Note that this field cannot be set when spec.os.name is windows.
2006 items:
2007 description: Sysctl defines a kernel parameter to be set
2008 properties:
2009 name:
2010 description: Name of a property to set
2011 type: string
2012 value:
2013 description: Value of a property to set
2014 type: string
2015 required:
2016 - name
2017 - value
2018 type: object
2019 type: array
2020 x-kubernetes-list-type: atomic
2021 type: object
2022 serviceAccountName:
2023 description: If specified, the pod's service account
2024 type: string
2025 tolerations:
2026 description: If specified, the pod's tolerations.
2027 items:
2028 description: |-
2029 The pod this Toleration is attached to tolerates any taint that matches
2030 the triple <key,value,effect> using the matching operator <operator>.
2031 properties:
2032 effect:
2033 description: |-
2034 Effect indicates the taint effect to match. Empty means match all taint effects.
2035 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
2036 type: string
2037 key:
2038 description: |-
2039 Key is the taint key that the toleration applies to. Empty means match all taint keys.
2040 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
2041 type: string
2042 operator:
2043 description: |-
2044 Operator represents a key's relationship to the value.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]2045 Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]2046 Exists is equivalent to wildcard for value, so that a pod can
2047 tolerate all taints of a particular category.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]2048 Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]2049 type: string
2050 tolerationSeconds:
2051 description: |-
2052 TolerationSeconds represents the period of time the toleration (which must be
2053 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
2054 it is not set, which means tolerate the taint forever (do not evict). Zero and
2055 negative values will be treated as 0 (evict immediately) by the system.
2056 format: int64
2057 type: integer
2058 value:
2059 description: |-
2060 Value is the taint value the toleration matches to.
2061 If the operator is Exists, the value should be empty, otherwise just a regular string.
2062 type: string
2063 type: object
2064 type: array
2065 x-kubernetes-list-type: atomic
2066 type: object
2067 type: object
2068 serviceType:
2069 description: |-
2070 Optional service type for Kubernetes solver service. Supported values
2071 are NodePort or ClusterIP. If unset, defaults to NodePort.
2072 type: string
2073 type: object
2074 ingress:
2075 description: |-
2076 The ingress based HTTP01 challenge solver will solve challenges by
2077 creating or modifying Ingress resources in order to route requests for
2078 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
2079 provisioned by cert-manager for each Challenge to be completed.
2080 properties:
2081 class:
2082 description: |-
2083 This field configures the annotation `kubernetes.io/ingress.class` when
2084 creating Ingress resources to solve ACME challenges that use this
2085 challenge solver. Only one of `class`, `name` or `ingressClassName` may
2086 be specified.
2087 type: string
2088 ingressClassName:
2089 description: |-
2090 This field configures the field `ingressClassName` on the created Ingress
2091 resources used to solve ACME challenges that use this challenge solver.
2092 This is the recommended way of configuring the ingress class. Only one of
2093 `class`, `name` or `ingressClassName` may be specified.
2094 type: string
2095 ingressTemplate:
2096 description: |-
2097 Optional ingress template used to configure the ACME challenge solver
2098 ingress used for HTTP01 challenges.
2099 properties:
2100 metadata:
2101 description: |-
2102 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
2103 Only the 'labels' and 'annotations' fields may be set.
2104 If labels or annotations overlap with in-built values, the values here
2105 will override the in-built values.
2106 properties:
2107 annotations:
2108 additionalProperties:
2109 type: string
2110 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
2111 type: object
2112 labels:
2113 additionalProperties:
2114 type: string
2115 description: Labels that should be added to the created ACME HTTP01 solver ingress.
2116 type: object
2117 type: object
2118 type: object
2119 name:
2120 description: |-
2121 The name of the ingress resource that should have ACME challenge solving
2122 routes inserted into it in order to solve HTTP01 challenges.
2123 This is typically used in conjunction with ingress controllers like
2124 ingress-gce, which maintains a 1:1 mapping between external IPs and
2125 ingress resources. Only one of `class`, `name` or `ingressClassName` may
2126 be specified.
2127 type: string
2128 podTemplate:
2129 description: |-
2130 Optional pod template used to configure the ACME challenge solver pods
2131 used for HTTP01 challenges.
2132 properties:
2133 metadata:
2134 description: |-
2135 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
2136 Only the 'labels' and 'annotations' fields may be set.
2137 If labels or annotations overlap with in-built values, the values here
2138 will override the in-built values.
2139 properties:
2140 annotations:
2141 additionalProperties:
2142 type: string
2143 description: Annotations that should be added to the created ACME HTTP01 solver pods.
2144 type: object
2145 labels:
2146 additionalProperties:
2147 type: string
2148 description: Labels that should be added to the created ACME HTTP01 solver pods.
2149 type: object
2150 type: object
2151 spec:
2152 description: |-
2153 PodSpec defines overrides for the HTTP01 challenge solver pod.
2154 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
2155 All other fields will be ignored.
2156 properties:
2157 affinity:
2158 description: If specified, the pod's scheduling constraints
2159 properties:
2160 nodeAffinity:
2161 description: Describes node affinity scheduling rules for the pod.
2162 properties:
2163 preferredDuringSchedulingIgnoredDuringExecution:
2164 description: |-
2165 The scheduler will prefer to schedule pods to nodes that satisfy
2166 the affinity expressions specified by this field, but it may choose
2167 a node that violates one or more of the expressions. The node that is
2168 most preferred is the one with the greatest sum of weights, i.e.
2169 for each node that meets all of the scheduling requirements (resource
2170 request, requiredDuringScheduling affinity expressions, etc.),
2171 compute a sum by iterating through the elements of this field and adding
2172 "weight" to the sum if the node matches the corresponding matchExpressions; the
2173 node(s) with the highest sum are the most preferred.
2174 items:
2175 description: |-
2176 An empty preferred scheduling term matches all objects with implicit weight 0
2177 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
2178 properties:
2179 preference:
2180 description: A node selector term, associated with the corresponding weight.
2181 properties:
2182 matchExpressions:
2183 description: A list of node selector requirements by node's labels.
2184 items:
2185 description: |-
2186 A node selector requirement is a selector that contains values, a key, and an operator
2187 that relates the key and values.
2188 properties:
2189 key:
2190 description: The label key that the selector applies to.
2191 type: string
2192 operator:
2193 description: |-
2194 Represents a key's relationship to a set of values.
2195 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2196 type: string
2197 values:
2198 description: |-
2199 An array of string values. If the operator is In or NotIn,
2200 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2201 the values array must be empty. If the operator is Gt or Lt, the values
2202 array must have a single element, which will be interpreted as an integer.
2203 This array is replaced during a strategic merge patch.
2204 items:
2205 type: string
2206 type: array
2207 x-kubernetes-list-type: atomic
2208 required:
2209 - key
2210 - operator
2211 type: object
2212 type: array
2213 x-kubernetes-list-type: atomic
2214 matchFields:
2215 description: A list of node selector requirements by node's fields.
2216 items:
2217 description: |-
2218 A node selector requirement is a selector that contains values, a key, and an operator
2219 that relates the key and values.
2220 properties:
2221 key:
2222 description: The label key that the selector applies to.
2223 type: string
2224 operator:
2225 description: |-
2226 Represents a key's relationship to a set of values.
2227 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2228 type: string
2229 values:
2230 description: |-
2231 An array of string values. If the operator is In or NotIn,
2232 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2233 the values array must be empty. If the operator is Gt or Lt, the values
2234 array must have a single element, which will be interpreted as an integer.
2235 This array is replaced during a strategic merge patch.
2236 items:
2237 type: string
2238 type: array
2239 x-kubernetes-list-type: atomic
2240 required:
2241 - key
2242 - operator
2243 type: object
2244 type: array
2245 x-kubernetes-list-type: atomic
2246 type: object
2247 x-kubernetes-map-type: atomic
2248 weight:
2249 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
2250 format: int32
2251 type: integer
2252 required:
2253 - preference
2254 - weight
2255 type: object
2256 type: array
2257 x-kubernetes-list-type: atomic
2258 requiredDuringSchedulingIgnoredDuringExecution:
2259 description: |-
2260 If the affinity requirements specified by this field are not met at
2261 scheduling time, the pod will not be scheduled onto the node.
2262 If the affinity requirements specified by this field cease to be met
2263 at some point during pod execution (e.g. due to an update), the system
2264 may or may not try to eventually evict the pod from its node.
2265 properties:
2266 nodeSelectorTerms:
2267 description: Required. A list of node selector terms. The terms are ORed.
2268 items:
2269 description: |-
2270 A null or empty node selector term matches no objects. The requirements of
2271 them are ANDed.
2272 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
2273 properties:
2274 matchExpressions:
2275 description: A list of node selector requirements by node's labels.
2276 items:
2277 description: |-
2278 A node selector requirement is a selector that contains values, a key, and an operator
2279 that relates the key and values.
2280 properties:
2281 key:
2282 description: The label key that the selector applies to.
2283 type: string
2284 operator:
2285 description: |-
2286 Represents a key's relationship to a set of values.
2287 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2288 type: string
2289 values:
2290 description: |-
2291 An array of string values. If the operator is In or NotIn,
2292 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2293 the values array must be empty. If the operator is Gt or Lt, the values
2294 array must have a single element, which will be interpreted as an integer.
2295 This array is replaced during a strategic merge patch.
2296 items:
2297 type: string
2298 type: array
2299 x-kubernetes-list-type: atomic
2300 required:
2301 - key
2302 - operator
2303 type: object
2304 type: array
2305 x-kubernetes-list-type: atomic
2306 matchFields:
2307 description: A list of node selector requirements by node's fields.
2308 items:
2309 description: |-
2310 A node selector requirement is a selector that contains values, a key, and an operator
2311 that relates the key and values.
2312 properties:
2313 key:
2314 description: The label key that the selector applies to.
2315 type: string
2316 operator:
2317 description: |-
2318 Represents a key's relationship to a set of values.
2319 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2320 type: string
2321 values:
2322 description: |-
2323 An array of string values. If the operator is In or NotIn,
2324 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2325 the values array must be empty. If the operator is Gt or Lt, the values
2326 array must have a single element, which will be interpreted as an integer.
2327 This array is replaced during a strategic merge patch.
2328 items:
2329 type: string
2330 type: array
2331 x-kubernetes-list-type: atomic
2332 required:
2333 - key
2334 - operator
2335 type: object
2336 type: array
2337 x-kubernetes-list-type: atomic
2338 type: object
2339 x-kubernetes-map-type: atomic
2340 type: array
2341 x-kubernetes-list-type: atomic
2342 required:
2343 - nodeSelectorTerms
2344 type: object
2345 x-kubernetes-map-type: atomic
2346 type: object
2347 podAffinity:
2348 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
2349 properties:
2350 preferredDuringSchedulingIgnoredDuringExecution:
2351 description: |-
2352 The scheduler will prefer to schedule pods to nodes that satisfy
2353 the affinity expressions specified by this field, but it may choose
2354 a node that violates one or more of the expressions. The node that is
2355 most preferred is the one with the greatest sum of weights, i.e.
2356 for each node that meets all of the scheduling requirements (resource
2357 request, requiredDuringScheduling affinity expressions, etc.),
2358 compute a sum by iterating through the elements of this field and adding
2359 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
2360 node(s) with the highest sum are the most preferred.
2361 items:
2362 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2363 properties:
2364 podAffinityTerm:
2365 description: Required. A pod affinity term, associated with the corresponding weight.
2366 properties:
2367 labelSelector:
2368 description: |-
2369 A label query over a set of resources, in this case pods.
2370 If it's null, this PodAffinityTerm matches with no Pods.
2371 properties:
2372 matchExpressions:
2373 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2374 items:
2375 description: |-
2376 A label selector requirement is a selector that contains values, a key, and an operator that
2377 relates the key and values.
2378 properties:
2379 key:
2380 description: key is the label key that the selector applies to.
2381 type: string
2382 operator:
2383 description: |-
2384 operator represents a key's relationship to a set of values.
2385 Valid operators are In, NotIn, Exists and DoesNotExist.
2386 type: string
2387 values:
2388 description: |-
2389 values is an array of string values. If the operator is In or NotIn,
2390 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2391 the values array must be empty. This array is replaced during a strategic
2392 merge patch.
2393 items:
2394 type: string
2395 type: array
2396 x-kubernetes-list-type: atomic
2397 required:
2398 - key
2399 - operator
2400 type: object
2401 type: array
2402 x-kubernetes-list-type: atomic
2403 matchLabels:
2404 additionalProperties:
2405 type: string
2406 description: |-
2407 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2408 map is equivalent to an element of matchExpressions, whose key field is "key", the
2409 operator is "In", and the values array contains only "value". The requirements are ANDed.
2410 type: object
2411 type: object
2412 x-kubernetes-map-type: atomic
2413 matchLabelKeys:
2414 description: |-
2415 MatchLabelKeys is a set of pod label keys to select which pods will
2416 be taken into consideration. The keys are used to lookup values from the
2417 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2418 to select the group of existing pods which pods will be taken into consideration
2419 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2420 pod labels will be ignored. The default value is empty.
2421 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2422 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2423 items:
2424 type: string
2425 type: array
2426 x-kubernetes-list-type: atomic
2427 mismatchLabelKeys:
2428 description: |-
2429 MismatchLabelKeys is a set of pod label keys to select which pods will
2430 be taken into consideration. The keys are used to lookup values from the
2431 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2432 to select the group of existing pods which pods will be taken into consideration
2433 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2434 pod labels will be ignored. The default value is empty.
2435 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2436 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2437 items:
2438 type: string
2439 type: array
2440 x-kubernetes-list-type: atomic
2441 namespaceSelector:
2442 description: |-
2443 A label query over the set of namespaces that the term applies to.
2444 The term is applied to the union of the namespaces selected by this field
2445 and the ones listed in the namespaces field.
2446 null selector and null or empty namespaces list means "this pod's namespace".
2447 An empty selector ({}) matches all namespaces.
2448 properties:
2449 matchExpressions:
2450 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2451 items:
2452 description: |-
2453 A label selector requirement is a selector that contains values, a key, and an operator that
2454 relates the key and values.
2455 properties:
2456 key:
2457 description: key is the label key that the selector applies to.
2458 type: string
2459 operator:
2460 description: |-
2461 operator represents a key's relationship to a set of values.
2462 Valid operators are In, NotIn, Exists and DoesNotExist.
2463 type: string
2464 values:
2465 description: |-
2466 values is an array of string values. If the operator is In or NotIn,
2467 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2468 the values array must be empty. This array is replaced during a strategic
2469 merge patch.
2470 items:
2471 type: string
2472 type: array
2473 x-kubernetes-list-type: atomic
2474 required:
2475 - key
2476 - operator
2477 type: object
2478 type: array
2479 x-kubernetes-list-type: atomic
2480 matchLabels:
2481 additionalProperties:
2482 type: string
2483 description: |-
2484 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2485 map is equivalent to an element of matchExpressions, whose key field is "key", the
2486 operator is "In", and the values array contains only "value". The requirements are ANDed.
2487 type: object
2488 type: object
2489 x-kubernetes-map-type: atomic
2490 namespaces:
2491 description: |-
2492 namespaces specifies a static list of namespace names that the term applies to.
2493 The term is applied to the union of the namespaces listed in this field
2494 and the ones selected by namespaceSelector.
2495 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2496 items:
2497 type: string
2498 type: array
2499 x-kubernetes-list-type: atomic
2500 topologyKey:
2501 description: |-
2502 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2503 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2504 whose value of the label with key topologyKey matches that of any node on which any of the
2505 selected pods is running.
2506 Empty topologyKey is not allowed.
2507 type: string
2508 required:
2509 - topologyKey
2510 type: object
2511 weight:
2512 description: |-
2513 weight associated with matching the corresponding podAffinityTerm,
2514 in the range 1-100.
2515 format: int32
2516 type: integer
2517 required:
2518 - podAffinityTerm
2519 - weight
2520 type: object
2521 type: array
2522 x-kubernetes-list-type: atomic
2523 requiredDuringSchedulingIgnoredDuringExecution:
2524 description: |-
2525 If the affinity requirements specified by this field are not met at
2526 scheduling time, the pod will not be scheduled onto the node.
2527 If the affinity requirements specified by this field cease to be met
2528 at some point during pod execution (e.g. due to a pod label update), the
2529 system may or may not try to eventually evict the pod from its node.
2530 When there are multiple elements, the lists of nodes corresponding to each
2531 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2532 items:
2533 description: |-
2534 Defines a set of pods (namely those matching the labelSelector
2535 relative to the given namespace(s)) that this pod should be
2536 co-located (affinity) or not co-located (anti-affinity) with,
2537 where co-located is defined as running on a node whose value of
2538 the label with key <topologyKey> matches that of any node on which
2539 a pod of the set of pods is running
2540 properties:
2541 labelSelector:
2542 description: |-
2543 A label query over a set of resources, in this case pods.
2544 If it's null, this PodAffinityTerm matches with no Pods.
2545 properties:
2546 matchExpressions:
2547 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2548 items:
2549 description: |-
2550 A label selector requirement is a selector that contains values, a key, and an operator that
2551 relates the key and values.
2552 properties:
2553 key:
2554 description: key is the label key that the selector applies to.
2555 type: string
2556 operator:
2557 description: |-
2558 operator represents a key's relationship to a set of values.
2559 Valid operators are In, NotIn, Exists and DoesNotExist.
2560 type: string
2561 values:
2562 description: |-
2563 values is an array of string values. If the operator is In or NotIn,
2564 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2565 the values array must be empty. This array is replaced during a strategic
2566 merge patch.
2567 items:
2568 type: string
2569 type: array
2570 x-kubernetes-list-type: atomic
2571 required:
2572 - key
2573 - operator
2574 type: object
2575 type: array
2576 x-kubernetes-list-type: atomic
2577 matchLabels:
2578 additionalProperties:
2579 type: string
2580 description: |-
2581 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2582 map is equivalent to an element of matchExpressions, whose key field is "key", the
2583 operator is "In", and the values array contains only "value". The requirements are ANDed.
2584 type: object
2585 type: object
2586 x-kubernetes-map-type: atomic
2587 matchLabelKeys:
2588 description: |-
2589 MatchLabelKeys is a set of pod label keys to select which pods will
2590 be taken into consideration. The keys are used to lookup values from the
2591 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2592 to select the group of existing pods which pods will be taken into consideration
2593 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2594 pod labels will be ignored. The default value is empty.
2595 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2596 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2597 items:
2598 type: string
2599 type: array
2600 x-kubernetes-list-type: atomic
2601 mismatchLabelKeys:
2602 description: |-
2603 MismatchLabelKeys is a set of pod label keys to select which pods will
2604 be taken into consideration. The keys are used to lookup values from the
2605 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2606 to select the group of existing pods which pods will be taken into consideration
2607 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2608 pod labels will be ignored. The default value is empty.
2609 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2610 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2611 items:
2612 type: string
2613 type: array
2614 x-kubernetes-list-type: atomic
2615 namespaceSelector:
2616 description: |-
2617 A label query over the set of namespaces that the term applies to.
2618 The term is applied to the union of the namespaces selected by this field
2619 and the ones listed in the namespaces field.
2620 null selector and null or empty namespaces list means "this pod's namespace".
2621 An empty selector ({}) matches all namespaces.
2622 properties:
2623 matchExpressions:
2624 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2625 items:
2626 description: |-
2627 A label selector requirement is a selector that contains values, a key, and an operator that
2628 relates the key and values.
2629 properties:
2630 key:
2631 description: key is the label key that the selector applies to.
2632 type: string
2633 operator:
2634 description: |-
2635 operator represents a key's relationship to a set of values.
2636 Valid operators are In, NotIn, Exists and DoesNotExist.
2637 type: string
2638 values:
2639 description: |-
2640 values is an array of string values. If the operator is In or NotIn,
2641 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2642 the values array must be empty. This array is replaced during a strategic
2643 merge patch.
2644 items:
2645 type: string
2646 type: array
2647 x-kubernetes-list-type: atomic
2648 required:
2649 - key
2650 - operator
2651 type: object
2652 type: array
2653 x-kubernetes-list-type: atomic
2654 matchLabels:
2655 additionalProperties:
2656 type: string
2657 description: |-
2658 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2659 map is equivalent to an element of matchExpressions, whose key field is "key", the
2660 operator is "In", and the values array contains only "value". The requirements are ANDed.
2661 type: object
2662 type: object
2663 x-kubernetes-map-type: atomic
2664 namespaces:
2665 description: |-
2666 namespaces specifies a static list of namespace names that the term applies to.
2667 The term is applied to the union of the namespaces listed in this field
2668 and the ones selected by namespaceSelector.
2669 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2670 items:
2671 type: string
2672 type: array
2673 x-kubernetes-list-type: atomic
2674 topologyKey:
2675 description: |-
2676 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2677 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2678 whose value of the label with key topologyKey matches that of any node on which any of the
2679 selected pods is running.
2680 Empty topologyKey is not allowed.
2681 type: string
2682 required:
2683 - topologyKey
2684 type: object
2685 type: array
2686 x-kubernetes-list-type: atomic
2687 type: object
2688 podAntiAffinity:
2689 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
2690 properties:
2691 preferredDuringSchedulingIgnoredDuringExecution:
2692 description: |-
2693 The scheduler will prefer to schedule pods to nodes that satisfy
2694 the anti-affinity expressions specified by this field, but it may choose
2695 a node that violates one or more of the expressions. The node that is
2696 most preferred is the one with the greatest sum of weights, i.e.
2697 for each node that meets all of the scheduling requirements (resource
2698 request, requiredDuringScheduling anti-affinity expressions, etc.),
2699 compute a sum by iterating through the elements of this field and subtracting
2700 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
2701 node(s) with the highest sum are the most preferred.
2702 items:
2703 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2704 properties:
2705 podAffinityTerm:
2706 description: Required. A pod affinity term, associated with the corresponding weight.
2707 properties:
2708 labelSelector:
2709 description: |-
2710 A label query over a set of resources, in this case pods.
2711 If it's null, this PodAffinityTerm matches with no Pods.
2712 properties:
2713 matchExpressions:
2714 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2715 items:
2716 description: |-
2717 A label selector requirement is a selector that contains values, a key, and an operator that
2718 relates the key and values.
2719 properties:
2720 key:
2721 description: key is the label key that the selector applies to.
2722 type: string
2723 operator:
2724 description: |-
2725 operator represents a key's relationship to a set of values.
2726 Valid operators are In, NotIn, Exists and DoesNotExist.
2727 type: string
2728 values:
2729 description: |-
2730 values is an array of string values. If the operator is In or NotIn,
2731 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2732 the values array must be empty. This array is replaced during a strategic
2733 merge patch.
2734 items:
2735 type: string
2736 type: array
2737 x-kubernetes-list-type: atomic
2738 required:
2739 - key
2740 - operator
2741 type: object
2742 type: array
2743 x-kubernetes-list-type: atomic
2744 matchLabels:
2745 additionalProperties:
2746 type: string
2747 description: |-
2748 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2749 map is equivalent to an element of matchExpressions, whose key field is "key", the
2750 operator is "In", and the values array contains only "value". The requirements are ANDed.
2751 type: object
2752 type: object
2753 x-kubernetes-map-type: atomic
2754 matchLabelKeys:
2755 description: |-
2756 MatchLabelKeys is a set of pod label keys to select which pods will
2757 be taken into consideration. The keys are used to lookup values from the
2758 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2759 to select the group of existing pods which pods will be taken into consideration
2760 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2761 pod labels will be ignored. The default value is empty.
2762 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2763 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2764 items:
2765 type: string
2766 type: array
2767 x-kubernetes-list-type: atomic
2768 mismatchLabelKeys:
2769 description: |-
2770 MismatchLabelKeys is a set of pod label keys to select which pods will
2771 be taken into consideration. The keys are used to lookup values from the
2772 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2773 to select the group of existing pods which pods will be taken into consideration
2774 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2775 pod labels will be ignored. The default value is empty.
2776 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2777 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2778 items:
2779 type: string
2780 type: array
2781 x-kubernetes-list-type: atomic
2782 namespaceSelector:
2783 description: |-
2784 A label query over the set of namespaces that the term applies to.
2785 The term is applied to the union of the namespaces selected by this field
2786 and the ones listed in the namespaces field.
2787 null selector and null or empty namespaces list means "this pod's namespace".
2788 An empty selector ({}) matches all namespaces.
2789 properties:
2790 matchExpressions:
2791 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2792 items:
2793 description: |-
2794 A label selector requirement is a selector that contains values, a key, and an operator that
2795 relates the key and values.
2796 properties:
2797 key:
2798 description: key is the label key that the selector applies to.
2799 type: string
2800 operator:
2801 description: |-
2802 operator represents a key's relationship to a set of values.
2803 Valid operators are In, NotIn, Exists and DoesNotExist.
2804 type: string
2805 values:
2806 description: |-
2807 values is an array of string values. If the operator is In or NotIn,
2808 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2809 the values array must be empty. This array is replaced during a strategic
2810 merge patch.
2811 items:
2812 type: string
2813 type: array
2814 x-kubernetes-list-type: atomic
2815 required:
2816 - key
2817 - operator
2818 type: object
2819 type: array
2820 x-kubernetes-list-type: atomic
2821 matchLabels:
2822 additionalProperties:
2823 type: string
2824 description: |-
2825 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2826 map is equivalent to an element of matchExpressions, whose key field is "key", the
2827 operator is "In", and the values array contains only "value". The requirements are ANDed.
2828 type: object
2829 type: object
2830 x-kubernetes-map-type: atomic
2831 namespaces:
2832 description: |-
2833 namespaces specifies a static list of namespace names that the term applies to.
2834 The term is applied to the union of the namespaces listed in this field
2835 and the ones selected by namespaceSelector.
2836 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2837 items:
2838 type: string
2839 type: array
2840 x-kubernetes-list-type: atomic
2841 topologyKey:
2842 description: |-
2843 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2844 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2845 whose value of the label with key topologyKey matches that of any node on which any of the
2846 selected pods is running.
2847 Empty topologyKey is not allowed.
2848 type: string
2849 required:
2850 - topologyKey
2851 type: object
2852 weight:
2853 description: |-
2854 weight associated with matching the corresponding podAffinityTerm,
2855 in the range 1-100.
2856 format: int32
2857 type: integer
2858 required:
2859 - podAffinityTerm
2860 - weight
2861 type: object
2862 type: array
2863 x-kubernetes-list-type: atomic
2864 requiredDuringSchedulingIgnoredDuringExecution:
2865 description: |-
2866 If the anti-affinity requirements specified by this field are not met at
2867 scheduling time, the pod will not be scheduled onto the node.
2868 If the anti-affinity requirements specified by this field cease to be met
2869 at some point during pod execution (e.g. due to a pod label update), the
2870 system may or may not try to eventually evict the pod from its node.
2871 When there are multiple elements, the lists of nodes corresponding to each
2872 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2873 items:
2874 description: |-
2875 Defines a set of pods (namely those matching the labelSelector
2876 relative to the given namespace(s)) that this pod should be
2877 co-located (affinity) or not co-located (anti-affinity) with,
2878 where co-located is defined as running on a node whose value of
2879 the label with key <topologyKey> matches that of any node on which
2880 a pod of the set of pods is running
2881 properties:
2882 labelSelector:
2883 description: |-
2884 A label query over a set of resources, in this case pods.
2885 If it's null, this PodAffinityTerm matches with no Pods.
2886 properties:
2887 matchExpressions:
2888 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2889 items:
2890 description: |-
2891 A label selector requirement is a selector that contains values, a key, and an operator that
2892 relates the key and values.
2893 properties:
2894 key:
2895 description: key is the label key that the selector applies to.
2896 type: string
2897 operator:
2898 description: |-
2899 operator represents a key's relationship to a set of values.
2900 Valid operators are In, NotIn, Exists and DoesNotExist.
2901 type: string
2902 values:
2903 description: |-
2904 values is an array of string values. If the operator is In or NotIn,
2905 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2906 the values array must be empty. This array is replaced during a strategic
2907 merge patch.
2908 items:
2909 type: string
2910 type: array
2911 x-kubernetes-list-type: atomic
2912 required:
2913 - key
2914 - operator
2915 type: object
2916 type: array
2917 x-kubernetes-list-type: atomic
2918 matchLabels:
2919 additionalProperties:
2920 type: string
2921 description: |-
2922 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2923 map is equivalent to an element of matchExpressions, whose key field is "key", the
2924 operator is "In", and the values array contains only "value". The requirements are ANDed.
2925 type: object
2926 type: object
2927 x-kubernetes-map-type: atomic
2928 matchLabelKeys:
2929 description: |-
2930 MatchLabelKeys is a set of pod label keys to select which pods will
2931 be taken into consideration. The keys are used to lookup values from the
2932 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2933 to select the group of existing pods which pods will be taken into consideration
2934 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2935 pod labels will be ignored. The default value is empty.
2936 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2937 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2938 items:
2939 type: string
2940 type: array
2941 x-kubernetes-list-type: atomic
2942 mismatchLabelKeys:
2943 description: |-
2944 MismatchLabelKeys is a set of pod label keys to select which pods will
2945 be taken into consideration. The keys are used to lookup values from the
2946 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2947 to select the group of existing pods which pods will be taken into consideration
2948 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2949 pod labels will be ignored. The default value is empty.
2950 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2951 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2952 items:
2953 type: string
2954 type: array
2955 x-kubernetes-list-type: atomic
2956 namespaceSelector:
2957 description: |-
2958 A label query over the set of namespaces that the term applies to.
2959 The term is applied to the union of the namespaces selected by this field
2960 and the ones listed in the namespaces field.
2961 null selector and null or empty namespaces list means "this pod's namespace".
2962 An empty selector ({}) matches all namespaces.
2963 properties:
2964 matchExpressions:
2965 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2966 items:
2967 description: |-
2968 A label selector requirement is a selector that contains values, a key, and an operator that
2969 relates the key and values.
2970 properties:
2971 key:
2972 description: key is the label key that the selector applies to.
2973 type: string
2974 operator:
2975 description: |-
2976 operator represents a key's relationship to a set of values.
2977 Valid operators are In, NotIn, Exists and DoesNotExist.
2978 type: string
2979 values:
2980 description: |-
2981 values is an array of string values. If the operator is In or NotIn,
2982 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2983 the values array must be empty. This array is replaced during a strategic
2984 merge patch.
2985 items:
2986 type: string
2987 type: array
2988 x-kubernetes-list-type: atomic
2989 required:
2990 - key
2991 - operator
2992 type: object
2993 type: array
2994 x-kubernetes-list-type: atomic
2995 matchLabels:
2996 additionalProperties:
2997 type: string
2998 description: |-
2999 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
3000 map is equivalent to an element of matchExpressions, whose key field is "key", the
3001 operator is "In", and the values array contains only "value". The requirements are ANDed.
3002 type: object
3003 type: object
3004 x-kubernetes-map-type: atomic
3005 namespaces:
3006 description: |-
3007 namespaces specifies a static list of namespace names that the term applies to.
3008 The term is applied to the union of the namespaces listed in this field
3009 and the ones selected by namespaceSelector.
3010 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
3011 items:
3012 type: string
3013 type: array
3014 x-kubernetes-list-type: atomic
3015 topologyKey:
3016 description: |-
3017 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
3018 the labelSelector in the specified namespaces, where co-located is defined as running on a node
3019 whose value of the label with key topologyKey matches that of any node on which any of the
3020 selected pods is running.
3021 Empty topologyKey is not allowed.
3022 type: string
3023 required:
3024 - topologyKey
3025 type: object
3026 type: array
3027 x-kubernetes-list-type: atomic
3028 type: object
3029 type: object
3030 imagePullSecrets:
3031 description: If specified, the pod's imagePullSecrets
3032 items:
3033 description: |-
3034 LocalObjectReference contains enough information to let you locate the
3035 referenced object inside the same namespace.
3036 properties:
3037 name:
3038 default: ""
3039 description: |-
3040 Name of the referent.
3041 This field is effectively required, but due to backwards compatibility is
3042 allowed to be empty. Instances of this type with an empty value here are
3043 almost certainly wrong.
3044 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3045 type: string
3046 type: object
3047 x-kubernetes-map-type: atomic
3048 type: array
3049 x-kubernetes-list-map-keys:
3050 - name
3051 x-kubernetes-list-type: map
3052 nodeSelector:
3053 additionalProperties:
3054 type: string
3055 description: |-
3056 NodeSelector is a selector which must be true for the pod to fit on a node.
3057 Selector which must match a node's labels for the pod to be scheduled on that node.
3058 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
3059 type: object
3060 priorityClassName:
3061 description: If specified, the pod's priorityClassName.
3062 type: string
3063 resources:
3064 description: |-
3065 If specified, the pod's resource requirements.
3066 These values override the global resource configuration flags.
3067 Note that when only specifying resource limits, ensure they are greater than or equal
3068 to the corresponding global resource requests configured via controller flags
3069 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
3070 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
3071 properties:
3072 limits:
3073 additionalProperties:
3074 anyOf:
3075 - type: integer
3076 - type: string
3077 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3078 x-kubernetes-int-or-string: true
3079 description: |-
3080 Limits describes the maximum amount of compute resources allowed.
3081 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3082 type: object
3083 requests:
3084 additionalProperties:
3085 anyOf:
3086 - type: integer
3087 - type: string
3088 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3089 x-kubernetes-int-or-string: true
3090 description: |-
3091 Requests describes the minimum amount of compute resources required.
3092 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
3093 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
3094 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3095 type: object
3096 type: object
3097 securityContext:
3098 description: If specified, the pod's security context
3099 properties:
3100 fsGroup:
3101 description: |-
3102 A special supplemental group that applies to all containers in a pod.
3103 Some volume types allow the Kubelet to change the ownership of that volume
3104 to be owned by the pod:
3105
3106 1. The owning GID will be the FSGroup
3107 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3108 3. The permission bits are OR'd with rw-rw----
3109
3110 If unset, the Kubelet will not modify the ownership and permissions of any volume.
3111 Note that this field cannot be set when spec.os.name is windows.
3112 format: int64
3113 type: integer
3114 fsGroupChangePolicy:
3115 description: |-
3116 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
3117 before being exposed inside Pod. This field will only apply to
3118 volume types which support fsGroup based ownership(and permissions).
3119 It will have no effect on ephemeral volume types such as: secret, configmaps
3120 and emptydir.
3121 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
3122 Note that this field cannot be set when spec.os.name is windows.
3123 type: string
3124 runAsGroup:
3125 description: |-
3126 The GID to run the entrypoint of the container process.
3127 Uses runtime default if unset.
3128 May also be set in SecurityContext. If set in both SecurityContext and
3129 PodSecurityContext, the value specified in SecurityContext takes precedence
3130 for that container.
3131 Note that this field cannot be set when spec.os.name is windows.
3132 format: int64
3133 type: integer
3134 runAsNonRoot:
3135 description: |-
3136 Indicates that the container must run as a non-root user.
3137 If true, the Kubelet will validate the image at runtime to ensure that it
3138 does not run as UID 0 (root) and fail to start the container if it does.
3139 If unset or false, no such validation will be performed.
3140 May also be set in SecurityContext. If set in both SecurityContext and
3141 PodSecurityContext, the value specified in SecurityContext takes precedence.
3142 type: boolean
3143 runAsUser:
3144 description: |-
3145 The UID to run the entrypoint of the container process.
3146 Defaults to user specified in image metadata if unspecified.
3147 May also be set in SecurityContext. If set in both SecurityContext and
3148 PodSecurityContext, the value specified in SecurityContext takes precedence
3149 for that container.
3150 Note that this field cannot be set when spec.os.name is windows.
3151 format: int64
3152 type: integer
3153 seLinuxOptions:
3154 description: |-
3155 The SELinux context to be applied to all containers.
3156 If unspecified, the container runtime will allocate a random SELinux context for each
3157 container. May also be set in SecurityContext. If set in
3158 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
3159 takes precedence for that container.
3160 Note that this field cannot be set when spec.os.name is windows.
3161 properties:
3162 level:
3163 description: Level is SELinux level label that applies to the container.
3164 type: string
3165 role:
3166 description: Role is a SELinux role label that applies to the container.
3167 type: string
3168 type:
3169 description: Type is a SELinux type label that applies to the container.
3170 type: string
3171 user:
3172 description: User is a SELinux user label that applies to the container.
3173 type: string
3174 type: object
3175 seccompProfile:
3176 description: |-
3177 The seccomp options to use by the containers in this pod.
3178 Note that this field cannot be set when spec.os.name is windows.
3179 properties:
3180 localhostProfile:
3181 description: |-
3182 localhostProfile indicates a profile defined in a file on the node should be used.
3183 The profile must be preconfigured on the node to work.
3184 Must be a descending path, relative to the kubelet's configured seccomp profile location.
3185 Must be set if type is "Localhost". Must NOT be set for any other type.
3186 type: string
3187 type:
3188 description: |-
3189 type indicates which kind of seccomp profile will be applied.
3190 Valid options are:
3191
3192 Localhost - a profile defined in a file on the node should be used.
3193 RuntimeDefault - the container runtime default profile should be used.
3194 Unconfined - no profile should be applied.
3195 type: string
3196 required:
3197 - type
3198 type: object
3199 supplementalGroups:
3200 description: |-
3201 A list of groups applied to the first process run in each container, in addition
3202 to the container's primary GID, the fsGroup (if specified), and group memberships
3203 defined in the container image for the uid of the container process. If unspecified,
3204 no additional groups are added to any container. Note that group memberships
3205 defined in the container image for the uid of the container process are still effective,
3206 even if they are not included in this list.
3207 Note that this field cannot be set when spec.os.name is windows.
3208 items:
3209 format: int64
3210 type: integer
3211 type: array
3212 x-kubernetes-list-type: atomic
3213 sysctls:
3214 description: |-
3215 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
3216 sysctls (by the container runtime) might fail to launch.
3217 Note that this field cannot be set when spec.os.name is windows.
3218 items:
3219 description: Sysctl defines a kernel parameter to be set
3220 properties:
3221 name:
3222 description: Name of a property to set
3223 type: string
3224 value:
3225 description: Value of a property to set
3226 type: string
3227 required:
3228 - name
3229 - value
3230 type: object
3231 type: array
3232 x-kubernetes-list-type: atomic
3233 type: object
3234 serviceAccountName:
3235 description: If specified, the pod's service account
3236 type: string
3237 tolerations:
3238 description: If specified, the pod's tolerations.
3239 items:
3240 description: |-
3241 The pod this Toleration is attached to tolerates any taint that matches
3242 the triple <key,value,effect> using the matching operator <operator>.
3243 properties:
3244 effect:
3245 description: |-
3246 Effect indicates the taint effect to match. Empty means match all taint effects.
3247 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
3248 type: string
3249 key:
3250 description: |-
3251 Key is the taint key that the toleration applies to. Empty means match all taint keys.
3252 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
3253 type: string
3254 operator:
3255 description: |-
3256 Operator represents a key's relationship to the value.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3257 Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3258 Exists is equivalent to wildcard for value, so that a pod can
3259 tolerate all taints of a particular category.
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3260 Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3261 type: string
3262 tolerationSeconds:
3263 description: |-
3264 TolerationSeconds represents the period of time the toleration (which must be
3265 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
3266 it is not set, which means tolerate the taint forever (do not evict). Zero and
3267 negative values will be treated as 0 (evict immediately) by the system.
3268 format: int64
3269 type: integer
3270 value:
3271 description: |-
3272 Value is the taint value the toleration matches to.
3273 If the operator is Exists, the value should be empty, otherwise just a regular string.
3274 type: string
3275 type: object
3276 type: array
3277 x-kubernetes-list-type: atomic
3278 type: object
3279 type: object
3280 serviceType:
3281 description: |-
3282 Optional service type for Kubernetes solver service. Supported values
3283 are NodePort or ClusterIP. If unset, defaults to NodePort.
3284 type: string
3285 type: object
3286 type: object
3287 selector:
3288 description: |-
3289 Selector selects a set of DNSNames on the Certificate resource that
3290 should be solved using this challenge solver.
3291 If not specified, the solver will be treated as the 'default' solver
3292 with the lowest priority, i.e. if any other solver has a more specific
3293 match, it will be used instead.
3294 properties:
3295 dnsNames:
3296 description: |-
3297 List of DNSNames that this solver will be used to solve.
3298 If specified and a match is found, a dnsNames selector will take
3299 precedence over a dnsZones selector.
3300 If multiple solvers match with the same dnsNames value, the solver
3301 with the most matching labels in matchLabels will be selected.
3302 If neither has more matches, the solver defined earlier in the list
3303 will be selected.
3304 items:
3305 type: string
3306 type: array
3307 x-kubernetes-list-type: atomic
3308 dnsZones:
3309 description: |-
3310 List of DNSZones that this solver will be used to solve.
3311 The most specific DNS zone match specified here will take precedence
3312 over other DNS zone matches, so a solver specifying sys.example.com
3313 will be selected over one specifying example.com for the domain
3314 www.sys.example.com.
3315 If multiple solvers match with the same dnsZones value, the solver
3316 with the most matching labels in matchLabels will be selected.
3317 If neither has more matches, the solver defined earlier in the list
3318 will be selected.
3319 items:
3320 type: string
3321 type: array
3322 x-kubernetes-list-type: atomic
3323 matchLabels:
3324 additionalProperties:
3325 type: string
3326 description: |-
3327 A label selector that is used to refine the set of certificate's that
3328 this challenge solver will apply to.
3329 type: object
3330 type: object
3331 type: object
3332 type: array
3333 x-kubernetes-list-type: atomic
3334 required:
3335 - privateKeySecretRef
3336 - server
3337 type: object
3338 ca:
3339 description: |-
3340 CA configures this issuer to sign certificates using a signing CA keypair
3341 stored in a Secret resource.
3342 This is used to build internal PKIs that are managed by cert-manager.
3343 properties:
3344 crlDistributionPoints:
3345 description: |-
3346 The CRL distribution points is an X.509 v3 certificate extension which identifies
3347 the location of the CRL from which the revocation of this certificate can be checked.
3348 If not set, certificates will be issued without distribution points set.
3349 items:
3350 type: string
3351 type: array
3352 x-kubernetes-list-type: atomic
3353 issuingCertificateURLs:
3354 description: |-
3355 IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
3356 it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
3357 As an example, such a URL might be "http://ca.domain.com/ca.crt".
3358 items:
3359 type: string
3360 type: array
3361 x-kubernetes-list-type: atomic
3362 ocspServers:
3363 description: |-
3364 The OCSP server list is an X.509 v3 extension that defines a list of
3365 URLs of OCSP responders. The OCSP responders can be queried for the
3366 revocation status of an issued certificate. If not set, the
3367 certificate will be issued with no OCSP servers set. For example, an
3368 OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
3369 items:
3370 type: string
3371 type: array
3372 x-kubernetes-list-type: atomic
3373 secretName:
3374 description: |-
3375 SecretName is the name of the secret used to sign Certificates issued
3376 by this Issuer.
3377 type: string
3378 required:
3379 - secretName
3380 type: object
3381 selfSigned:
3382 description: |-
3383 SelfSigned configures this issuer to 'self sign' certificates using the
3384 private key used to create the CertificateRequest object.
3385 properties:
3386 crlDistributionPoints:
3387 description: |-
3388 The CRL distribution points is an X.509 v3 certificate extension which identifies
3389 the location of the CRL from which the revocation of this certificate can be checked.
3390 If not set certificate will be issued without CDP. Values are strings.
3391 items:
3392 type: string
3393 type: array
3394 x-kubernetes-list-type: atomic
3395 type: object
3396 vault:
3397 description: |-
3398 Vault configures this issuer to sign certificates using a HashiCorp Vault
3399 PKI backend.
3400 properties:
3401 auth:
3402 description: Auth configures how cert-manager authenticates with the Vault server.
3403 properties:
3404 appRole:
3405 description: |-
3406 AppRole authenticates with Vault using the App Role auth mechanism,
3407 with the role and secret stored in a Kubernetes Secret resource.
3408 properties:
3409 path:
3410 description: |-
3411 Path where the App Role authentication backend is mounted in Vault, e.g:
3412 "approle"
3413 type: string
3414 roleId:
3415 description: |-
3416 RoleID configured in the App Role authentication backend when setting
3417 up the authentication backend in Vault.
3418 type: string
3419 secretRef:
3420 description: |-
3421 Reference to a key in a Secret that contains the App Role secret used
3422 to authenticate with Vault.
3423 The `key` field must be specified and denotes which entry within the Secret
3424 resource is used as the app role secret.
3425 properties:
3426 key:
3427 description: |-
3428 The key of the entry in the Secret resource's `data` field to be used.
3429 Some instances of this field may be defaulted, in others it may be
3430 required.
3431 type: string
3432 name:
3433 description: |-
3434 Name of the resource being referred to.
3435 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3436 type: string
3437 required:
3438 - name
3439 type: object
3440 required:
3441 - path
3442 - roleId
3443 - secretRef
3444 type: object
3445 clientCertificate:
3446 description: |-
3447 ClientCertificate authenticates with Vault by presenting a client
3448 certificate during the request's TLS handshake.
3449 Works only when using HTTPS protocol.
3450 properties:
3451 mountPath:
3452 description: |-
3453 The Vault mountPath here is the mount path to use when authenticating with
3454 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3455 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3456 default value "/v1/auth/cert" will be used.
3457 type: string
3458 name:
3459 description: |-
3460 Name of the certificate role to authenticate against.
3461 If not set, matching any certificate role, if available.
3462 type: string
3463 secretName:
3464 description: |-
3465 Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
3466 tls.crt and tls.key) used to authenticate to Vault using TLS client
3467 authentication.
3468 type: string
3469 type: object
3470 kubernetes:
3471 description: |-
3472 Kubernetes authenticates with Vault by passing the ServiceAccount
3473 token stored in the named Secret resource to the Vault server.
3474 properties:
3475 mountPath:
3476 description: |-
3477 The Vault mountPath here is the mount path to use when authenticating with
3478 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3479 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3480 default value "/v1/auth/kubernetes" will be used.
3481 type: string
3482 role:
3483 description: |-
3484 A required field containing the Vault Role to assume. A Role binds a
3485 Kubernetes ServiceAccount with a set of Vault policies.
3486 type: string
3487 secretRef:
3488 description: |-
3489 The required Secret field containing a Kubernetes ServiceAccount JWT used
3490 for authenticating with Vault. Use of 'ambient credentials' is not
3491 supported.
3492 properties:
3493 key:
3494 description: |-
3495 The key of the entry in the Secret resource's `data` field to be used.
3496 Some instances of this field may be defaulted, in others it may be
3497 required.
3498 type: string
3499 name:
3500 description: |-
3501 Name of the resource being referred to.
3502 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3503 type: string
3504 required:
3505 - name
3506 type: object
3507 serviceAccountRef:
3508 description: |-
3509 A reference to a service account that will be used to request a bound
3510 token (also known as "projected token"). Compared to using "secretRef",
3511 using this field means that you don't rely on statically bound tokens. To
3512 use this field, you must configure an RBAC rule to let cert-manager
3513 request a token.
3514 properties:
3515 audiences:
3516 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3517 TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
3518 The default audiences are always included in the token.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3519 items:
3520 type: string
3521 type: array
3522 x-kubernetes-list-type: atomic
3523 name:
3524 description: Name of the ServiceAccount used to request a token.
3525 type: string
3526 required:
3527 - name
3528 type: object
3529 required:
3530 - role
3531 type: object
3532 tokenSecretRef:
3533 description: TokenSecretRef authenticates with Vault by presenting a token.
3534 properties:
3535 key:
3536 description: |-
3537 The key of the entry in the Secret resource's `data` field to be used.
3538 Some instances of this field may be defaulted, in others it may be
3539 required.
3540 type: string
3541 name:
3542 description: |-
3543 Name of the resource being referred to.
3544 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3545 type: string
3546 required:
3547 - name
3548 type: object
3549 type: object
3550 caBundle:
3551 description: |-
3552 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3553 chain presented by Vault. Only used if using HTTPS to connect to Vault and
3554 ignored for HTTP connections.
3555 Mutually exclusive with CABundleSecretRef.
3556 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3557 the cert-manager controller container is used to validate the TLS connection.
3558 format: byte
3559 type: string
3560 caBundleSecretRef:
3561 description: |-
3562 Reference to a Secret containing a bundle of PEM-encoded CAs to use when
3563 verifying the certificate chain presented by Vault when using HTTPS.
3564 Mutually exclusive with CABundle.
3565 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3566 the cert-manager controller container is used to validate the TLS connection.
3567 If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
3568 properties:
3569 key:
3570 description: |-
3571 The key of the entry in the Secret resource's `data` field to be used.
3572 Some instances of this field may be defaulted, in others it may be
3573 required.
3574 type: string
3575 name:
3576 description: |-
3577 Name of the resource being referred to.
3578 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3579 type: string
3580 required:
3581 - name
3582 type: object
3583 clientCertSecretRef:
3584 description: |-
3585 Reference to a Secret containing a PEM-encoded Client Certificate to use when the
3586 Vault server requires mTLS.
3587 properties:
3588 key:
3589 description: |-
3590 The key of the entry in the Secret resource's `data` field to be used.
3591 Some instances of this field may be defaulted, in others it may be
3592 required.
3593 type: string
3594 name:
3595 description: |-
3596 Name of the resource being referred to.
3597 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3598 type: string
3599 required:
3600 - name
3601 type: object
3602 clientKeySecretRef:
3603 description: |-
3604 Reference to a Secret containing a PEM-encoded Client Private Key to use when the
3605 Vault server requires mTLS.
3606 properties:
3607 key:
3608 description: |-
3609 The key of the entry in the Secret resource's `data` field to be used.
3610 Some instances of this field may be defaulted, in others it may be
3611 required.
3612 type: string
3613 name:
3614 description: |-
3615 Name of the resource being referred to.
3616 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3617 type: string
3618 required:
3619 - name
3620 type: object
3621 namespace:
3622 description: |-
3623 Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
3624 More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
3625 type: string
3626 path:
3627 description: |-
3628 Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
3629 "my_pki_mount/sign/my-role-name".
3630 type: string
3631 server:
3632 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
3633 type: string
3634 serverName:
3635 description: |-
3636 ServerName is used to verify the hostname on the returned certificates
3637 by the Vault server.
3638 type: string
3639 required:
3640 - auth
3641 - path
3642 - server
3643 type: object
3644 venafi:
3645 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3646 Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted
3647 or SaaS policy zone.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3648 properties:
3649 cloud:
3650 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3651 Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
3652 Only one of CyberArk Certificate Manager may be specified.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3653 properties:
3654 apiTokenSecretRef:
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3655 description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3656 properties:
3657 key:
3658 description: |-
3659 The key of the entry in the Secret resource's `data` field to be used.
3660 Some instances of this field may be defaulted, in others it may be
3661 required.
3662 type: string
3663 name:
3664 description: |-
3665 Name of the resource being referred to.
3666 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3667 type: string
3668 required:
3669 - name
3670 type: object
3671 url:
3672 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3673 URL is the base URL for CyberArk Certificate Manager SaaS.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3674 Defaults to "https://api.venafi.cloud/".
3675 type: string
3676 required:
3677 - apiTokenSecretRef
3678 type: object
3679 tpp:
3680 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3681 TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
3682 Only one of CyberArk Certificate Manager may be specified.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3683 properties:
3684 caBundle:
3685 description: |-
3686 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3687 chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3688 If undefined, the certificate bundle in the cert-manager controller container
3689 is used to validate the chain.
3690 format: byte
3691 type: string
3692 caBundleSecretRef:
3693 description: |-
3694 Reference to a Secret containing a base64-encoded bundle of PEM CAs
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3695 which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3696 Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
3697 If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
3698 the cert-manager controller container is used to validate the TLS connection.
3699 properties:
3700 key:
3701 description: |-
3702 The key of the entry in the Secret resource's `data` field to be used.
3703 Some instances of this field may be defaulted, in others it may be
3704 required.
3705 type: string
3706 name:
3707 description: |-
3708 Name of the resource being referred to.
3709 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3710 type: string
3711 required:
3712 - name
3713 type: object
3714 credentialsRef:
3715 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3716 CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3717 The secret must contain the key 'access-token' for the Access Token Authentication,
3718 or two keys, 'username' and 'password' for the API Keys Authentication.
3719 properties:
3720 name:
3721 description: |-
3722 Name of the resource being referred to.
3723 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3724 type: string
3725 required:
3726 - name
3727 type: object
3728 url:
3729 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3730 URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3731 for example: "https://tpp.example.com/vedsdk".
3732 type: string
3733 required:
3734 - credentialsRef
3735 - url
3736 type: object
3737 zone:
3738 description: |-
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame^]3739 Zone is the Certificate Manager Policy Zone to use for this issuer.
3740 All requests made to the Certificate Manager platform will be restricted by the named
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]3741 zone policy.
3742 This field is required.
3743 type: string
3744 required:
3745 - zone
3746 type: object
3747 type: object
3748 status:
3749 description: Status of the ClusterIssuer. This is set and managed automatically.
3750 properties:
3751 acme:
3752 description: |-
3753 ACME specific status options.
3754 This field should only be set if the Issuer is configured to use an ACME
3755 server to issue certificates.
3756 properties:
3757 lastPrivateKeyHash:
3758 description: |-
3759 LastPrivateKeyHash is a hash of the private key associated with the latest
3760 registered ACME account, in order to track changes made to registered account
3761 associated with the Issuer
3762 type: string
3763 lastRegisteredEmail:
3764 description: |-
3765 LastRegisteredEmail is the email associated with the latest registered
3766 ACME account, in order to track changes made to registered account
3767 associated with the Issuer
3768 type: string
3769 uri:
3770 description: |-
3771 URI is the unique account identifier, which can also be used to retrieve
3772 account details from the CA
3773 type: string
3774 type: object
3775 conditions:
3776 description: |-
3777 List of status conditions to indicate the status of a CertificateRequest.
3778 Known condition types are `Ready`.
3779 items:
3780 description: IssuerCondition contains condition information for an Issuer.
3781 properties:
3782 lastTransitionTime:
3783 description: |-
3784 LastTransitionTime is the timestamp corresponding to the last status
3785 change of this condition.
3786 format: date-time
3787 type: string
3788 message:
3789 description: |-
3790 Message is a human readable description of the details of the last
3791 transition, complementing reason.
3792 type: string
3793 observedGeneration:
3794 description: |-
3795 If set, this represents the .metadata.generation that the condition was
3796 set based upon.
3797 For instance, if .metadata.generation is currently 12, but the
3798 .status.condition[x].observedGeneration is 9, the condition is out of date
3799 with respect to the current state of the Issuer.
3800 format: int64
3801 type: integer
3802 reason:
3803 description: |-
3804 Reason is a brief machine readable explanation for the condition's last
3805 transition.
3806 type: string
3807 status:
3808 description: Status of the condition, one of (`True`, `False`, `Unknown`).
3809 enum:
3810 - "True"
3811 - "False"
3812 - Unknown
3813 type: string
3814 type:
3815 description: Type of the condition, known values are (`Ready`).
3816 type: string
3817 required:
3818 - status
3819 - type
3820 type: object
3821 type: array
3822 x-kubernetes-list-map-keys:
3823 - type
3824 x-kubernetes-list-type: map
3825 type: object
3826 required:
3827 - spec
3828 type: object
3829 served: true
3830 storage: true
3831 subresources:
3832 status: {}
3833{{- end }}