Gitiles
Code Review Sign In
code.v1.dodo.cloud / pcloud / c895c1db1ef18211fffdbcd825914a6c93246513 / . / charts / cert-manager-1.20.3 / templates / crd-cert-manager.io_issuers.yaml
blob: 68a2dd0547dbc8aa2d6a7e5421c4609c7fc49844 [file] [log] [blame]
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame^]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "issuers.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: Issuer
18 listKind: IssuerList
19 plural: issuers
20 shortNames:
21 - iss
22 singular: issuer
23 scope: Namespaced
24 versions:
25 - additionalPrinterColumns:
26 - jsonPath: .status.conditions[?(@.type == "Ready")].status
27 name: Ready
28 type: string
29 - jsonPath: .status.conditions[?(@.type == "Ready")].message
30 name: Status
31 priority: 1
32 type: string
33 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
34 jsonPath: .metadata.creationTimestamp
35 name: Age
36 type: date
37 name: v1
38 schema:
39 openAPIV3Schema:
40 description: |-
41 An Issuer represents a certificate issuing authority which can be
42 referenced as part of `issuerRef` fields.
43 It is scoped to a single namespace and can therefore only be referenced by
44 resources within the same namespace.
45 properties:
46 apiVersion:
47 description: |-
48 APIVersion defines the versioned schema of this representation of an object.
49 Servers should convert recognized schemas to the latest internal value, and
50 may reject unrecognized values.
51 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
52 type: string
53 kind:
54 description: |-
55 Kind is a string value representing the REST resource this object represents.
56 Servers may infer this from the endpoint the client submits requests to.
57 Cannot be updated.
58 In CamelCase.
59 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
60 type: string
61 metadata:
62 type: object
63 spec:
64 description: Desired state of the Issuer resource.
65 properties:
66 acme:
67 description: |-
68 ACME configures this issuer to communicate with a RFC8555 (ACME) server
69 to obtain signed x509 certificates.
70 properties:
71 caBundle:
72 description: |-
73 Base64-encoded bundle of PEM CAs which can be used to validate the certificate
74 chain presented by the ACME server.
75 Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
76 kinds of security vulnerabilities.
77 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
78 the container is used to validate the TLS connection.
79 format: byte
80 type: string
81 disableAccountKeyGeneration:
82 description: |-
83 Enables or disables generating a new ACME account key.
84 If true, the Issuer resource will *not* request a new account but will expect
85 the account key to be supplied via an existing secret.
86 If false, the cert-manager system will generate a new ACME account key
87 for the Issuer.
88 Defaults to false.
89 type: boolean
90 email:
91 description: |-
92 Email is the email address to be associated with the ACME account.
93 This field is optional, but it is strongly recommended to be set.
94 It will be used to contact you in case of issues with your account or
95 certificates, including expiry notification emails.
96 This field may be updated after the account is initially registered.
97 type: string
98 enableDurationFeature:
99 description: |-
100 Enables requesting a Not After date on certificates that matches the
101 duration of the certificate. This is not supported by all ACME servers
102 like Let's Encrypt. If set to true when the ACME server does not support
103 it, it will create an error on the Order.
104 Defaults to false.
105 type: boolean
106 externalAccountBinding:
107 description: |-
108 ExternalAccountBinding is a reference to a CA external account of the ACME
109 server.
110 If set, upon registration cert-manager will attempt to associate the given
111 external account credentials with the registered ACME account.
112 properties:
113 keyAlgorithm:
114 description: |-
115 Deprecated: keyAlgorithm field exists for historical compatibility
116 reasons and should not be used. The algorithm is now hardcoded to HS256
117 in golang/x/crypto/acme.
118 enum:
119 - HS256
120 - HS384
121 - HS512
122 type: string
123 keyID:
124 description: keyID is the ID of the CA key that the External Account is bound to.
125 type: string
126 keySecretRef:
127 description: |-
128 keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
129 Secret which holds the symmetric MAC key of the External Account Binding.
130 The `key` is the index string that is paired with the key data in the
131 Secret and should not be confused with the key data itself, or indeed with
132 the External Account Binding keyID above.
133 The secret key stored in the Secret **must** be un-padded, base64 URL
134 encoded data.
135 properties:
136 key:
137 description: |-
138 The key of the entry in the Secret resource's `data` field to be used.
139 Some instances of this field may be defaulted, in others it may be
140 required.
141 type: string
142 name:
143 description: |-
144 Name of the resource being referred to.
145 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
146 type: string
147 required:
148 - name
149 type: object
150 required:
151 - keyID
152 - keySecretRef
153 type: object
154 preferredChain:
155 description: |-
156 PreferredChain is the chain to use if the ACME server outputs multiple.
157 PreferredChain is no guarantee that this one gets delivered by the ACME
158 endpoint.
159 For example, for Let's Encrypt's DST cross-sign you would use:
160 "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
161 This value picks the first certificate bundle in the combined set of
162 ACME default and alternative chains that has a root-most certificate with
163 this value as its issuer's commonname.
164 maxLength: 64
165 type: string
166 privateKeySecretRef:
167 description: |-
168 PrivateKey is the name of a Kubernetes Secret resource that will be used to
169 store the automatically generated ACME account private key.
170 Optionally, a `key` may be specified to select a specific entry within
171 the named Secret resource.
172 If `key` is not specified, a default of `tls.key` will be used.
173 properties:
174 key:
175 description: |-
176 The key of the entry in the Secret resource's `data` field to be used.
177 Some instances of this field may be defaulted, in others it may be
178 required.
179 type: string
180 name:
181 description: |-
182 Name of the resource being referred to.
183 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
184 type: string
185 required:
186 - name
187 type: object
188 profile:
189 description: |-
190 Profile allows requesting a certificate profile from the ACME server.
191 Supported profiles are listed by the server's ACME directory URL.
192 type: string
193 server:
194 description: |-
195 Server is the URL used to access the ACME server's 'directory' endpoint.
196 For example, for Let's Encrypt's staging endpoint, you would use:
197 "https://acme-staging-v02.api.letsencrypt.org/directory".
198 Only ACME v2 endpoints (i.e. RFC 8555) are supported.
199 type: string
200 skipTLSVerify:
201 description: |-
202 INSECURE: Enables or disables validation of the ACME server TLS certificate.
203 If true, requests to the ACME server will not have the TLS certificate chain
204 validated.
205 Mutually exclusive with CABundle; prefer using CABundle to prevent various
206 kinds of security vulnerabilities.
207 Only enable this option in development environments.
208 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
209 the container is used to validate the TLS connection.
210 Defaults to false.
211 type: boolean
212 solvers:
213 description: |-
214 Solvers is a list of challenge solvers that will be used to solve
215 ACME challenges for the matching domains.
216 Solver configurations must be provided in order to obtain certificates
217 from an ACME server.
218 For more information, see: https://cert-manager.io/docs/configuration/acme/
219 items:
220 description: |-
221 An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
222 A selector may be provided to use different solving strategies for different DNS names.
223 Only one of HTTP01 or DNS01 must be provided.
224 properties:
225 dns01:
226 description: |-
227 Configures cert-manager to attempt to complete authorizations by
228 performing the DNS01 challenge flow.
229 properties:
230 acmeDNS:
231 description: |-
232 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
233 DNS01 challenge records.
234 properties:
235 accountSecretRef:
236 description: |-
237 A reference to a specific 'key' within a Secret resource.
238 In some instances, `key` is a required field.
239 properties:
240 key:
241 description: |-
242 The key of the entry in the Secret resource's `data` field to be used.
243 Some instances of this field may be defaulted, in others it may be
244 required.
245 type: string
246 name:
247 description: |-
248 Name of the resource being referred to.
249 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
250 type: string
251 required:
252 - name
253 type: object
254 host:
255 type: string
256 required:
257 - accountSecretRef
258 - host
259 type: object
260 akamai:
261 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
262 properties:
263 accessTokenSecretRef:
264 description: |-
265 A reference to a specific 'key' within a Secret resource.
266 In some instances, `key` is a required field.
267 properties:
268 key:
269 description: |-
270 The key of the entry in the Secret resource's `data` field to be used.
271 Some instances of this field may be defaulted, in others it may be
272 required.
273 type: string
274 name:
275 description: |-
276 Name of the resource being referred to.
277 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
278 type: string
279 required:
280 - name
281 type: object
282 clientSecretSecretRef:
283 description: |-
284 A reference to a specific 'key' within a Secret resource.
285 In some instances, `key` is a required field.
286 properties:
287 key:
288 description: |-
289 The key of the entry in the Secret resource's `data` field to be used.
290 Some instances of this field may be defaulted, in others it may be
291 required.
292 type: string
293 name:
294 description: |-
295 Name of the resource being referred to.
296 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
297 type: string
298 required:
299 - name
300 type: object
301 clientTokenSecretRef:
302 description: |-
303 A reference to a specific 'key' within a Secret resource.
304 In some instances, `key` is a required field.
305 properties:
306 key:
307 description: |-
308 The key of the entry in the Secret resource's `data` field to be used.
309 Some instances of this field may be defaulted, in others it may be
310 required.
311 type: string
312 name:
313 description: |-
314 Name of the resource being referred to.
315 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
316 type: string
317 required:
318 - name
319 type: object
320 serviceConsumerDomain:
321 type: string
322 required:
323 - accessTokenSecretRef
324 - clientSecretSecretRef
325 - clientTokenSecretRef
326 - serviceConsumerDomain
327 type: object
328 azureDNS:
329 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
330 properties:
331 clientID:
332 description: |-
333 Auth: Azure Service Principal:
334 The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
335 If set, ClientSecret and TenantID must also be set.
336 type: string
337 clientSecretSecretRef:
338 description: |-
339 Auth: Azure Service Principal:
340 A reference to a Secret containing the password associated with the Service Principal.
341 If set, ClientID and TenantID must also be set.
342 properties:
343 key:
344 description: |-
345 The key of the entry in the Secret resource's `data` field to be used.
346 Some instances of this field may be defaulted, in others it may be
347 required.
348 type: string
349 name:
350 description: |-
351 Name of the resource being referred to.
352 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
353 type: string
354 required:
355 - name
356 type: object
357 environment:
358 description: name of the Azure environment (default AzurePublicCloud)
359 enum:
360 - AzurePublicCloud
361 - AzureChinaCloud
362 - AzureGermanCloud
363 - AzureUSGovernmentCloud
364 type: string
365 hostedZoneName:
366 description: name of the DNS zone that should be used
367 type: string
368 managedIdentity:
369 description: |-
370 Auth: Azure Workload Identity or Azure Managed Service Identity:
371 Settings to enable Azure Workload Identity or Azure Managed Service Identity
372 If set, ClientID, ClientSecret and TenantID must not be set.
373 properties:
374 clientID:
375 description: client ID of the managed identity, cannot be used at the same time as resourceID
376 type: string
377 resourceID:
378 description: |-
379 resource ID of the managed identity, cannot be used at the same time as clientID
380 Cannot be used for Azure Managed Service Identity
381 type: string
382 tenantID:
383 description: tenant ID of the managed identity, cannot be used at the same time as resourceID
384 type: string
385 type: object
386 resourceGroupName:
387 description: resource group the DNS zone is located in
388 type: string
389 subscriptionID:
390 description: ID of the Azure subscription
391 type: string
392 tenantID:
393 description: |-
394 Auth: Azure Service Principal:
395 The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
396 If set, ClientID and ClientSecret must also be set.
397 type: string
398 zoneType:
399 description: |-
400 ZoneType determines which type of Azure DNS zone to use.
401
402 Valid values are:
403 - AzurePublicZone (default): Use a public Azure DNS zone.
404 - AzurePrivateZone: Use an Azure Private DNS zone.
405
406 If not specified, AzurePublicZone is used.
407
408 Support for Azure Private DNS zones is currently
409 experimental and may change in future releases.
410 enum:
411 - AzurePublicZone
412 - AzurePrivateZone
413 type: string
414 required:
415 - resourceGroupName
416 - subscriptionID
417 type: object
418 cloudDNS:
419 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
420 properties:
421 hostedZoneName:
422 description: |-
423 HostedZoneName is an optional field that tells cert-manager in which
424 Cloud DNS zone the challenge record has to be created.
425 If left empty cert-manager will automatically choose a zone.
426 type: string
427 project:
428 type: string
429 serviceAccountSecretRef:
430 description: |-
431 A reference to a specific 'key' within a Secret resource.
432 In some instances, `key` is a required field.
433 properties:
434 key:
435 description: |-
436 The key of the entry in the Secret resource's `data` field to be used.
437 Some instances of this field may be defaulted, in others it may be
438 required.
439 type: string
440 name:
441 description: |-
442 Name of the resource being referred to.
443 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
444 type: string
445 required:
446 - name
447 type: object
448 required:
449 - project
450 type: object
451 cloudflare:
452 description: Use the Cloudflare API to manage DNS01 challenge records.
453 properties:
454 apiKeySecretRef:
455 description: |-
456 API key to use to authenticate with Cloudflare.
457 Note: using an API token to authenticate is now the recommended method
458 as it allows greater control of permissions.
459 properties:
460 key:
461 description: |-
462 The key of the entry in the Secret resource's `data` field to be used.
463 Some instances of this field may be defaulted, in others it may be
464 required.
465 type: string
466 name:
467 description: |-
468 Name of the resource being referred to.
469 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
470 type: string
471 required:
472 - name
473 type: object
474 apiTokenSecretRef:
475 description: API token used to authenticate with Cloudflare.
476 properties:
477 key:
478 description: |-
479 The key of the entry in the Secret resource's `data` field to be used.
480 Some instances of this field may be defaulted, in others it may be
481 required.
482 type: string
483 name:
484 description: |-
485 Name of the resource being referred to.
486 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
487 type: string
488 required:
489 - name
490 type: object
491 email:
492 description: Email of the account, only required when using API key based authentication.
493 type: string
494 type: object
495 cnameStrategy:
496 description: |-
497 CNAMEStrategy configures how the DNS01 provider should handle CNAME
498 records when found in DNS zones.
499 enum:
500 - None
501 - Follow
502 type: string
503 digitalocean:
504 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
505 properties:
506 tokenSecretRef:
507 description: |-
508 A reference to a specific 'key' within a Secret resource.
509 In some instances, `key` is a required field.
510 properties:
511 key:
512 description: |-
513 The key of the entry in the Secret resource's `data` field to be used.
514 Some instances of this field may be defaulted, in others it may be
515 required.
516 type: string
517 name:
518 description: |-
519 Name of the resource being referred to.
520 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
521 type: string
522 required:
523 - name
524 type: object
525 required:
526 - tokenSecretRef
527 type: object
528 rfc2136:
529 description: |-
530 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
531 to manage DNS01 challenge records.
532 properties:
533 nameserver:
534 description: |-
535 The IP address or hostname of an authoritative DNS server supporting
536 RFC2136 in the form host:port. If the host is an IPv6 address it must be
537 enclosed in square brackets (e.g [2001:db8::1]); port is optional.
538 This field is required.
539 type: string
540 protocol:
541 description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
542 enum:
543 - TCP
544 - UDP
545 type: string
546 tsigAlgorithm:
547 description: |-
548 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
549 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
550 Supported values are (case-insensitive): ``HMACMD5`` (default),
551 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
552 type: string
553 tsigKeyName:
554 description: |-
555 The TSIG Key name configured in the DNS.
556 If ``tsigSecretSecretRef`` is defined, this field is required.
557 type: string
558 tsigSecretSecretRef:
559 description: |-
560 The name of the secret containing the TSIG value.
561 If ``tsigKeyName`` is defined, this field is required.
562 properties:
563 key:
564 description: |-
565 The key of the entry in the Secret resource's `data` field to be used.
566 Some instances of this field may be defaulted, in others it may be
567 required.
568 type: string
569 name:
570 description: |-
571 Name of the resource being referred to.
572 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
573 type: string
574 required:
575 - name
576 type: object
577 required:
578 - nameserver
579 type: object
580 route53:
581 description: Use the AWS Route53 API to manage DNS01 challenge records.
582 properties:
583 accessKeyID:
584 description: |-
585 The AccessKeyID is used for authentication.
586 Cannot be set when SecretAccessKeyID is set.
587 If neither the Access Key nor Key ID are set, we fall back to using env
588 vars, shared credentials file, or AWS Instance metadata,
589 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
590 type: string
591 accessKeyIDSecretRef:
592 description: |-
593 The SecretAccessKey is used for authentication. If set, pull the AWS
594 access key ID from a key within a Kubernetes Secret.
595 Cannot be set when AccessKeyID is set.
596 If neither the Access Key nor Key ID are set, we fall back to using env
597 vars, shared credentials file, or AWS Instance metadata,
598 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
599 properties:
600 key:
601 description: |-
602 The key of the entry in the Secret resource's `data` field to be used.
603 Some instances of this field may be defaulted, in others it may be
604 required.
605 type: string
606 name:
607 description: |-
608 Name of the resource being referred to.
609 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
610 type: string
611 required:
612 - name
613 type: object
614 auth:
615 description: Auth configures how cert-manager authenticates.
616 properties:
617 kubernetes:
618 description: |-
619 Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
620 by passing a bound ServiceAccount token.
621 properties:
622 serviceAccountRef:
623 description: |-
624 A reference to a service account that will be used to request a bound
625 token (also known as "projected token"). To use this field, you must
626 configure an RBAC rule to let cert-manager request a token.
627 properties:
628 audiences:
629 description: |-
630 TokenAudiences is an optional list of audiences to include in the
631 token passed to AWS. The default token consisting of the issuer's namespace
632 and name is always included.
633 If unset the audience defaults to `sts.amazonaws.com`.
634 items:
635 type: string
636 type: array
637 x-kubernetes-list-type: atomic
638 name:
639 description: Name of the ServiceAccount used to request a token.
640 type: string
641 required:
642 - name
643 type: object
644 required:
645 - serviceAccountRef
646 type: object
647 required:
648 - kubernetes
649 type: object
650 hostedZoneID:
651 description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
652 type: string
653 region:
654 description: |-
655 Override the AWS region.
656
657 Route53 is a global service and does not have regional endpoints but the
658 region specified here (or via environment variables) is used as a hint to
659 help compute the correct AWS credential scope and partition when it
660 connects to Route53. See:
661 - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
662 - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
663
664 If you omit this region field, cert-manager will use the region from
665 AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
666 in the cert-manager controller Pod.
667
668 The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
669 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
670 [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
671 In this case this `region` field value is ignored.
672
673 The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
674 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
675 [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
676 In this case this `region` field value is ignored.
677 type: string
678 role:
679 description: |-
680 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
681 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
682 type: string
683 secretAccessKeySecretRef:
684 description: |-
685 The SecretAccessKey is used for authentication.
686 If neither the Access Key nor Key ID are set, we fall back to using env
687 vars, shared credentials file, or AWS Instance metadata,
688 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
689 properties:
690 key:
691 description: |-
692 The key of the entry in the Secret resource's `data` field to be used.
693 Some instances of this field may be defaulted, in others it may be
694 required.
695 type: string
696 name:
697 description: |-
698 Name of the resource being referred to.
699 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
700 type: string
701 required:
702 - name
703 type: object
704 type: object
705 webhook:
706 description: |-
707 Configure an external webhook based DNS01 challenge solver to manage
708 DNS01 challenge records.
709 properties:
710 config:
711 description: |-
712 Additional configuration that should be passed to the webhook apiserver
713 when challenges are processed.
714 This can contain arbitrary JSON data.
715 Secret values should not be specified in this stanza.
716 If secret values are needed (e.g., credentials for a DNS service), you
717 should use a SecretKeySelector to reference a Secret resource.
718 For details on the schema of this field, consult the webhook provider
719 implementation's documentation.
720 x-kubernetes-preserve-unknown-fields: true
721 groupName:
722 description: |-
723 The API group name that should be used when POSTing ChallengePayload
724 resources to the webhook apiserver.
725 This should be the same as the GroupName specified in the webhook
726 provider implementation.
727 type: string
728 solverName:
729 description: |-
730 The name of the solver to use, as defined in the webhook provider
731 implementation.
732 This will typically be the name of the provider, e.g., 'cloudflare'.
733 type: string
734 required:
735 - groupName
736 - solverName
737 type: object
738 type: object
739 http01:
740 description: |-
741 Configures cert-manager to attempt to complete authorizations by
742 performing the HTTP01 challenge flow.
743 It is not possible to obtain certificates for wildcard domain names
744 (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
745 properties:
746 gatewayHTTPRoute:
747 description: |-
748 The Gateway API is a sig-network community API that models service networking
749 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
750 create HTTPRoutes with the specified labels in the same namespace as the challenge.
751 This solver is experimental, and fields / behaviour may change in the future.
752 properties:
753 labels:
754 additionalProperties:
755 type: string
756 description: |-
757 Custom labels that will be applied to HTTPRoutes created by cert-manager
758 while solving HTTP-01 challenges.
759 type: object
760 parentRefs:
761 description: |-
762 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
763 cert-manager needs to know which parentRefs should be used when creating
764 the HTTPRoute. Usually, the parentRef references a Gateway. See:
765 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
766 items:
767 description: |-
768 ParentReference identifies an API object (usually a Gateway) that can be considered
769 a parent of this resource (usually a route). There are two kinds of parent resources
770 with "Core" support:
771
772 * Gateway (Gateway conformance profile)
773 * Service (Mesh conformance profile, ClusterIP Services only)
774
775 This API may be extended in the future to support additional kinds of parent
776 resources.
777
778 The API object must be valid in the cluster; the Group and Kind must
779 be registered in the cluster for this reference to be valid.
780 properties:
781 group:
782 default: gateway.networking.k8s.io
783 description: |-
784 Group is the group of the referent.
785 When unspecified, "gateway.networking.k8s.io" is inferred.
786 To set the core API group (such as for a "Service" kind referent),
787 Group must be explicitly set to "" (empty string).
788
789 Support: Core
790 maxLength: 253
791 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
792 type: string
793 kind:
794 default: Gateway
795 description: |-
796 Kind is kind of the referent.
797
798 There are two kinds of parent resources with "Core" support:
799
800 * Gateway (Gateway conformance profile)
801 * Service (Mesh conformance profile, ClusterIP Services only)
802
803 Support for other resources is Implementation-Specific.
804 maxLength: 63
805 minLength: 1
806 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
807 type: string
808 name:
809 description: |-
810 Name is the name of the referent.
811
812 Support: Core
813 maxLength: 253
814 minLength: 1
815 type: string
816 namespace:
817 description: |-
818 Namespace is the namespace of the referent. When unspecified, this refers
819 to the local namespace of the Route.
820
821 Note that there are specific rules for ParentRefs which cross namespace
822 boundaries. Cross-namespace references are only valid if they are explicitly
823 allowed by something in the namespace they are referring to. For example:
824 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
825 generic way to enable any other kind of cross-namespace reference.
826
827 <gateway:experimental:description>
828 ParentRefs from a Route to a Service in the same namespace are "producer"
829 routes, which apply default routing rules to inbound connections from
830 any namespace to the Service.
831
832 ParentRefs from a Route to a Service in a different namespace are
833 "consumer" routes, and these routing rules are only applied to outbound
834 connections originating from the same namespace as the Route, for which
835 the intended destination of the connections are a Service targeted as a
836 ParentRef of the Route.
837 </gateway:experimental:description>
838
839 Support: Core
840 maxLength: 63
841 minLength: 1
842 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
843 type: string
844 port:
845 description: |-
846 Port is the network port this Route targets. It can be interpreted
847 differently based on the type of parent resource.
848
849 When the parent resource is a Gateway, this targets all listeners
850 listening on the specified port that also support this kind of Route(and
851 select this Route). It's not recommended to set `Port` unless the
852 networking behaviors specified in a Route must apply to a specific port
853 as opposed to a listener(s) whose port(s) may be changed. When both Port
854 and SectionName are specified, the name and port of the selected listener
855 must match both specified values.
856
857 <gateway:experimental:description>
858 When the parent resource is a Service, this targets a specific port in the
859 Service spec. When both Port (experimental) and SectionName are specified,
860 the name and port of the selected port must match both specified values.
861 </gateway:experimental:description>
862
863 Implementations MAY choose to support other parent resources.
864 Implementations supporting other types of parent resources MUST clearly
865 document how/if Port is interpreted.
866
867 For the purpose of status, an attachment is considered successful as
868 long as the parent resource accepts it partially. For example, Gateway
869 listeners can restrict which Routes can attach to them by Route kind,
870 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
871 from the referencing Route, the Route MUST be considered successfully
872 attached. If no Gateway listeners accept attachment from this Route,
873 the Route MUST be considered detached from the Gateway.
874
875 Support: Extended
876 format: int32
877 maximum: 65535
878 minimum: 1
879 type: integer
880 sectionName:
881 description: |-
882 SectionName is the name of a section within the target resource. In the
883 following resources, SectionName is interpreted as the following:
884
885 * Gateway: Listener name. When both Port (experimental) and SectionName
886 are specified, the name and port of the selected listener must match
887 both specified values.
888 * Service: Port name. When both Port (experimental) and SectionName
889 are specified, the name and port of the selected listener must match
890 both specified values.
891
892 Implementations MAY choose to support attaching Routes to other resources.
893 If that is the case, they MUST clearly document how SectionName is
894 interpreted.
895
896 When unspecified (empty string), this will reference the entire resource.
897 For the purpose of status, an attachment is considered successful if at
898 least one section in the parent resource accepts it. For example, Gateway
899 listeners can restrict which Routes can attach to them by Route kind,
900 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
901 the referencing Route, the Route MUST be considered successfully
902 attached. If no Gateway listeners accept attachment from this Route, the
903 Route MUST be considered detached from the Gateway.
904
905 Support: Core
906 maxLength: 253
907 minLength: 1
908 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
909 type: string
910 required:
911 - name
912 type: object
913 type: array
914 x-kubernetes-list-type: atomic
915 podTemplate:
916 description: |-
917 Optional pod template used to configure the ACME challenge solver pods
918 used for HTTP01 challenges.
919 properties:
920 metadata:
921 description: |-
922 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
923 Only the 'labels' and 'annotations' fields may be set.
924 If labels or annotations overlap with in-built values, the values here
925 will override the in-built values.
926 properties:
927 annotations:
928 additionalProperties:
929 type: string
930 description: Annotations that should be added to the created ACME HTTP01 solver pods.
931 type: object
932 labels:
933 additionalProperties:
934 type: string
935 description: Labels that should be added to the created ACME HTTP01 solver pods.
936 type: object
937 type: object
938 spec:
939 description: |-
940 PodSpec defines overrides for the HTTP01 challenge solver pod.
941 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
942 All other fields will be ignored.
943 properties:
944 affinity:
945 description: If specified, the pod's scheduling constraints
946 properties:
947 nodeAffinity:
948 description: Describes node affinity scheduling rules for the pod.
949 properties:
950 preferredDuringSchedulingIgnoredDuringExecution:
951 description: |-
952 The scheduler will prefer to schedule pods to nodes that satisfy
953 the affinity expressions specified by this field, but it may choose
954 a node that violates one or more of the expressions. The node that is
955 most preferred is the one with the greatest sum of weights, i.e.
956 for each node that meets all of the scheduling requirements (resource
957 request, requiredDuringScheduling affinity expressions, etc.),
958 compute a sum by iterating through the elements of this field and adding
959 "weight" to the sum if the node matches the corresponding matchExpressions; the
960 node(s) with the highest sum are the most preferred.
961 items:
962 description: |-
963 An empty preferred scheduling term matches all objects with implicit weight 0
964 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
965 properties:
966 preference:
967 description: A node selector term, associated with the corresponding weight.
968 properties:
969 matchExpressions:
970 description: A list of node selector requirements by node's labels.
971 items:
972 description: |-
973 A node selector requirement is a selector that contains values, a key, and an operator
974 that relates the key and values.
975 properties:
976 key:
977 description: The label key that the selector applies to.
978 type: string
979 operator:
980 description: |-
981 Represents a key's relationship to a set of values.
982 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
983 type: string
984 values:
985 description: |-
986 An array of string values. If the operator is In or NotIn,
987 the values array must be non-empty. If the operator is Exists or DoesNotExist,
988 the values array must be empty. If the operator is Gt or Lt, the values
989 array must have a single element, which will be interpreted as an integer.
990 This array is replaced during a strategic merge patch.
991 items:
992 type: string
993 type: array
994 x-kubernetes-list-type: atomic
995 required:
996 - key
997 - operator
998 type: object
999 type: array
1000 x-kubernetes-list-type: atomic
1001 matchFields:
1002 description: A list of node selector requirements by node's fields.
1003 items:
1004 description: |-
1005 A node selector requirement is a selector that contains values, a key, and an operator
1006 that relates the key and values.
1007 properties:
1008 key:
1009 description: The label key that the selector applies to.
1010 type: string
1011 operator:
1012 description: |-
1013 Represents a key's relationship to a set of values.
1014 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1015 type: string
1016 values:
1017 description: |-
1018 An array of string values. If the operator is In or NotIn,
1019 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1020 the values array must be empty. If the operator is Gt or Lt, the values
1021 array must have a single element, which will be interpreted as an integer.
1022 This array is replaced during a strategic merge patch.
1023 items:
1024 type: string
1025 type: array
1026 x-kubernetes-list-type: atomic
1027 required:
1028 - key
1029 - operator
1030 type: object
1031 type: array
1032 x-kubernetes-list-type: atomic
1033 type: object
1034 x-kubernetes-map-type: atomic
1035 weight:
1036 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
1037 format: int32
1038 type: integer
1039 required:
1040 - preference
1041 - weight
1042 type: object
1043 type: array
1044 x-kubernetes-list-type: atomic
1045 requiredDuringSchedulingIgnoredDuringExecution:
1046 description: |-
1047 If the affinity requirements specified by this field are not met at
1048 scheduling time, the pod will not be scheduled onto the node.
1049 If the affinity requirements specified by this field cease to be met
1050 at some point during pod execution (e.g. due to an update), the system
1051 may or may not try to eventually evict the pod from its node.
1052 properties:
1053 nodeSelectorTerms:
1054 description: Required. A list of node selector terms. The terms are ORed.
1055 items:
1056 description: |-
1057 A null or empty node selector term matches no objects. The requirements of
1058 them are ANDed.
1059 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
1060 properties:
1061 matchExpressions:
1062 description: A list of node selector requirements by node's labels.
1063 items:
1064 description: |-
1065 A node selector requirement is a selector that contains values, a key, and an operator
1066 that relates the key and values.
1067 properties:
1068 key:
1069 description: The label key that the selector applies to.
1070 type: string
1071 operator:
1072 description: |-
1073 Represents a key's relationship to a set of values.
1074 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1075 type: string
1076 values:
1077 description: |-
1078 An array of string values. If the operator is In or NotIn,
1079 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1080 the values array must be empty. If the operator is Gt or Lt, the values
1081 array must have a single element, which will be interpreted as an integer.
1082 This array is replaced during a strategic merge patch.
1083 items:
1084 type: string
1085 type: array
1086 x-kubernetes-list-type: atomic
1087 required:
1088 - key
1089 - operator
1090 type: object
1091 type: array
1092 x-kubernetes-list-type: atomic
1093 matchFields:
1094 description: A list of node selector requirements by node's fields.
1095 items:
1096 description: |-
1097 A node selector requirement is a selector that contains values, a key, and an operator
1098 that relates the key and values.
1099 properties:
1100 key:
1101 description: The label key that the selector applies to.
1102 type: string
1103 operator:
1104 description: |-
1105 Represents a key's relationship to a set of values.
1106 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1107 type: string
1108 values:
1109 description: |-
1110 An array of string values. If the operator is In or NotIn,
1111 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1112 the values array must be empty. If the operator is Gt or Lt, the values
1113 array must have a single element, which will be interpreted as an integer.
1114 This array is replaced during a strategic merge patch.
1115 items:
1116 type: string
1117 type: array
1118 x-kubernetes-list-type: atomic
1119 required:
1120 - key
1121 - operator
1122 type: object
1123 type: array
1124 x-kubernetes-list-type: atomic
1125 type: object
1126 x-kubernetes-map-type: atomic
1127 type: array
1128 x-kubernetes-list-type: atomic
1129 required:
1130 - nodeSelectorTerms
1131 type: object
1132 x-kubernetes-map-type: atomic
1133 type: object
1134 podAffinity:
1135 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
1136 properties:
1137 preferredDuringSchedulingIgnoredDuringExecution:
1138 description: |-
1139 The scheduler will prefer to schedule pods to nodes that satisfy
1140 the affinity expressions specified by this field, but it may choose
1141 a node that violates one or more of the expressions. The node that is
1142 most preferred is the one with the greatest sum of weights, i.e.
1143 for each node that meets all of the scheduling requirements (resource
1144 request, requiredDuringScheduling affinity expressions, etc.),
1145 compute a sum by iterating through the elements of this field and adding
1146 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
1147 node(s) with the highest sum are the most preferred.
1148 items:
1149 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1150 properties:
1151 podAffinityTerm:
1152 description: Required. A pod affinity term, associated with the corresponding weight.
1153 properties:
1154 labelSelector:
1155 description: |-
1156 A label query over a set of resources, in this case pods.
1157 If it's null, this PodAffinityTerm matches with no Pods.
1158 properties:
1159 matchExpressions:
1160 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1161 items:
1162 description: |-
1163 A label selector requirement is a selector that contains values, a key, and an operator that
1164 relates the key and values.
1165 properties:
1166 key:
1167 description: key is the label key that the selector applies to.
1168 type: string
1169 operator:
1170 description: |-
1171 operator represents a key's relationship to a set of values.
1172 Valid operators are In, NotIn, Exists and DoesNotExist.
1173 type: string
1174 values:
1175 description: |-
1176 values is an array of string values. If the operator is In or NotIn,
1177 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1178 the values array must be empty. This array is replaced during a strategic
1179 merge patch.
1180 items:
1181 type: string
1182 type: array
1183 x-kubernetes-list-type: atomic
1184 required:
1185 - key
1186 - operator
1187 type: object
1188 type: array
1189 x-kubernetes-list-type: atomic
1190 matchLabels:
1191 additionalProperties:
1192 type: string
1193 description: |-
1194 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1195 map is equivalent to an element of matchExpressions, whose key field is "key", the
1196 operator is "In", and the values array contains only "value". The requirements are ANDed.
1197 type: object
1198 type: object
1199 x-kubernetes-map-type: atomic
1200 matchLabelKeys:
1201 description: |-
1202 MatchLabelKeys is a set of pod label keys to select which pods will
1203 be taken into consideration. The keys are used to lookup values from the
1204 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1205 to select the group of existing pods which pods will be taken into consideration
1206 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1207 pod labels will be ignored. The default value is empty.
1208 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1209 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1210 items:
1211 type: string
1212 type: array
1213 x-kubernetes-list-type: atomic
1214 mismatchLabelKeys:
1215 description: |-
1216 MismatchLabelKeys is a set of pod label keys to select which pods will
1217 be taken into consideration. The keys are used to lookup values from the
1218 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1219 to select the group of existing pods which pods will be taken into consideration
1220 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1221 pod labels will be ignored. The default value is empty.
1222 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1223 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1224 items:
1225 type: string
1226 type: array
1227 x-kubernetes-list-type: atomic
1228 namespaceSelector:
1229 description: |-
1230 A label query over the set of namespaces that the term applies to.
1231 The term is applied to the union of the namespaces selected by this field
1232 and the ones listed in the namespaces field.
1233 null selector and null or empty namespaces list means "this pod's namespace".
1234 An empty selector ({}) matches all namespaces.
1235 properties:
1236 matchExpressions:
1237 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1238 items:
1239 description: |-
1240 A label selector requirement is a selector that contains values, a key, and an operator that
1241 relates the key and values.
1242 properties:
1243 key:
1244 description: key is the label key that the selector applies to.
1245 type: string
1246 operator:
1247 description: |-
1248 operator represents a key's relationship to a set of values.
1249 Valid operators are In, NotIn, Exists and DoesNotExist.
1250 type: string
1251 values:
1252 description: |-
1253 values is an array of string values. If the operator is In or NotIn,
1254 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1255 the values array must be empty. This array is replaced during a strategic
1256 merge patch.
1257 items:
1258 type: string
1259 type: array
1260 x-kubernetes-list-type: atomic
1261 required:
1262 - key
1263 - operator
1264 type: object
1265 type: array
1266 x-kubernetes-list-type: atomic
1267 matchLabels:
1268 additionalProperties:
1269 type: string
1270 description: |-
1271 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1272 map is equivalent to an element of matchExpressions, whose key field is "key", the
1273 operator is "In", and the values array contains only "value". The requirements are ANDed.
1274 type: object
1275 type: object
1276 x-kubernetes-map-type: atomic
1277 namespaces:
1278 description: |-
1279 namespaces specifies a static list of namespace names that the term applies to.
1280 The term is applied to the union of the namespaces listed in this field
1281 and the ones selected by namespaceSelector.
1282 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1283 items:
1284 type: string
1285 type: array
1286 x-kubernetes-list-type: atomic
1287 topologyKey:
1288 description: |-
1289 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1290 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1291 whose value of the label with key topologyKey matches that of any node on which any of the
1292 selected pods is running.
1293 Empty topologyKey is not allowed.
1294 type: string
1295 required:
1296 - topologyKey
1297 type: object
1298 weight:
1299 description: |-
1300 weight associated with matching the corresponding podAffinityTerm,
1301 in the range 1-100.
1302 format: int32
1303 type: integer
1304 required:
1305 - podAffinityTerm
1306 - weight
1307 type: object
1308 type: array
1309 x-kubernetes-list-type: atomic
1310 requiredDuringSchedulingIgnoredDuringExecution:
1311 description: |-
1312 If the affinity requirements specified by this field are not met at
1313 scheduling time, the pod will not be scheduled onto the node.
1314 If the affinity requirements specified by this field cease to be met
1315 at some point during pod execution (e.g. due to a pod label update), the
1316 system may or may not try to eventually evict the pod from its node.
1317 When there are multiple elements, the lists of nodes corresponding to each
1318 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1319 items:
1320 description: |-
1321 Defines a set of pods (namely those matching the labelSelector
1322 relative to the given namespace(s)) that this pod should be
1323 co-located (affinity) or not co-located (anti-affinity) with,
1324 where co-located is defined as running on a node whose value of
1325 the label with key <topologyKey> matches that of any node on which
1326 a pod of the set of pods is running
1327 properties:
1328 labelSelector:
1329 description: |-
1330 A label query over a set of resources, in this case pods.
1331 If it's null, this PodAffinityTerm matches with no Pods.
1332 properties:
1333 matchExpressions:
1334 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1335 items:
1336 description: |-
1337 A label selector requirement is a selector that contains values, a key, and an operator that
1338 relates the key and values.
1339 properties:
1340 key:
1341 description: key is the label key that the selector applies to.
1342 type: string
1343 operator:
1344 description: |-
1345 operator represents a key's relationship to a set of values.
1346 Valid operators are In, NotIn, Exists and DoesNotExist.
1347 type: string
1348 values:
1349 description: |-
1350 values is an array of string values. If the operator is In or NotIn,
1351 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1352 the values array must be empty. This array is replaced during a strategic
1353 merge patch.
1354 items:
1355 type: string
1356 type: array
1357 x-kubernetes-list-type: atomic
1358 required:
1359 - key
1360 - operator
1361 type: object
1362 type: array
1363 x-kubernetes-list-type: atomic
1364 matchLabels:
1365 additionalProperties:
1366 type: string
1367 description: |-
1368 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1369 map is equivalent to an element of matchExpressions, whose key field is "key", the
1370 operator is "In", and the values array contains only "value". The requirements are ANDed.
1371 type: object
1372 type: object
1373 x-kubernetes-map-type: atomic
1374 matchLabelKeys:
1375 description: |-
1376 MatchLabelKeys is a set of pod label keys to select which pods will
1377 be taken into consideration. The keys are used to lookup values from the
1378 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1379 to select the group of existing pods which pods will be taken into consideration
1380 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1381 pod labels will be ignored. The default value is empty.
1382 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1383 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1384 items:
1385 type: string
1386 type: array
1387 x-kubernetes-list-type: atomic
1388 mismatchLabelKeys:
1389 description: |-
1390 MismatchLabelKeys is a set of pod label keys to select which pods will
1391 be taken into consideration. The keys are used to lookup values from the
1392 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1393 to select the group of existing pods which pods will be taken into consideration
1394 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1395 pod labels will be ignored. The default value is empty.
1396 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1397 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1398 items:
1399 type: string
1400 type: array
1401 x-kubernetes-list-type: atomic
1402 namespaceSelector:
1403 description: |-
1404 A label query over the set of namespaces that the term applies to.
1405 The term is applied to the union of the namespaces selected by this field
1406 and the ones listed in the namespaces field.
1407 null selector and null or empty namespaces list means "this pod's namespace".
1408 An empty selector ({}) matches all namespaces.
1409 properties:
1410 matchExpressions:
1411 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1412 items:
1413 description: |-
1414 A label selector requirement is a selector that contains values, a key, and an operator that
1415 relates the key and values.
1416 properties:
1417 key:
1418 description: key is the label key that the selector applies to.
1419 type: string
1420 operator:
1421 description: |-
1422 operator represents a key's relationship to a set of values.
1423 Valid operators are In, NotIn, Exists and DoesNotExist.
1424 type: string
1425 values:
1426 description: |-
1427 values is an array of string values. If the operator is In or NotIn,
1428 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1429 the values array must be empty. This array is replaced during a strategic
1430 merge patch.
1431 items:
1432 type: string
1433 type: array
1434 x-kubernetes-list-type: atomic
1435 required:
1436 - key
1437 - operator
1438 type: object
1439 type: array
1440 x-kubernetes-list-type: atomic
1441 matchLabels:
1442 additionalProperties:
1443 type: string
1444 description: |-
1445 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1446 map is equivalent to an element of matchExpressions, whose key field is "key", the
1447 operator is "In", and the values array contains only "value". The requirements are ANDed.
1448 type: object
1449 type: object
1450 x-kubernetes-map-type: atomic
1451 namespaces:
1452 description: |-
1453 namespaces specifies a static list of namespace names that the term applies to.
1454 The term is applied to the union of the namespaces listed in this field
1455 and the ones selected by namespaceSelector.
1456 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1457 items:
1458 type: string
1459 type: array
1460 x-kubernetes-list-type: atomic
1461 topologyKey:
1462 description: |-
1463 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1464 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1465 whose value of the label with key topologyKey matches that of any node on which any of the
1466 selected pods is running.
1467 Empty topologyKey is not allowed.
1468 type: string
1469 required:
1470 - topologyKey
1471 type: object
1472 type: array
1473 x-kubernetes-list-type: atomic
1474 type: object
1475 podAntiAffinity:
1476 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
1477 properties:
1478 preferredDuringSchedulingIgnoredDuringExecution:
1479 description: |-
1480 The scheduler will prefer to schedule pods to nodes that satisfy
1481 the anti-affinity expressions specified by this field, but it may choose
1482 a node that violates one or more of the expressions. The node that is
1483 most preferred is the one with the greatest sum of weights, i.e.
1484 for each node that meets all of the scheduling requirements (resource
1485 request, requiredDuringScheduling anti-affinity expressions, etc.),
1486 compute a sum by iterating through the elements of this field and subtracting
1487 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
1488 node(s) with the highest sum are the most preferred.
1489 items:
1490 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1491 properties:
1492 podAffinityTerm:
1493 description: Required. A pod affinity term, associated with the corresponding weight.
1494 properties:
1495 labelSelector:
1496 description: |-
1497 A label query over a set of resources, in this case pods.
1498 If it's null, this PodAffinityTerm matches with no Pods.
1499 properties:
1500 matchExpressions:
1501 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1502 items:
1503 description: |-
1504 A label selector requirement is a selector that contains values, a key, and an operator that
1505 relates the key and values.
1506 properties:
1507 key:
1508 description: key is the label key that the selector applies to.
1509 type: string
1510 operator:
1511 description: |-
1512 operator represents a key's relationship to a set of values.
1513 Valid operators are In, NotIn, Exists and DoesNotExist.
1514 type: string
1515 values:
1516 description: |-
1517 values is an array of string values. If the operator is In or NotIn,
1518 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1519 the values array must be empty. This array is replaced during a strategic
1520 merge patch.
1521 items:
1522 type: string
1523 type: array
1524 x-kubernetes-list-type: atomic
1525 required:
1526 - key
1527 - operator
1528 type: object
1529 type: array
1530 x-kubernetes-list-type: atomic
1531 matchLabels:
1532 additionalProperties:
1533 type: string
1534 description: |-
1535 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1536 map is equivalent to an element of matchExpressions, whose key field is "key", the
1537 operator is "In", and the values array contains only "value". The requirements are ANDed.
1538 type: object
1539 type: object
1540 x-kubernetes-map-type: atomic
1541 matchLabelKeys:
1542 description: |-
1543 MatchLabelKeys is a set of pod label keys to select which pods will
1544 be taken into consideration. The keys are used to lookup values from the
1545 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1546 to select the group of existing pods which pods will be taken into consideration
1547 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1548 pod labels will be ignored. The default value is empty.
1549 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1550 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1551 items:
1552 type: string
1553 type: array
1554 x-kubernetes-list-type: atomic
1555 mismatchLabelKeys:
1556 description: |-
1557 MismatchLabelKeys is a set of pod label keys to select which pods will
1558 be taken into consideration. The keys are used to lookup values from the
1559 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1560 to select the group of existing pods which pods will be taken into consideration
1561 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1562 pod labels will be ignored. The default value is empty.
1563 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1564 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1565 items:
1566 type: string
1567 type: array
1568 x-kubernetes-list-type: atomic
1569 namespaceSelector:
1570 description: |-
1571 A label query over the set of namespaces that the term applies to.
1572 The term is applied to the union of the namespaces selected by this field
1573 and the ones listed in the namespaces field.
1574 null selector and null or empty namespaces list means "this pod's namespace".
1575 An empty selector ({}) matches all namespaces.
1576 properties:
1577 matchExpressions:
1578 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1579 items:
1580 description: |-
1581 A label selector requirement is a selector that contains values, a key, and an operator that
1582 relates the key and values.
1583 properties:
1584 key:
1585 description: key is the label key that the selector applies to.
1586 type: string
1587 operator:
1588 description: |-
1589 operator represents a key's relationship to a set of values.
1590 Valid operators are In, NotIn, Exists and DoesNotExist.
1591 type: string
1592 values:
1593 description: |-
1594 values is an array of string values. If the operator is In or NotIn,
1595 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1596 the values array must be empty. This array is replaced during a strategic
1597 merge patch.
1598 items:
1599 type: string
1600 type: array
1601 x-kubernetes-list-type: atomic
1602 required:
1603 - key
1604 - operator
1605 type: object
1606 type: array
1607 x-kubernetes-list-type: atomic
1608 matchLabels:
1609 additionalProperties:
1610 type: string
1611 description: |-
1612 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1613 map is equivalent to an element of matchExpressions, whose key field is "key", the
1614 operator is "In", and the values array contains only "value". The requirements are ANDed.
1615 type: object
1616 type: object
1617 x-kubernetes-map-type: atomic
1618 namespaces:
1619 description: |-
1620 namespaces specifies a static list of namespace names that the term applies to.
1621 The term is applied to the union of the namespaces listed in this field
1622 and the ones selected by namespaceSelector.
1623 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1624 items:
1625 type: string
1626 type: array
1627 x-kubernetes-list-type: atomic
1628 topologyKey:
1629 description: |-
1630 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1631 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1632 whose value of the label with key topologyKey matches that of any node on which any of the
1633 selected pods is running.
1634 Empty topologyKey is not allowed.
1635 type: string
1636 required:
1637 - topologyKey
1638 type: object
1639 weight:
1640 description: |-
1641 weight associated with matching the corresponding podAffinityTerm,
1642 in the range 1-100.
1643 format: int32
1644 type: integer
1645 required:
1646 - podAffinityTerm
1647 - weight
1648 type: object
1649 type: array
1650 x-kubernetes-list-type: atomic
1651 requiredDuringSchedulingIgnoredDuringExecution:
1652 description: |-
1653 If the anti-affinity requirements specified by this field are not met at
1654 scheduling time, the pod will not be scheduled onto the node.
1655 If the anti-affinity requirements specified by this field cease to be met
1656 at some point during pod execution (e.g. due to a pod label update), the
1657 system may or may not try to eventually evict the pod from its node.
1658 When there are multiple elements, the lists of nodes corresponding to each
1659 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1660 items:
1661 description: |-
1662 Defines a set of pods (namely those matching the labelSelector
1663 relative to the given namespace(s)) that this pod should be
1664 co-located (affinity) or not co-located (anti-affinity) with,
1665 where co-located is defined as running on a node whose value of
1666 the label with key <topologyKey> matches that of any node on which
1667 a pod of the set of pods is running
1668 properties:
1669 labelSelector:
1670 description: |-
1671 A label query over a set of resources, in this case pods.
1672 If it's null, this PodAffinityTerm matches with no Pods.
1673 properties:
1674 matchExpressions:
1675 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1676 items:
1677 description: |-
1678 A label selector requirement is a selector that contains values, a key, and an operator that
1679 relates the key and values.
1680 properties:
1681 key:
1682 description: key is the label key that the selector applies to.
1683 type: string
1684 operator:
1685 description: |-
1686 operator represents a key's relationship to a set of values.
1687 Valid operators are In, NotIn, Exists and DoesNotExist.
1688 type: string
1689 values:
1690 description: |-
1691 values is an array of string values. If the operator is In or NotIn,
1692 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1693 the values array must be empty. This array is replaced during a strategic
1694 merge patch.
1695 items:
1696 type: string
1697 type: array
1698 x-kubernetes-list-type: atomic
1699 required:
1700 - key
1701 - operator
1702 type: object
1703 type: array
1704 x-kubernetes-list-type: atomic
1705 matchLabels:
1706 additionalProperties:
1707 type: string
1708 description: |-
1709 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1710 map is equivalent to an element of matchExpressions, whose key field is "key", the
1711 operator is "In", and the values array contains only "value". The requirements are ANDed.
1712 type: object
1713 type: object
1714 x-kubernetes-map-type: atomic
1715 matchLabelKeys:
1716 description: |-
1717 MatchLabelKeys is a set of pod label keys to select which pods will
1718 be taken into consideration. The keys are used to lookup values from the
1719 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1720 to select the group of existing pods which pods will be taken into consideration
1721 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1722 pod labels will be ignored. The default value is empty.
1723 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1724 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1725 items:
1726 type: string
1727 type: array
1728 x-kubernetes-list-type: atomic
1729 mismatchLabelKeys:
1730 description: |-
1731 MismatchLabelKeys is a set of pod label keys to select which pods will
1732 be taken into consideration. The keys are used to lookup values from the
1733 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1734 to select the group of existing pods which pods will be taken into consideration
1735 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1736 pod labels will be ignored. The default value is empty.
1737 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1738 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1739 items:
1740 type: string
1741 type: array
1742 x-kubernetes-list-type: atomic
1743 namespaceSelector:
1744 description: |-
1745 A label query over the set of namespaces that the term applies to.
1746 The term is applied to the union of the namespaces selected by this field
1747 and the ones listed in the namespaces field.
1748 null selector and null or empty namespaces list means "this pod's namespace".
1749 An empty selector ({}) matches all namespaces.
1750 properties:
1751 matchExpressions:
1752 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1753 items:
1754 description: |-
1755 A label selector requirement is a selector that contains values, a key, and an operator that
1756 relates the key and values.
1757 properties:
1758 key:
1759 description: key is the label key that the selector applies to.
1760 type: string
1761 operator:
1762 description: |-
1763 operator represents a key's relationship to a set of values.
1764 Valid operators are In, NotIn, Exists and DoesNotExist.
1765 type: string
1766 values:
1767 description: |-
1768 values is an array of string values. If the operator is In or NotIn,
1769 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1770 the values array must be empty. This array is replaced during a strategic
1771 merge patch.
1772 items:
1773 type: string
1774 type: array
1775 x-kubernetes-list-type: atomic
1776 required:
1777 - key
1778 - operator
1779 type: object
1780 type: array
1781 x-kubernetes-list-type: atomic
1782 matchLabels:
1783 additionalProperties:
1784 type: string
1785 description: |-
1786 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1787 map is equivalent to an element of matchExpressions, whose key field is "key", the
1788 operator is "In", and the values array contains only "value". The requirements are ANDed.
1789 type: object
1790 type: object
1791 x-kubernetes-map-type: atomic
1792 namespaces:
1793 description: |-
1794 namespaces specifies a static list of namespace names that the term applies to.
1795 The term is applied to the union of the namespaces listed in this field
1796 and the ones selected by namespaceSelector.
1797 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1798 items:
1799 type: string
1800 type: array
1801 x-kubernetes-list-type: atomic
1802 topologyKey:
1803 description: |-
1804 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1805 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1806 whose value of the label with key topologyKey matches that of any node on which any of the
1807 selected pods is running.
1808 Empty topologyKey is not allowed.
1809 type: string
1810 required:
1811 - topologyKey
1812 type: object
1813 type: array
1814 x-kubernetes-list-type: atomic
1815 type: object
1816 type: object
1817 imagePullSecrets:
1818 description: If specified, the pod's imagePullSecrets
1819 items:
1820 description: |-
1821 LocalObjectReference contains enough information to let you locate the
1822 referenced object inside the same namespace.
1823 properties:
1824 name:
1825 default: ""
1826 description: |-
1827 Name of the referent.
1828 This field is effectively required, but due to backwards compatibility is
1829 allowed to be empty. Instances of this type with an empty value here are
1830 almost certainly wrong.
1831 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1832 type: string
1833 type: object
1834 x-kubernetes-map-type: atomic
1835 type: array
1836 x-kubernetes-list-map-keys:
1837 - name
1838 x-kubernetes-list-type: map
1839 nodeSelector:
1840 additionalProperties:
1841 type: string
1842 description: |-
1843 NodeSelector is a selector which must be true for the pod to fit on a node.
1844 Selector which must match a node's labels for the pod to be scheduled on that node.
1845 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
1846 type: object
1847 priorityClassName:
1848 description: If specified, the pod's priorityClassName.
1849 type: string
1850 resources:
1851 description: |-
1852 If specified, the pod's resource requirements.
1853 These values override the global resource configuration flags.
1854 Note that when only specifying resource limits, ensure they are greater than or equal
1855 to the corresponding global resource requests configured via controller flags
1856 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
1857 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
1858 properties:
1859 limits:
1860 additionalProperties:
1861 anyOf:
1862 - type: integer
1863 - type: string
1864 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1865 x-kubernetes-int-or-string: true
1866 description: |-
1867 Limits describes the maximum amount of compute resources allowed.
1868 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1869 type: object
1870 requests:
1871 additionalProperties:
1872 anyOf:
1873 - type: integer
1874 - type: string
1875 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1876 x-kubernetes-int-or-string: true
1877 description: |-
1878 Requests describes the minimum amount of compute resources required.
1879 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
1880 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
1881 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1882 type: object
1883 type: object
1884 securityContext:
1885 description: If specified, the pod's security context
1886 properties:
1887 fsGroup:
1888 description: |-
1889 A special supplemental group that applies to all containers in a pod.
1890 Some volume types allow the Kubelet to change the ownership of that volume
1891 to be owned by the pod:
1892
1893 1. The owning GID will be the FSGroup
1894 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
1895 3. The permission bits are OR'd with rw-rw----
1896
1897 If unset, the Kubelet will not modify the ownership and permissions of any volume.
1898 Note that this field cannot be set when spec.os.name is windows.
1899 format: int64
1900 type: integer
1901 fsGroupChangePolicy:
1902 description: |-
1903 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
1904 before being exposed inside Pod. This field will only apply to
1905 volume types which support fsGroup based ownership(and permissions).
1906 It will have no effect on ephemeral volume types such as: secret, configmaps
1907 and emptydir.
1908 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
1909 Note that this field cannot be set when spec.os.name is windows.
1910 type: string
1911 runAsGroup:
1912 description: |-
1913 The GID to run the entrypoint of the container process.
1914 Uses runtime default if unset.
1915 May also be set in SecurityContext. If set in both SecurityContext and
1916 PodSecurityContext, the value specified in SecurityContext takes precedence
1917 for that container.
1918 Note that this field cannot be set when spec.os.name is windows.
1919 format: int64
1920 type: integer
1921 runAsNonRoot:
1922 description: |-
1923 Indicates that the container must run as a non-root user.
1924 If true, the Kubelet will validate the image at runtime to ensure that it
1925 does not run as UID 0 (root) and fail to start the container if it does.
1926 If unset or false, no such validation will be performed.
1927 May also be set in SecurityContext. If set in both SecurityContext and
1928 PodSecurityContext, the value specified in SecurityContext takes precedence.
1929 type: boolean
1930 runAsUser:
1931 description: |-
1932 The UID to run the entrypoint of the container process.
1933 Defaults to user specified in image metadata if unspecified.
1934 May also be set in SecurityContext. If set in both SecurityContext and
1935 PodSecurityContext, the value specified in SecurityContext takes precedence
1936 for that container.
1937 Note that this field cannot be set when spec.os.name is windows.
1938 format: int64
1939 type: integer
1940 seLinuxOptions:
1941 description: |-
1942 The SELinux context to be applied to all containers.
1943 If unspecified, the container runtime will allocate a random SELinux context for each
1944 container. May also be set in SecurityContext. If set in
1945 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
1946 takes precedence for that container.
1947 Note that this field cannot be set when spec.os.name is windows.
1948 properties:
1949 level:
1950 description: Level is SELinux level label that applies to the container.
1951 type: string
1952 role:
1953 description: Role is a SELinux role label that applies to the container.
1954 type: string
1955 type:
1956 description: Type is a SELinux type label that applies to the container.
1957 type: string
1958 user:
1959 description: User is a SELinux user label that applies to the container.
1960 type: string
1961 type: object
1962 seccompProfile:
1963 description: |-
1964 The seccomp options to use by the containers in this pod.
1965 Note that this field cannot be set when spec.os.name is windows.
1966 properties:
1967 localhostProfile:
1968 description: |-
1969 localhostProfile indicates a profile defined in a file on the node should be used.
1970 The profile must be preconfigured on the node to work.
1971 Must be a descending path, relative to the kubelet's configured seccomp profile location.
1972 Must be set if type is "Localhost". Must NOT be set for any other type.
1973 type: string
1974 type:
1975 description: |-
1976 type indicates which kind of seccomp profile will be applied.
1977 Valid options are:
1978
1979 Localhost - a profile defined in a file on the node should be used.
1980 RuntimeDefault - the container runtime default profile should be used.
1981 Unconfined - no profile should be applied.
1982 type: string
1983 required:
1984 - type
1985 type: object
1986 supplementalGroups:
1987 description: |-
1988 A list of groups applied to the first process run in each container, in addition
1989 to the container's primary GID, the fsGroup (if specified), and group memberships
1990 defined in the container image for the uid of the container process. If unspecified,
1991 no additional groups are added to any container. Note that group memberships
1992 defined in the container image for the uid of the container process are still effective,
1993 even if they are not included in this list.
1994 Note that this field cannot be set when spec.os.name is windows.
1995 items:
1996 format: int64
1997 type: integer
1998 type: array
1999 x-kubernetes-list-type: atomic
2000 sysctls:
2001 description: |-
2002 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
2003 sysctls (by the container runtime) might fail to launch.
2004 Note that this field cannot be set when spec.os.name is windows.
2005 items:
2006 description: Sysctl defines a kernel parameter to be set
2007 properties:
2008 name:
2009 description: Name of a property to set
2010 type: string
2011 value:
2012 description: Value of a property to set
2013 type: string
2014 required:
2015 - name
2016 - value
2017 type: object
2018 type: array
2019 x-kubernetes-list-type: atomic
2020 type: object
2021 serviceAccountName:
2022 description: If specified, the pod's service account
2023 type: string
2024 tolerations:
2025 description: If specified, the pod's tolerations.
2026 items:
2027 description: |-
2028 The pod this Toleration is attached to tolerates any taint that matches
2029 the triple <key,value,effect> using the matching operator <operator>.
2030 properties:
2031 effect:
2032 description: |-
2033 Effect indicates the taint effect to match. Empty means match all taint effects.
2034 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
2035 type: string
2036 key:
2037 description: |-
2038 Key is the taint key that the toleration applies to. Empty means match all taint keys.
2039 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
2040 type: string
2041 operator:
2042 description: |-
2043 Operator represents a key's relationship to the value.
2044 Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
2045 Exists is equivalent to wildcard for value, so that a pod can
2046 tolerate all taints of a particular category.
2047 Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
2048 type: string
2049 tolerationSeconds:
2050 description: |-
2051 TolerationSeconds represents the period of time the toleration (which must be
2052 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
2053 it is not set, which means tolerate the taint forever (do not evict). Zero and
2054 negative values will be treated as 0 (evict immediately) by the system.
2055 format: int64
2056 type: integer
2057 value:
2058 description: |-
2059 Value is the taint value the toleration matches to.
2060 If the operator is Exists, the value should be empty, otherwise just a regular string.
2061 type: string
2062 type: object
2063 type: array
2064 x-kubernetes-list-type: atomic
2065 type: object
2066 type: object
2067 serviceType:
2068 description: |-
2069 Optional service type for Kubernetes solver service. Supported values
2070 are NodePort or ClusterIP. If unset, defaults to NodePort.
2071 type: string
2072 type: object
2073 ingress:
2074 description: |-
2075 The ingress based HTTP01 challenge solver will solve challenges by
2076 creating or modifying Ingress resources in order to route requests for
2077 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
2078 provisioned by cert-manager for each Challenge to be completed.
2079 properties:
2080 class:
2081 description: |-
2082 This field configures the annotation `kubernetes.io/ingress.class` when
2083 creating Ingress resources to solve ACME challenges that use this
2084 challenge solver. Only one of `class`, `name` or `ingressClassName` may
2085 be specified.
2086 type: string
2087 ingressClassName:
2088 description: |-
2089 This field configures the field `ingressClassName` on the created Ingress
2090 resources used to solve ACME challenges that use this challenge solver.
2091 This is the recommended way of configuring the ingress class. Only one of
2092 `class`, `name` or `ingressClassName` may be specified.
2093 type: string
2094 ingressTemplate:
2095 description: |-
2096 Optional ingress template used to configure the ACME challenge solver
2097 ingress used for HTTP01 challenges.
2098 properties:
2099 metadata:
2100 description: |-
2101 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
2102 Only the 'labels' and 'annotations' fields may be set.
2103 If labels or annotations overlap with in-built values, the values here
2104 will override the in-built values.
2105 properties:
2106 annotations:
2107 additionalProperties:
2108 type: string
2109 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
2110 type: object
2111 labels:
2112 additionalProperties:
2113 type: string
2114 description: Labels that should be added to the created ACME HTTP01 solver ingress.
2115 type: object
2116 type: object
2117 type: object
2118 name:
2119 description: |-
2120 The name of the ingress resource that should have ACME challenge solving
2121 routes inserted into it in order to solve HTTP01 challenges.
2122 This is typically used in conjunction with ingress controllers like
2123 ingress-gce, which maintains a 1:1 mapping between external IPs and
2124 ingress resources. Only one of `class`, `name` or `ingressClassName` may
2125 be specified.
2126 type: string
2127 podTemplate:
2128 description: |-
2129 Optional pod template used to configure the ACME challenge solver pods
2130 used for HTTP01 challenges.
2131 properties:
2132 metadata:
2133 description: |-
2134 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
2135 Only the 'labels' and 'annotations' fields may be set.
2136 If labels or annotations overlap with in-built values, the values here
2137 will override the in-built values.
2138 properties:
2139 annotations:
2140 additionalProperties:
2141 type: string
2142 description: Annotations that should be added to the created ACME HTTP01 solver pods.
2143 type: object
2144 labels:
2145 additionalProperties:
2146 type: string
2147 description: Labels that should be added to the created ACME HTTP01 solver pods.
2148 type: object
2149 type: object
2150 spec:
2151 description: |-
2152 PodSpec defines overrides for the HTTP01 challenge solver pod.
2153 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
2154 All other fields will be ignored.
2155 properties:
2156 affinity:
2157 description: If specified, the pod's scheduling constraints
2158 properties:
2159 nodeAffinity:
2160 description: Describes node affinity scheduling rules for the pod.
2161 properties:
2162 preferredDuringSchedulingIgnoredDuringExecution:
2163 description: |-
2164 The scheduler will prefer to schedule pods to nodes that satisfy
2165 the affinity expressions specified by this field, but it may choose
2166 a node that violates one or more of the expressions. The node that is
2167 most preferred is the one with the greatest sum of weights, i.e.
2168 for each node that meets all of the scheduling requirements (resource
2169 request, requiredDuringScheduling affinity expressions, etc.),
2170 compute a sum by iterating through the elements of this field and adding
2171 "weight" to the sum if the node matches the corresponding matchExpressions; the
2172 node(s) with the highest sum are the most preferred.
2173 items:
2174 description: |-
2175 An empty preferred scheduling term matches all objects with implicit weight 0
2176 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
2177 properties:
2178 preference:
2179 description: A node selector term, associated with the corresponding weight.
2180 properties:
2181 matchExpressions:
2182 description: A list of node selector requirements by node's labels.
2183 items:
2184 description: |-
2185 A node selector requirement is a selector that contains values, a key, and an operator
2186 that relates the key and values.
2187 properties:
2188 key:
2189 description: The label key that the selector applies to.
2190 type: string
2191 operator:
2192 description: |-
2193 Represents a key's relationship to a set of values.
2194 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2195 type: string
2196 values:
2197 description: |-
2198 An array of string values. If the operator is In or NotIn,
2199 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2200 the values array must be empty. If the operator is Gt or Lt, the values
2201 array must have a single element, which will be interpreted as an integer.
2202 This array is replaced during a strategic merge patch.
2203 items:
2204 type: string
2205 type: array
2206 x-kubernetes-list-type: atomic
2207 required:
2208 - key
2209 - operator
2210 type: object
2211 type: array
2212 x-kubernetes-list-type: atomic
2213 matchFields:
2214 description: A list of node selector requirements by node's fields.
2215 items:
2216 description: |-
2217 A node selector requirement is a selector that contains values, a key, and an operator
2218 that relates the key and values.
2219 properties:
2220 key:
2221 description: The label key that the selector applies to.
2222 type: string
2223 operator:
2224 description: |-
2225 Represents a key's relationship to a set of values.
2226 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2227 type: string
2228 values:
2229 description: |-
2230 An array of string values. If the operator is In or NotIn,
2231 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2232 the values array must be empty. If the operator is Gt or Lt, the values
2233 array must have a single element, which will be interpreted as an integer.
2234 This array is replaced during a strategic merge patch.
2235 items:
2236 type: string
2237 type: array
2238 x-kubernetes-list-type: atomic
2239 required:
2240 - key
2241 - operator
2242 type: object
2243 type: array
2244 x-kubernetes-list-type: atomic
2245 type: object
2246 x-kubernetes-map-type: atomic
2247 weight:
2248 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
2249 format: int32
2250 type: integer
2251 required:
2252 - preference
2253 - weight
2254 type: object
2255 type: array
2256 x-kubernetes-list-type: atomic
2257 requiredDuringSchedulingIgnoredDuringExecution:
2258 description: |-
2259 If the affinity requirements specified by this field are not met at
2260 scheduling time, the pod will not be scheduled onto the node.
2261 If the affinity requirements specified by this field cease to be met
2262 at some point during pod execution (e.g. due to an update), the system
2263 may or may not try to eventually evict the pod from its node.
2264 properties:
2265 nodeSelectorTerms:
2266 description: Required. A list of node selector terms. The terms are ORed.
2267 items:
2268 description: |-
2269 A null or empty node selector term matches no objects. The requirements of
2270 them are ANDed.
2271 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
2272 properties:
2273 matchExpressions:
2274 description: A list of node selector requirements by node's labels.
2275 items:
2276 description: |-
2277 A node selector requirement is a selector that contains values, a key, and an operator
2278 that relates the key and values.
2279 properties:
2280 key:
2281 description: The label key that the selector applies to.
2282 type: string
2283 operator:
2284 description: |-
2285 Represents a key's relationship to a set of values.
2286 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2287 type: string
2288 values:
2289 description: |-
2290 An array of string values. If the operator is In or NotIn,
2291 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2292 the values array must be empty. If the operator is Gt or Lt, the values
2293 array must have a single element, which will be interpreted as an integer.
2294 This array is replaced during a strategic merge patch.
2295 items:
2296 type: string
2297 type: array
2298 x-kubernetes-list-type: atomic
2299 required:
2300 - key
2301 - operator
2302 type: object
2303 type: array
2304 x-kubernetes-list-type: atomic
2305 matchFields:
2306 description: A list of node selector requirements by node's fields.
2307 items:
2308 description: |-
2309 A node selector requirement is a selector that contains values, a key, and an operator
2310 that relates the key and values.
2311 properties:
2312 key:
2313 description: The label key that the selector applies to.
2314 type: string
2315 operator:
2316 description: |-
2317 Represents a key's relationship to a set of values.
2318 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2319 type: string
2320 values:
2321 description: |-
2322 An array of string values. If the operator is In or NotIn,
2323 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2324 the values array must be empty. If the operator is Gt or Lt, the values
2325 array must have a single element, which will be interpreted as an integer.
2326 This array is replaced during a strategic merge patch.
2327 items:
2328 type: string
2329 type: array
2330 x-kubernetes-list-type: atomic
2331 required:
2332 - key
2333 - operator
2334 type: object
2335 type: array
2336 x-kubernetes-list-type: atomic
2337 type: object
2338 x-kubernetes-map-type: atomic
2339 type: array
2340 x-kubernetes-list-type: atomic
2341 required:
2342 - nodeSelectorTerms
2343 type: object
2344 x-kubernetes-map-type: atomic
2345 type: object
2346 podAffinity:
2347 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
2348 properties:
2349 preferredDuringSchedulingIgnoredDuringExecution:
2350 description: |-
2351 The scheduler will prefer to schedule pods to nodes that satisfy
2352 the affinity expressions specified by this field, but it may choose
2353 a node that violates one or more of the expressions. The node that is
2354 most preferred is the one with the greatest sum of weights, i.e.
2355 for each node that meets all of the scheduling requirements (resource
2356 request, requiredDuringScheduling affinity expressions, etc.),
2357 compute a sum by iterating through the elements of this field and adding
2358 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
2359 node(s) with the highest sum are the most preferred.
2360 items:
2361 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2362 properties:
2363 podAffinityTerm:
2364 description: Required. A pod affinity term, associated with the corresponding weight.
2365 properties:
2366 labelSelector:
2367 description: |-
2368 A label query over a set of resources, in this case pods.
2369 If it's null, this PodAffinityTerm matches with no Pods.
2370 properties:
2371 matchExpressions:
2372 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2373 items:
2374 description: |-
2375 A label selector requirement is a selector that contains values, a key, and an operator that
2376 relates the key and values.
2377 properties:
2378 key:
2379 description: key is the label key that the selector applies to.
2380 type: string
2381 operator:
2382 description: |-
2383 operator represents a key's relationship to a set of values.
2384 Valid operators are In, NotIn, Exists and DoesNotExist.
2385 type: string
2386 values:
2387 description: |-
2388 values is an array of string values. If the operator is In or NotIn,
2389 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2390 the values array must be empty. This array is replaced during a strategic
2391 merge patch.
2392 items:
2393 type: string
2394 type: array
2395 x-kubernetes-list-type: atomic
2396 required:
2397 - key
2398 - operator
2399 type: object
2400 type: array
2401 x-kubernetes-list-type: atomic
2402 matchLabels:
2403 additionalProperties:
2404 type: string
2405 description: |-
2406 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2407 map is equivalent to an element of matchExpressions, whose key field is "key", the
2408 operator is "In", and the values array contains only "value". The requirements are ANDed.
2409 type: object
2410 type: object
2411 x-kubernetes-map-type: atomic
2412 matchLabelKeys:
2413 description: |-
2414 MatchLabelKeys is a set of pod label keys to select which pods will
2415 be taken into consideration. The keys are used to lookup values from the
2416 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2417 to select the group of existing pods which pods will be taken into consideration
2418 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2419 pod labels will be ignored. The default value is empty.
2420 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2421 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2422 items:
2423 type: string
2424 type: array
2425 x-kubernetes-list-type: atomic
2426 mismatchLabelKeys:
2427 description: |-
2428 MismatchLabelKeys is a set of pod label keys to select which pods will
2429 be taken into consideration. The keys are used to lookup values from the
2430 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2431 to select the group of existing pods which pods will be taken into consideration
2432 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2433 pod labels will be ignored. The default value is empty.
2434 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2435 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2436 items:
2437 type: string
2438 type: array
2439 x-kubernetes-list-type: atomic
2440 namespaceSelector:
2441 description: |-
2442 A label query over the set of namespaces that the term applies to.
2443 The term is applied to the union of the namespaces selected by this field
2444 and the ones listed in the namespaces field.
2445 null selector and null or empty namespaces list means "this pod's namespace".
2446 An empty selector ({}) matches all namespaces.
2447 properties:
2448 matchExpressions:
2449 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2450 items:
2451 description: |-
2452 A label selector requirement is a selector that contains values, a key, and an operator that
2453 relates the key and values.
2454 properties:
2455 key:
2456 description: key is the label key that the selector applies to.
2457 type: string
2458 operator:
2459 description: |-
2460 operator represents a key's relationship to a set of values.
2461 Valid operators are In, NotIn, Exists and DoesNotExist.
2462 type: string
2463 values:
2464 description: |-
2465 values is an array of string values. If the operator is In or NotIn,
2466 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2467 the values array must be empty. This array is replaced during a strategic
2468 merge patch.
2469 items:
2470 type: string
2471 type: array
2472 x-kubernetes-list-type: atomic
2473 required:
2474 - key
2475 - operator
2476 type: object
2477 type: array
2478 x-kubernetes-list-type: atomic
2479 matchLabels:
2480 additionalProperties:
2481 type: string
2482 description: |-
2483 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2484 map is equivalent to an element of matchExpressions, whose key field is "key", the
2485 operator is "In", and the values array contains only "value". The requirements are ANDed.
2486 type: object
2487 type: object
2488 x-kubernetes-map-type: atomic
2489 namespaces:
2490 description: |-
2491 namespaces specifies a static list of namespace names that the term applies to.
2492 The term is applied to the union of the namespaces listed in this field
2493 and the ones selected by namespaceSelector.
2494 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2495 items:
2496 type: string
2497 type: array
2498 x-kubernetes-list-type: atomic
2499 topologyKey:
2500 description: |-
2501 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2502 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2503 whose value of the label with key topologyKey matches that of any node on which any of the
2504 selected pods is running.
2505 Empty topologyKey is not allowed.
2506 type: string
2507 required:
2508 - topologyKey
2509 type: object
2510 weight:
2511 description: |-
2512 weight associated with matching the corresponding podAffinityTerm,
2513 in the range 1-100.
2514 format: int32
2515 type: integer
2516 required:
2517 - podAffinityTerm
2518 - weight
2519 type: object
2520 type: array
2521 x-kubernetes-list-type: atomic
2522 requiredDuringSchedulingIgnoredDuringExecution:
2523 description: |-
2524 If the affinity requirements specified by this field are not met at
2525 scheduling time, the pod will not be scheduled onto the node.
2526 If the affinity requirements specified by this field cease to be met
2527 at some point during pod execution (e.g. due to a pod label update), the
2528 system may or may not try to eventually evict the pod from its node.
2529 When there are multiple elements, the lists of nodes corresponding to each
2530 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2531 items:
2532 description: |-
2533 Defines a set of pods (namely those matching the labelSelector
2534 relative to the given namespace(s)) that this pod should be
2535 co-located (affinity) or not co-located (anti-affinity) with,
2536 where co-located is defined as running on a node whose value of
2537 the label with key <topologyKey> matches that of any node on which
2538 a pod of the set of pods is running
2539 properties:
2540 labelSelector:
2541 description: |-
2542 A label query over a set of resources, in this case pods.
2543 If it's null, this PodAffinityTerm matches with no Pods.
2544 properties:
2545 matchExpressions:
2546 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2547 items:
2548 description: |-
2549 A label selector requirement is a selector that contains values, a key, and an operator that
2550 relates the key and values.
2551 properties:
2552 key:
2553 description: key is the label key that the selector applies to.
2554 type: string
2555 operator:
2556 description: |-
2557 operator represents a key's relationship to a set of values.
2558 Valid operators are In, NotIn, Exists and DoesNotExist.
2559 type: string
2560 values:
2561 description: |-
2562 values is an array of string values. If the operator is In or NotIn,
2563 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2564 the values array must be empty. This array is replaced during a strategic
2565 merge patch.
2566 items:
2567 type: string
2568 type: array
2569 x-kubernetes-list-type: atomic
2570 required:
2571 - key
2572 - operator
2573 type: object
2574 type: array
2575 x-kubernetes-list-type: atomic
2576 matchLabels:
2577 additionalProperties:
2578 type: string
2579 description: |-
2580 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2581 map is equivalent to an element of matchExpressions, whose key field is "key", the
2582 operator is "In", and the values array contains only "value". The requirements are ANDed.
2583 type: object
2584 type: object
2585 x-kubernetes-map-type: atomic
2586 matchLabelKeys:
2587 description: |-
2588 MatchLabelKeys is a set of pod label keys to select which pods will
2589 be taken into consideration. The keys are used to lookup values from the
2590 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2591 to select the group of existing pods which pods will be taken into consideration
2592 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2593 pod labels will be ignored. The default value is empty.
2594 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2595 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2596 items:
2597 type: string
2598 type: array
2599 x-kubernetes-list-type: atomic
2600 mismatchLabelKeys:
2601 description: |-
2602 MismatchLabelKeys is a set of pod label keys to select which pods will
2603 be taken into consideration. The keys are used to lookup values from the
2604 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2605 to select the group of existing pods which pods will be taken into consideration
2606 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2607 pod labels will be ignored. The default value is empty.
2608 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2609 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2610 items:
2611 type: string
2612 type: array
2613 x-kubernetes-list-type: atomic
2614 namespaceSelector:
2615 description: |-
2616 A label query over the set of namespaces that the term applies to.
2617 The term is applied to the union of the namespaces selected by this field
2618 and the ones listed in the namespaces field.
2619 null selector and null or empty namespaces list means "this pod's namespace".
2620 An empty selector ({}) matches all namespaces.
2621 properties:
2622 matchExpressions:
2623 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2624 items:
2625 description: |-
2626 A label selector requirement is a selector that contains values, a key, and an operator that
2627 relates the key and values.
2628 properties:
2629 key:
2630 description: key is the label key that the selector applies to.
2631 type: string
2632 operator:
2633 description: |-
2634 operator represents a key's relationship to a set of values.
2635 Valid operators are In, NotIn, Exists and DoesNotExist.
2636 type: string
2637 values:
2638 description: |-
2639 values is an array of string values. If the operator is In or NotIn,
2640 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2641 the values array must be empty. This array is replaced during a strategic
2642 merge patch.
2643 items:
2644 type: string
2645 type: array
2646 x-kubernetes-list-type: atomic
2647 required:
2648 - key
2649 - operator
2650 type: object
2651 type: array
2652 x-kubernetes-list-type: atomic
2653 matchLabels:
2654 additionalProperties:
2655 type: string
2656 description: |-
2657 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2658 map is equivalent to an element of matchExpressions, whose key field is "key", the
2659 operator is "In", and the values array contains only "value". The requirements are ANDed.
2660 type: object
2661 type: object
2662 x-kubernetes-map-type: atomic
2663 namespaces:
2664 description: |-
2665 namespaces specifies a static list of namespace names that the term applies to.
2666 The term is applied to the union of the namespaces listed in this field
2667 and the ones selected by namespaceSelector.
2668 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2669 items:
2670 type: string
2671 type: array
2672 x-kubernetes-list-type: atomic
2673 topologyKey:
2674 description: |-
2675 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2676 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2677 whose value of the label with key topologyKey matches that of any node on which any of the
2678 selected pods is running.
2679 Empty topologyKey is not allowed.
2680 type: string
2681 required:
2682 - topologyKey
2683 type: object
2684 type: array
2685 x-kubernetes-list-type: atomic
2686 type: object
2687 podAntiAffinity:
2688 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
2689 properties:
2690 preferredDuringSchedulingIgnoredDuringExecution:
2691 description: |-
2692 The scheduler will prefer to schedule pods to nodes that satisfy
2693 the anti-affinity expressions specified by this field, but it may choose
2694 a node that violates one or more of the expressions. The node that is
2695 most preferred is the one with the greatest sum of weights, i.e.
2696 for each node that meets all of the scheduling requirements (resource
2697 request, requiredDuringScheduling anti-affinity expressions, etc.),
2698 compute a sum by iterating through the elements of this field and subtracting
2699 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
2700 node(s) with the highest sum are the most preferred.
2701 items:
2702 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2703 properties:
2704 podAffinityTerm:
2705 description: Required. A pod affinity term, associated with the corresponding weight.
2706 properties:
2707 labelSelector:
2708 description: |-
2709 A label query over a set of resources, in this case pods.
2710 If it's null, this PodAffinityTerm matches with no Pods.
2711 properties:
2712 matchExpressions:
2713 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2714 items:
2715 description: |-
2716 A label selector requirement is a selector that contains values, a key, and an operator that
2717 relates the key and values.
2718 properties:
2719 key:
2720 description: key is the label key that the selector applies to.
2721 type: string
2722 operator:
2723 description: |-
2724 operator represents a key's relationship to a set of values.
2725 Valid operators are In, NotIn, Exists and DoesNotExist.
2726 type: string
2727 values:
2728 description: |-
2729 values is an array of string values. If the operator is In or NotIn,
2730 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2731 the values array must be empty. This array is replaced during a strategic
2732 merge patch.
2733 items:
2734 type: string
2735 type: array
2736 x-kubernetes-list-type: atomic
2737 required:
2738 - key
2739 - operator
2740 type: object
2741 type: array
2742 x-kubernetes-list-type: atomic
2743 matchLabels:
2744 additionalProperties:
2745 type: string
2746 description: |-
2747 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2748 map is equivalent to an element of matchExpressions, whose key field is "key", the
2749 operator is "In", and the values array contains only "value". The requirements are ANDed.
2750 type: object
2751 type: object
2752 x-kubernetes-map-type: atomic
2753 matchLabelKeys:
2754 description: |-
2755 MatchLabelKeys is a set of pod label keys to select which pods will
2756 be taken into consideration. The keys are used to lookup values from the
2757 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2758 to select the group of existing pods which pods will be taken into consideration
2759 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2760 pod labels will be ignored. The default value is empty.
2761 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2762 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2763 items:
2764 type: string
2765 type: array
2766 x-kubernetes-list-type: atomic
2767 mismatchLabelKeys:
2768 description: |-
2769 MismatchLabelKeys is a set of pod label keys to select which pods will
2770 be taken into consideration. The keys are used to lookup values from the
2771 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2772 to select the group of existing pods which pods will be taken into consideration
2773 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2774 pod labels will be ignored. The default value is empty.
2775 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2776 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2777 items:
2778 type: string
2779 type: array
2780 x-kubernetes-list-type: atomic
2781 namespaceSelector:
2782 description: |-
2783 A label query over the set of namespaces that the term applies to.
2784 The term is applied to the union of the namespaces selected by this field
2785 and the ones listed in the namespaces field.
2786 null selector and null or empty namespaces list means "this pod's namespace".
2787 An empty selector ({}) matches all namespaces.
2788 properties:
2789 matchExpressions:
2790 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2791 items:
2792 description: |-
2793 A label selector requirement is a selector that contains values, a key, and an operator that
2794 relates the key and values.
2795 properties:
2796 key:
2797 description: key is the label key that the selector applies to.
2798 type: string
2799 operator:
2800 description: |-
2801 operator represents a key's relationship to a set of values.
2802 Valid operators are In, NotIn, Exists and DoesNotExist.
2803 type: string
2804 values:
2805 description: |-
2806 values is an array of string values. If the operator is In or NotIn,
2807 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2808 the values array must be empty. This array is replaced during a strategic
2809 merge patch.
2810 items:
2811 type: string
2812 type: array
2813 x-kubernetes-list-type: atomic
2814 required:
2815 - key
2816 - operator
2817 type: object
2818 type: array
2819 x-kubernetes-list-type: atomic
2820 matchLabels:
2821 additionalProperties:
2822 type: string
2823 description: |-
2824 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2825 map is equivalent to an element of matchExpressions, whose key field is "key", the
2826 operator is "In", and the values array contains only "value". The requirements are ANDed.
2827 type: object
2828 type: object
2829 x-kubernetes-map-type: atomic
2830 namespaces:
2831 description: |-
2832 namespaces specifies a static list of namespace names that the term applies to.
2833 The term is applied to the union of the namespaces listed in this field
2834 and the ones selected by namespaceSelector.
2835 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2836 items:
2837 type: string
2838 type: array
2839 x-kubernetes-list-type: atomic
2840 topologyKey:
2841 description: |-
2842 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2843 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2844 whose value of the label with key topologyKey matches that of any node on which any of the
2845 selected pods is running.
2846 Empty topologyKey is not allowed.
2847 type: string
2848 required:
2849 - topologyKey
2850 type: object
2851 weight:
2852 description: |-
2853 weight associated with matching the corresponding podAffinityTerm,
2854 in the range 1-100.
2855 format: int32
2856 type: integer
2857 required:
2858 - podAffinityTerm
2859 - weight
2860 type: object
2861 type: array
2862 x-kubernetes-list-type: atomic
2863 requiredDuringSchedulingIgnoredDuringExecution:
2864 description: |-
2865 If the anti-affinity requirements specified by this field are not met at
2866 scheduling time, the pod will not be scheduled onto the node.
2867 If the anti-affinity requirements specified by this field cease to be met
2868 at some point during pod execution (e.g. due to a pod label update), the
2869 system may or may not try to eventually evict the pod from its node.
2870 When there are multiple elements, the lists of nodes corresponding to each
2871 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2872 items:
2873 description: |-
2874 Defines a set of pods (namely those matching the labelSelector
2875 relative to the given namespace(s)) that this pod should be
2876 co-located (affinity) or not co-located (anti-affinity) with,
2877 where co-located is defined as running on a node whose value of
2878 the label with key <topologyKey> matches that of any node on which
2879 a pod of the set of pods is running
2880 properties:
2881 labelSelector:
2882 description: |-
2883 A label query over a set of resources, in this case pods.
2884 If it's null, this PodAffinityTerm matches with no Pods.
2885 properties:
2886 matchExpressions:
2887 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2888 items:
2889 description: |-
2890 A label selector requirement is a selector that contains values, a key, and an operator that
2891 relates the key and values.
2892 properties:
2893 key:
2894 description: key is the label key that the selector applies to.
2895 type: string
2896 operator:
2897 description: |-
2898 operator represents a key's relationship to a set of values.
2899 Valid operators are In, NotIn, Exists and DoesNotExist.
2900 type: string
2901 values:
2902 description: |-
2903 values is an array of string values. If the operator is In or NotIn,
2904 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2905 the values array must be empty. This array is replaced during a strategic
2906 merge patch.
2907 items:
2908 type: string
2909 type: array
2910 x-kubernetes-list-type: atomic
2911 required:
2912 - key
2913 - operator
2914 type: object
2915 type: array
2916 x-kubernetes-list-type: atomic
2917 matchLabels:
2918 additionalProperties:
2919 type: string
2920 description: |-
2921 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2922 map is equivalent to an element of matchExpressions, whose key field is "key", the
2923 operator is "In", and the values array contains only "value". The requirements are ANDed.
2924 type: object
2925 type: object
2926 x-kubernetes-map-type: atomic
2927 matchLabelKeys:
2928 description: |-
2929 MatchLabelKeys is a set of pod label keys to select which pods will
2930 be taken into consideration. The keys are used to lookup values from the
2931 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2932 to select the group of existing pods which pods will be taken into consideration
2933 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2934 pod labels will be ignored. The default value is empty.
2935 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2936 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2937 items:
2938 type: string
2939 type: array
2940 x-kubernetes-list-type: atomic
2941 mismatchLabelKeys:
2942 description: |-
2943 MismatchLabelKeys is a set of pod label keys to select which pods will
2944 be taken into consideration. The keys are used to lookup values from the
2945 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2946 to select the group of existing pods which pods will be taken into consideration
2947 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2948 pod labels will be ignored. The default value is empty.
2949 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2950 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2951 items:
2952 type: string
2953 type: array
2954 x-kubernetes-list-type: atomic
2955 namespaceSelector:
2956 description: |-
2957 A label query over the set of namespaces that the term applies to.
2958 The term is applied to the union of the namespaces selected by this field
2959 and the ones listed in the namespaces field.
2960 null selector and null or empty namespaces list means "this pod's namespace".
2961 An empty selector ({}) matches all namespaces.
2962 properties:
2963 matchExpressions:
2964 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2965 items:
2966 description: |-
2967 A label selector requirement is a selector that contains values, a key, and an operator that
2968 relates the key and values.
2969 properties:
2970 key:
2971 description: key is the label key that the selector applies to.
2972 type: string
2973 operator:
2974 description: |-
2975 operator represents a key's relationship to a set of values.
2976 Valid operators are In, NotIn, Exists and DoesNotExist.
2977 type: string
2978 values:
2979 description: |-
2980 values is an array of string values. If the operator is In or NotIn,
2981 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2982 the values array must be empty. This array is replaced during a strategic
2983 merge patch.
2984 items:
2985 type: string
2986 type: array
2987 x-kubernetes-list-type: atomic
2988 required:
2989 - key
2990 - operator
2991 type: object
2992 type: array
2993 x-kubernetes-list-type: atomic
2994 matchLabels:
2995 additionalProperties:
2996 type: string
2997 description: |-
2998 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2999 map is equivalent to an element of matchExpressions, whose key field is "key", the
3000 operator is "In", and the values array contains only "value". The requirements are ANDed.
3001 type: object
3002 type: object
3003 x-kubernetes-map-type: atomic
3004 namespaces:
3005 description: |-
3006 namespaces specifies a static list of namespace names that the term applies to.
3007 The term is applied to the union of the namespaces listed in this field
3008 and the ones selected by namespaceSelector.
3009 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
3010 items:
3011 type: string
3012 type: array
3013 x-kubernetes-list-type: atomic
3014 topologyKey:
3015 description: |-
3016 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
3017 the labelSelector in the specified namespaces, where co-located is defined as running on a node
3018 whose value of the label with key topologyKey matches that of any node on which any of the
3019 selected pods is running.
3020 Empty topologyKey is not allowed.
3021 type: string
3022 required:
3023 - topologyKey
3024 type: object
3025 type: array
3026 x-kubernetes-list-type: atomic
3027 type: object
3028 type: object
3029 imagePullSecrets:
3030 description: If specified, the pod's imagePullSecrets
3031 items:
3032 description: |-
3033 LocalObjectReference contains enough information to let you locate the
3034 referenced object inside the same namespace.
3035 properties:
3036 name:
3037 default: ""
3038 description: |-
3039 Name of the referent.
3040 This field is effectively required, but due to backwards compatibility is
3041 allowed to be empty. Instances of this type with an empty value here are
3042 almost certainly wrong.
3043 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3044 type: string
3045 type: object
3046 x-kubernetes-map-type: atomic
3047 type: array
3048 x-kubernetes-list-map-keys:
3049 - name
3050 x-kubernetes-list-type: map
3051 nodeSelector:
3052 additionalProperties:
3053 type: string
3054 description: |-
3055 NodeSelector is a selector which must be true for the pod to fit on a node.
3056 Selector which must match a node's labels for the pod to be scheduled on that node.
3057 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
3058 type: object
3059 priorityClassName:
3060 description: If specified, the pod's priorityClassName.
3061 type: string
3062 resources:
3063 description: |-
3064 If specified, the pod's resource requirements.
3065 These values override the global resource configuration flags.
3066 Note that when only specifying resource limits, ensure they are greater than or equal
3067 to the corresponding global resource requests configured via controller flags
3068 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
3069 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
3070 properties:
3071 limits:
3072 additionalProperties:
3073 anyOf:
3074 - type: integer
3075 - type: string
3076 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3077 x-kubernetes-int-or-string: true
3078 description: |-
3079 Limits describes the maximum amount of compute resources allowed.
3080 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3081 type: object
3082 requests:
3083 additionalProperties:
3084 anyOf:
3085 - type: integer
3086 - type: string
3087 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3088 x-kubernetes-int-or-string: true
3089 description: |-
3090 Requests describes the minimum amount of compute resources required.
3091 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
3092 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
3093 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3094 type: object
3095 type: object
3096 securityContext:
3097 description: If specified, the pod's security context
3098 properties:
3099 fsGroup:
3100 description: |-
3101 A special supplemental group that applies to all containers in a pod.
3102 Some volume types allow the Kubelet to change the ownership of that volume
3103 to be owned by the pod:
3104
3105 1. The owning GID will be the FSGroup
3106 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3107 3. The permission bits are OR'd with rw-rw----
3108
3109 If unset, the Kubelet will not modify the ownership and permissions of any volume.
3110 Note that this field cannot be set when spec.os.name is windows.
3111 format: int64
3112 type: integer
3113 fsGroupChangePolicy:
3114 description: |-
3115 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
3116 before being exposed inside Pod. This field will only apply to
3117 volume types which support fsGroup based ownership(and permissions).
3118 It will have no effect on ephemeral volume types such as: secret, configmaps
3119 and emptydir.
3120 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
3121 Note that this field cannot be set when spec.os.name is windows.
3122 type: string
3123 runAsGroup:
3124 description: |-
3125 The GID to run the entrypoint of the container process.
3126 Uses runtime default if unset.
3127 May also be set in SecurityContext. If set in both SecurityContext and
3128 PodSecurityContext, the value specified in SecurityContext takes precedence
3129 for that container.
3130 Note that this field cannot be set when spec.os.name is windows.
3131 format: int64
3132 type: integer
3133 runAsNonRoot:
3134 description: |-
3135 Indicates that the container must run as a non-root user.
3136 If true, the Kubelet will validate the image at runtime to ensure that it
3137 does not run as UID 0 (root) and fail to start the container if it does.
3138 If unset or false, no such validation will be performed.
3139 May also be set in SecurityContext. If set in both SecurityContext and
3140 PodSecurityContext, the value specified in SecurityContext takes precedence.
3141 type: boolean
3142 runAsUser:
3143 description: |-
3144 The UID to run the entrypoint of the container process.
3145 Defaults to user specified in image metadata if unspecified.
3146 May also be set in SecurityContext. If set in both SecurityContext and
3147 PodSecurityContext, the value specified in SecurityContext takes precedence
3148 for that container.
3149 Note that this field cannot be set when spec.os.name is windows.
3150 format: int64
3151 type: integer
3152 seLinuxOptions:
3153 description: |-
3154 The SELinux context to be applied to all containers.
3155 If unspecified, the container runtime will allocate a random SELinux context for each
3156 container. May also be set in SecurityContext. If set in
3157 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
3158 takes precedence for that container.
3159 Note that this field cannot be set when spec.os.name is windows.
3160 properties:
3161 level:
3162 description: Level is SELinux level label that applies to the container.
3163 type: string
3164 role:
3165 description: Role is a SELinux role label that applies to the container.
3166 type: string
3167 type:
3168 description: Type is a SELinux type label that applies to the container.
3169 type: string
3170 user:
3171 description: User is a SELinux user label that applies to the container.
3172 type: string
3173 type: object
3174 seccompProfile:
3175 description: |-
3176 The seccomp options to use by the containers in this pod.
3177 Note that this field cannot be set when spec.os.name is windows.
3178 properties:
3179 localhostProfile:
3180 description: |-
3181 localhostProfile indicates a profile defined in a file on the node should be used.
3182 The profile must be preconfigured on the node to work.
3183 Must be a descending path, relative to the kubelet's configured seccomp profile location.
3184 Must be set if type is "Localhost". Must NOT be set for any other type.
3185 type: string
3186 type:
3187 description: |-
3188 type indicates which kind of seccomp profile will be applied.
3189 Valid options are:
3190
3191 Localhost - a profile defined in a file on the node should be used.
3192 RuntimeDefault - the container runtime default profile should be used.
3193 Unconfined - no profile should be applied.
3194 type: string
3195 required:
3196 - type
3197 type: object
3198 supplementalGroups:
3199 description: |-
3200 A list of groups applied to the first process run in each container, in addition
3201 to the container's primary GID, the fsGroup (if specified), and group memberships
3202 defined in the container image for the uid of the container process. If unspecified,
3203 no additional groups are added to any container. Note that group memberships
3204 defined in the container image for the uid of the container process are still effective,
3205 even if they are not included in this list.
3206 Note that this field cannot be set when spec.os.name is windows.
3207 items:
3208 format: int64
3209 type: integer
3210 type: array
3211 x-kubernetes-list-type: atomic
3212 sysctls:
3213 description: |-
3214 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
3215 sysctls (by the container runtime) might fail to launch.
3216 Note that this field cannot be set when spec.os.name is windows.
3217 items:
3218 description: Sysctl defines a kernel parameter to be set
3219 properties:
3220 name:
3221 description: Name of a property to set
3222 type: string
3223 value:
3224 description: Value of a property to set
3225 type: string
3226 required:
3227 - name
3228 - value
3229 type: object
3230 type: array
3231 x-kubernetes-list-type: atomic
3232 type: object
3233 serviceAccountName:
3234 description: If specified, the pod's service account
3235 type: string
3236 tolerations:
3237 description: If specified, the pod's tolerations.
3238 items:
3239 description: |-
3240 The pod this Toleration is attached to tolerates any taint that matches
3241 the triple <key,value,effect> using the matching operator <operator>.
3242 properties:
3243 effect:
3244 description: |-
3245 Effect indicates the taint effect to match. Empty means match all taint effects.
3246 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
3247 type: string
3248 key:
3249 description: |-
3250 Key is the taint key that the toleration applies to. Empty means match all taint keys.
3251 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
3252 type: string
3253 operator:
3254 description: |-
3255 Operator represents a key's relationship to the value.
3256 Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
3257 Exists is equivalent to wildcard for value, so that a pod can
3258 tolerate all taints of a particular category.
3259 Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
3260 type: string
3261 tolerationSeconds:
3262 description: |-
3263 TolerationSeconds represents the period of time the toleration (which must be
3264 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
3265 it is not set, which means tolerate the taint forever (do not evict). Zero and
3266 negative values will be treated as 0 (evict immediately) by the system.
3267 format: int64
3268 type: integer
3269 value:
3270 description: |-
3271 Value is the taint value the toleration matches to.
3272 If the operator is Exists, the value should be empty, otherwise just a regular string.
3273 type: string
3274 type: object
3275 type: array
3276 x-kubernetes-list-type: atomic
3277 type: object
3278 type: object
3279 serviceType:
3280 description: |-
3281 Optional service type for Kubernetes solver service. Supported values
3282 are NodePort or ClusterIP. If unset, defaults to NodePort.
3283 type: string
3284 type: object
3285 type: object
3286 selector:
3287 description: |-
3288 Selector selects a set of DNSNames on the Certificate resource that
3289 should be solved using this challenge solver.
3290 If not specified, the solver will be treated as the 'default' solver
3291 with the lowest priority, i.e. if any other solver has a more specific
3292 match, it will be used instead.
3293 properties:
3294 dnsNames:
3295 description: |-
3296 List of DNSNames that this solver will be used to solve.
3297 If specified and a match is found, a dnsNames selector will take
3298 precedence over a dnsZones selector.
3299 If multiple solvers match with the same dnsNames value, the solver
3300 with the most matching labels in matchLabels will be selected.
3301 If neither has more matches, the solver defined earlier in the list
3302 will be selected.
3303 items:
3304 type: string
3305 type: array
3306 x-kubernetes-list-type: atomic
3307 dnsZones:
3308 description: |-
3309 List of DNSZones that this solver will be used to solve.
3310 The most specific DNS zone match specified here will take precedence
3311 over other DNS zone matches, so a solver specifying sys.example.com
3312 will be selected over one specifying example.com for the domain
3313 www.sys.example.com.
3314 If multiple solvers match with the same dnsZones value, the solver
3315 with the most matching labels in matchLabels will be selected.
3316 If neither has more matches, the solver defined earlier in the list
3317 will be selected.
3318 items:
3319 type: string
3320 type: array
3321 x-kubernetes-list-type: atomic
3322 matchLabels:
3323 additionalProperties:
3324 type: string
3325 description: |-
3326 A label selector that is used to refine the set of certificate's that
3327 this challenge solver will apply to.
3328 type: object
3329 type: object
3330 type: object
3331 type: array
3332 x-kubernetes-list-type: atomic
3333 required:
3334 - privateKeySecretRef
3335 - server
3336 type: object
3337 ca:
3338 description: |-
3339 CA configures this issuer to sign certificates using a signing CA keypair
3340 stored in a Secret resource.
3341 This is used to build internal PKIs that are managed by cert-manager.
3342 properties:
3343 crlDistributionPoints:
3344 description: |-
3345 The CRL distribution points is an X.509 v3 certificate extension which identifies
3346 the location of the CRL from which the revocation of this certificate can be checked.
3347 If not set, certificates will be issued without distribution points set.
3348 items:
3349 type: string
3350 type: array
3351 x-kubernetes-list-type: atomic
3352 issuingCertificateURLs:
3353 description: |-
3354 IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
3355 it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
3356 As an example, such a URL might be "http://ca.domain.com/ca.crt".
3357 items:
3358 type: string
3359 type: array
3360 x-kubernetes-list-type: atomic
3361 ocspServers:
3362 description: |-
3363 The OCSP server list is an X.509 v3 extension that defines a list of
3364 URLs of OCSP responders. The OCSP responders can be queried for the
3365 revocation status of an issued certificate. If not set, the
3366 certificate will be issued with no OCSP servers set. For example, an
3367 OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
3368 items:
3369 type: string
3370 type: array
3371 x-kubernetes-list-type: atomic
3372 secretName:
3373 description: |-
3374 SecretName is the name of the secret used to sign Certificates issued
3375 by this Issuer.
3376 type: string
3377 required:
3378 - secretName
3379 type: object
3380 selfSigned:
3381 description: |-
3382 SelfSigned configures this issuer to 'self sign' certificates using the
3383 private key used to create the CertificateRequest object.
3384 properties:
3385 crlDistributionPoints:
3386 description: |-
3387 The CRL distribution points is an X.509 v3 certificate extension which identifies
3388 the location of the CRL from which the revocation of this certificate can be checked.
3389 If not set certificate will be issued without CDP. Values are strings.
3390 items:
3391 type: string
3392 type: array
3393 x-kubernetes-list-type: atomic
3394 type: object
3395 vault:
3396 description: |-
3397 Vault configures this issuer to sign certificates using a HashiCorp Vault
3398 PKI backend.
3399 properties:
3400 auth:
3401 description: Auth configures how cert-manager authenticates with the Vault server.
3402 properties:
3403 appRole:
3404 description: |-
3405 AppRole authenticates with Vault using the App Role auth mechanism,
3406 with the role and secret stored in a Kubernetes Secret resource.
3407 properties:
3408 path:
3409 description: |-
3410 Path where the App Role authentication backend is mounted in Vault, e.g:
3411 "approle"
3412 type: string
3413 roleId:
3414 description: |-
3415 RoleID configured in the App Role authentication backend when setting
3416 up the authentication backend in Vault.
3417 type: string
3418 secretRef:
3419 description: |-
3420 Reference to a key in a Secret that contains the App Role secret used
3421 to authenticate with Vault.
3422 The `key` field must be specified and denotes which entry within the Secret
3423 resource is used as the app role secret.
3424 properties:
3425 key:
3426 description: |-
3427 The key of the entry in the Secret resource's `data` field to be used.
3428 Some instances of this field may be defaulted, in others it may be
3429 required.
3430 type: string
3431 name:
3432 description: |-
3433 Name of the resource being referred to.
3434 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3435 type: string
3436 required:
3437 - name
3438 type: object
3439 required:
3440 - path
3441 - roleId
3442 - secretRef
3443 type: object
3444 clientCertificate:
3445 description: |-
3446 ClientCertificate authenticates with Vault by presenting a client
3447 certificate during the request's TLS handshake.
3448 Works only when using HTTPS protocol.
3449 properties:
3450 mountPath:
3451 description: |-
3452 The Vault mountPath here is the mount path to use when authenticating with
3453 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3454 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3455 default value "/v1/auth/cert" will be used.
3456 type: string
3457 name:
3458 description: |-
3459 Name of the certificate role to authenticate against.
3460 If not set, matching any certificate role, if available.
3461 type: string
3462 secretName:
3463 description: |-
3464 Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
3465 tls.crt and tls.key) used to authenticate to Vault using TLS client
3466 authentication.
3467 type: string
3468 type: object
3469 kubernetes:
3470 description: |-
3471 Kubernetes authenticates with Vault by passing the ServiceAccount
3472 token stored in the named Secret resource to the Vault server.
3473 properties:
3474 mountPath:
3475 description: |-
3476 The Vault mountPath here is the mount path to use when authenticating with
3477 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3478 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3479 default value "/v1/auth/kubernetes" will be used.
3480 type: string
3481 role:
3482 description: |-
3483 A required field containing the Vault Role to assume. A Role binds a
3484 Kubernetes ServiceAccount with a set of Vault policies.
3485 type: string
3486 secretRef:
3487 description: |-
3488 The required Secret field containing a Kubernetes ServiceAccount JWT used
3489 for authenticating with Vault. Use of 'ambient credentials' is not
3490 supported.
3491 properties:
3492 key:
3493 description: |-
3494 The key of the entry in the Secret resource's `data` field to be used.
3495 Some instances of this field may be defaulted, in others it may be
3496 required.
3497 type: string
3498 name:
3499 description: |-
3500 Name of the resource being referred to.
3501 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3502 type: string
3503 required:
3504 - name
3505 type: object
3506 serviceAccountRef:
3507 description: |-
3508 A reference to a service account that will be used to request a bound
3509 token (also known as "projected token"). Compared to using "secretRef",
3510 using this field means that you don't rely on statically bound tokens. To
3511 use this field, you must configure an RBAC rule to let cert-manager
3512 request a token.
3513 properties:
3514 audiences:
3515 description: |-
3516 TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
3517 The default audiences are always included in the token.
3518 items:
3519 type: string
3520 type: array
3521 x-kubernetes-list-type: atomic
3522 name:
3523 description: Name of the ServiceAccount used to request a token.
3524 type: string
3525 required:
3526 - name
3527 type: object
3528 required:
3529 - role
3530 type: object
3531 tokenSecretRef:
3532 description: TokenSecretRef authenticates with Vault by presenting a token.
3533 properties:
3534 key:
3535 description: |-
3536 The key of the entry in the Secret resource's `data` field to be used.
3537 Some instances of this field may be defaulted, in others it may be
3538 required.
3539 type: string
3540 name:
3541 description: |-
3542 Name of the resource being referred to.
3543 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3544 type: string
3545 required:
3546 - name
3547 type: object
3548 type: object
3549 caBundle:
3550 description: |-
3551 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3552 chain presented by Vault. Only used if using HTTPS to connect to Vault and
3553 ignored for HTTP connections.
3554 Mutually exclusive with CABundleSecretRef.
3555 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3556 the cert-manager controller container is used to validate the TLS connection.
3557 format: byte
3558 type: string
3559 caBundleSecretRef:
3560 description: |-
3561 Reference to a Secret containing a bundle of PEM-encoded CAs to use when
3562 verifying the certificate chain presented by Vault when using HTTPS.
3563 Mutually exclusive with CABundle.
3564 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3565 the cert-manager controller container is used to validate the TLS connection.
3566 If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
3567 properties:
3568 key:
3569 description: |-
3570 The key of the entry in the Secret resource's `data` field to be used.
3571 Some instances of this field may be defaulted, in others it may be
3572 required.
3573 type: string
3574 name:
3575 description: |-
3576 Name of the resource being referred to.
3577 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3578 type: string
3579 required:
3580 - name
3581 type: object
3582 clientCertSecretRef:
3583 description: |-
3584 Reference to a Secret containing a PEM-encoded Client Certificate to use when the
3585 Vault server requires mTLS.
3586 properties:
3587 key:
3588 description: |-
3589 The key of the entry in the Secret resource's `data` field to be used.
3590 Some instances of this field may be defaulted, in others it may be
3591 required.
3592 type: string
3593 name:
3594 description: |-
3595 Name of the resource being referred to.
3596 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3597 type: string
3598 required:
3599 - name
3600 type: object
3601 clientKeySecretRef:
3602 description: |-
3603 Reference to a Secret containing a PEM-encoded Client Private Key to use when the
3604 Vault server requires mTLS.
3605 properties:
3606 key:
3607 description: |-
3608 The key of the entry in the Secret resource's `data` field to be used.
3609 Some instances of this field may be defaulted, in others it may be
3610 required.
3611 type: string
3612 name:
3613 description: |-
3614 Name of the resource being referred to.
3615 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3616 type: string
3617 required:
3618 - name
3619 type: object
3620 namespace:
3621 description: |-
3622 Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
3623 More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
3624 type: string
3625 path:
3626 description: |-
3627 Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
3628 "my_pki_mount/sign/my-role-name".
3629 type: string
3630 server:
3631 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
3632 type: string
3633 serverName:
3634 description: |-
3635 ServerName is used to verify the hostname on the returned certificates
3636 by the Vault server.
3637 type: string
3638 required:
3639 - auth
3640 - path
3641 - server
3642 type: object
3643 venafi:
3644 description: |-
3645 Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted
3646 or SaaS policy zone.
3647 properties:
3648 cloud:
3649 description: |-
3650 Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
3651 Only one of CyberArk Certificate Manager may be specified.
3652 properties:
3653 apiTokenSecretRef:
3654 description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.
3655 properties:
3656 key:
3657 description: |-
3658 The key of the entry in the Secret resource's `data` field to be used.
3659 Some instances of this field may be defaulted, in others it may be
3660 required.
3661 type: string
3662 name:
3663 description: |-
3664 Name of the resource being referred to.
3665 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3666 type: string
3667 required:
3668 - name
3669 type: object
3670 url:
3671 description: |-
3672 URL is the base URL for CyberArk Certificate Manager SaaS.
3673 Defaults to "https://api.venafi.cloud/".
3674 type: string
3675 required:
3676 - apiTokenSecretRef
3677 type: object
3678 tpp:
3679 description: |-
3680 TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
3681 Only one of CyberArk Certificate Manager may be specified.
3682 properties:
3683 caBundle:
3684 description: |-
3685 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3686 chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.
3687 If undefined, the certificate bundle in the cert-manager controller container
3688 is used to validate the chain.
3689 format: byte
3690 type: string
3691 caBundleSecretRef:
3692 description: |-
3693 Reference to a Secret containing a base64-encoded bundle of PEM CAs
3694 which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.
3695 Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
3696 If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
3697 the cert-manager controller container is used to validate the TLS connection.
3698 properties:
3699 key:
3700 description: |-
3701 The key of the entry in the Secret resource's `data` field to be used.
3702 Some instances of this field may be defaulted, in others it may be
3703 required.
3704 type: string
3705 name:
3706 description: |-
3707 Name of the resource being referred to.
3708 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3709 type: string
3710 required:
3711 - name
3712 type: object
3713 credentialsRef:
3714 description: |-
3715 CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
3716 The secret must contain the key 'access-token' for the Access Token Authentication,
3717 or two keys, 'username' and 'password' for the API Keys Authentication.
3718 properties:
3719 name:
3720 description: |-
3721 Name of the resource being referred to.
3722 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3723 type: string
3724 required:
3725 - name
3726 type: object
3727 url:
3728 description: |-
3729 URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,
3730 for example: "https://tpp.example.com/vedsdk".
3731 type: string
3732 required:
3733 - credentialsRef
3734 - url
3735 type: object
3736 zone:
3737 description: |-
3738 Zone is the Certificate Manager Policy Zone to use for this issuer.
3739 All requests made to the Certificate Manager platform will be restricted by the named
3740 zone policy.
3741 This field is required.
3742 type: string
3743 required:
3744 - zone
3745 type: object
3746 type: object
3747 status:
3748 description: Status of the Issuer. This is set and managed automatically.
3749 properties:
3750 acme:
3751 description: |-
3752 ACME specific status options.
3753 This field should only be set if the Issuer is configured to use an ACME
3754 server to issue certificates.
3755 properties:
3756 lastPrivateKeyHash:
3757 description: |-
3758 LastPrivateKeyHash is a hash of the private key associated with the latest
3759 registered ACME account, in order to track changes made to registered account
3760 associated with the Issuer
3761 type: string
3762 lastRegisteredEmail:
3763 description: |-
3764 LastRegisteredEmail is the email associated with the latest registered
3765 ACME account, in order to track changes made to registered account
3766 associated with the Issuer
3767 type: string
3768 uri:
3769 description: |-
3770 URI is the unique account identifier, which can also be used to retrieve
3771 account details from the CA
3772 type: string
3773 type: object
3774 conditions:
3775 description: |-
3776 List of status conditions to indicate the status of a CertificateRequest.
3777 Known condition types are `Ready`.
3778 items:
3779 description: IssuerCondition contains condition information for an Issuer.
3780 properties:
3781 lastTransitionTime:
3782 description: |-
3783 LastTransitionTime is the timestamp corresponding to the last status
3784 change of this condition.
3785 format: date-time
3786 type: string
3787 message:
3788 description: |-
3789 Message is a human readable description of the details of the last
3790 transition, complementing reason.
3791 type: string
3792 observedGeneration:
3793 description: |-
3794 If set, this represents the .metadata.generation that the condition was
3795 set based upon.
3796 For instance, if .metadata.generation is currently 12, but the
3797 .status.condition[x].observedGeneration is 9, the condition is out of date
3798 with respect to the current state of the Issuer.
3799 format: int64
3800 type: integer
3801 reason:
3802 description: |-
3803 Reason is a brief machine readable explanation for the condition's last
3804 transition.
3805 type: string
3806 status:
3807 description: Status of the condition, one of (`True`, `False`, `Unknown`).
3808 enum:
3809 - "True"
3810 - "False"
3811 - Unknown
3812 type: string
3813 type:
3814 description: Type of the condition, known values are (`Ready`).
3815 type: string
3816 required:
3817 - status
3818 - type
3819 type: object
3820 type: array
3821 x-kubernetes-list-map-keys:
3822 - type
3823 x-kubernetes-list-type: map
3824 type: object
3825 required:
3826 - spec
3827 type: object
3828 served: true
3829 storage: true
3830 subresources:
3831 status: {}
3832{{- end }}