Gitiles
Code Review Sign In
code.v1.dodo.cloud / pcloud / d55d03ac5bfd4bd18a671e2d783183702d2bd64d / . / charts / cert-manager / templates / crd-cert-manager.io_issuers.yaml
blob: c88b318e6eaeff32e1434911c8f3c2336206fdf5 [file] [log] [blame]
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame^]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "issuers.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: Issuer
18 listKind: IssuerList
19 plural: issuers
20 shortNames:
21 - iss
22 singular: issuer
23 scope: Namespaced
24 versions:
25 - additionalPrinterColumns:
26 - jsonPath: .status.conditions[?(@.type == "Ready")].status
27 name: Ready
28 type: string
29 - jsonPath: .status.conditions[?(@.type == "Ready")].message
30 name: Status
31 priority: 1
32 type: string
33 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
34 jsonPath: .metadata.creationTimestamp
35 name: Age
36 type: date
37 name: v1
38 schema:
39 openAPIV3Schema:
40 description: |-
41 An Issuer represents a certificate issuing authority which can be
42 referenced as part of `issuerRef` fields.
43 It is scoped to a single namespace and can therefore only be referenced by
44 resources within the same namespace.
45 properties:
46 apiVersion:
47 description: |-
48 APIVersion defines the versioned schema of this representation of an object.
49 Servers should convert recognized schemas to the latest internal value, and
50 may reject unrecognized values.
51 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
52 type: string
53 kind:
54 description: |-
55 Kind is a string value representing the REST resource this object represents.
56 Servers may infer this from the endpoint the client submits requests to.
57 Cannot be updated.
58 In CamelCase.
59 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
60 type: string
61 metadata:
62 type: object
63 spec:
64 description: Desired state of the Issuer resource.
65 properties:
66 acme:
67 description: |-
68 ACME configures this issuer to communicate with a RFC8555 (ACME) server
69 to obtain signed x509 certificates.
70 properties:
71 caBundle:
72 description: |-
73 Base64-encoded bundle of PEM CAs which can be used to validate the certificate
74 chain presented by the ACME server.
75 Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
76 kinds of security vulnerabilities.
77 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
78 the container is used to validate the TLS connection.
79 format: byte
80 type: string
81 disableAccountKeyGeneration:
82 description: |-
83 Enables or disables generating a new ACME account key.
84 If true, the Issuer resource will *not* request a new account but will expect
85 the account key to be supplied via an existing secret.
86 If false, the cert-manager system will generate a new ACME account key
87 for the Issuer.
88 Defaults to false.
89 type: boolean
90 email:
91 description: |-
92 Email is the email address to be associated with the ACME account.
93 This field is optional, but it is strongly recommended to be set.
94 It will be used to contact you in case of issues with your account or
95 certificates, including expiry notification emails.
96 This field may be updated after the account is initially registered.
97 type: string
98 enableDurationFeature:
99 description: |-
100 Enables requesting a Not After date on certificates that matches the
101 duration of the certificate. This is not supported by all ACME servers
102 like Let's Encrypt. If set to true when the ACME server does not support
103 it, it will create an error on the Order.
104 Defaults to false.
105 type: boolean
106 externalAccountBinding:
107 description: |-
108 ExternalAccountBinding is a reference to a CA external account of the ACME
109 server.
110 If set, upon registration cert-manager will attempt to associate the given
111 external account credentials with the registered ACME account.
112 properties:
113 keyAlgorithm:
114 description: |-
115 Deprecated: keyAlgorithm field exists for historical compatibility
116 reasons and should not be used. The algorithm is now hardcoded to HS256
117 in golang/x/crypto/acme.
118 enum:
119 - HS256
120 - HS384
121 - HS512
122 type: string
123 keyID:
124 description: keyID is the ID of the CA key that the External Account is bound to.
125 type: string
126 keySecretRef:
127 description: |-
128 keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
129 Secret which holds the symmetric MAC key of the External Account Binding.
130 The `key` is the index string that is paired with the key data in the
131 Secret and should not be confused with the key data itself, or indeed with
132 the External Account Binding keyID above.
133 The secret key stored in the Secret **must** be un-padded, base64 URL
134 encoded data.
135 properties:
136 key:
137 description: |-
138 The key of the entry in the Secret resource's `data` field to be used.
139 Some instances of this field may be defaulted, in others it may be
140 required.
141 type: string
142 name:
143 description: |-
144 Name of the resource being referred to.
145 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
146 type: string
147 required:
148 - name
149 type: object
150 required:
151 - keyID
152 - keySecretRef
153 type: object
154 preferredChain:
155 description: |-
156 PreferredChain is the chain to use if the ACME server outputs multiple.
157 PreferredChain is no guarantee that this one gets delivered by the ACME
158 endpoint.
159 For example, for Let's Encrypt's DST cross-sign you would use:
160 "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
161 This value picks the first certificate bundle in the combined set of
162 ACME default and alternative chains that has a root-most certificate with
163 this value as its issuer's commonname.
164 maxLength: 64
165 type: string
166 privateKeySecretRef:
167 description: |-
168 PrivateKey is the name of a Kubernetes Secret resource that will be used to
169 store the automatically generated ACME account private key.
170 Optionally, a `key` may be specified to select a specific entry within
171 the named Secret resource.
172 If `key` is not specified, a default of `tls.key` will be used.
173 properties:
174 key:
175 description: |-
176 The key of the entry in the Secret resource's `data` field to be used.
177 Some instances of this field may be defaulted, in others it may be
178 required.
179 type: string
180 name:
181 description: |-
182 Name of the resource being referred to.
183 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
184 type: string
185 required:
186 - name
187 type: object
188 profile:
189 description: |-
190 Profile allows requesting a certificate profile from the ACME server.
191 Supported profiles are listed by the server's ACME directory URL.
192 type: string
193 server:
194 description: |-
195 Server is the URL used to access the ACME server's 'directory' endpoint.
196 For example, for Let's Encrypt's staging endpoint, you would use:
197 "https://acme-staging-v02.api.letsencrypt.org/directory".
198 Only ACME v2 endpoints (i.e. RFC 8555) are supported.
199 type: string
200 skipTLSVerify:
201 description: |-
202 INSECURE: Enables or disables validation of the ACME server TLS certificate.
203 If true, requests to the ACME server will not have the TLS certificate chain
204 validated.
205 Mutually exclusive with CABundle; prefer using CABundle to prevent various
206 kinds of security vulnerabilities.
207 Only enable this option in development environments.
208 If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
209 the container is used to validate the TLS connection.
210 Defaults to false.
211 type: boolean
212 solvers:
213 description: |-
214 Solvers is a list of challenge solvers that will be used to solve
215 ACME challenges for the matching domains.
216 Solver configurations must be provided in order to obtain certificates
217 from an ACME server.
218 For more information, see: https://cert-manager.io/docs/configuration/acme/
219 items:
220 description: |-
221 An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
222 A selector may be provided to use different solving strategies for different DNS names.
223 Only one of HTTP01 or DNS01 must be provided.
224 properties:
225 dns01:
226 description: |-
227 Configures cert-manager to attempt to complete authorizations by
228 performing the DNS01 challenge flow.
229 properties:
230 acmeDNS:
231 description: |-
232 Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
233 DNS01 challenge records.
234 properties:
235 accountSecretRef:
236 description: |-
237 A reference to a specific 'key' within a Secret resource.
238 In some instances, `key` is a required field.
239 properties:
240 key:
241 description: |-
242 The key of the entry in the Secret resource's `data` field to be used.
243 Some instances of this field may be defaulted, in others it may be
244 required.
245 type: string
246 name:
247 description: |-
248 Name of the resource being referred to.
249 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
250 type: string
251 required:
252 - name
253 type: object
254 host:
255 type: string
256 required:
257 - accountSecretRef
258 - host
259 type: object
260 akamai:
261 description: Use the Akamai DNS zone management API to manage DNS01 challenge records.
262 properties:
263 accessTokenSecretRef:
264 description: |-
265 A reference to a specific 'key' within a Secret resource.
266 In some instances, `key` is a required field.
267 properties:
268 key:
269 description: |-
270 The key of the entry in the Secret resource's `data` field to be used.
271 Some instances of this field may be defaulted, in others it may be
272 required.
273 type: string
274 name:
275 description: |-
276 Name of the resource being referred to.
277 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
278 type: string
279 required:
280 - name
281 type: object
282 clientSecretSecretRef:
283 description: |-
284 A reference to a specific 'key' within a Secret resource.
285 In some instances, `key` is a required field.
286 properties:
287 key:
288 description: |-
289 The key of the entry in the Secret resource's `data` field to be used.
290 Some instances of this field may be defaulted, in others it may be
291 required.
292 type: string
293 name:
294 description: |-
295 Name of the resource being referred to.
296 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
297 type: string
298 required:
299 - name
300 type: object
301 clientTokenSecretRef:
302 description: |-
303 A reference to a specific 'key' within a Secret resource.
304 In some instances, `key` is a required field.
305 properties:
306 key:
307 description: |-
308 The key of the entry in the Secret resource's `data` field to be used.
309 Some instances of this field may be defaulted, in others it may be
310 required.
311 type: string
312 name:
313 description: |-
314 Name of the resource being referred to.
315 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
316 type: string
317 required:
318 - name
319 type: object
320 serviceConsumerDomain:
321 type: string
322 required:
323 - accessTokenSecretRef
324 - clientSecretSecretRef
325 - clientTokenSecretRef
326 - serviceConsumerDomain
327 type: object
328 azureDNS:
329 description: Use the Microsoft Azure DNS API to manage DNS01 challenge records.
330 properties:
331 clientID:
332 description: |-
333 Auth: Azure Service Principal:
334 The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
335 If set, ClientSecret and TenantID must also be set.
336 type: string
337 clientSecretSecretRef:
338 description: |-
339 Auth: Azure Service Principal:
340 A reference to a Secret containing the password associated with the Service Principal.
341 If set, ClientID and TenantID must also be set.
342 properties:
343 key:
344 description: |-
345 The key of the entry in the Secret resource's `data` field to be used.
346 Some instances of this field may be defaulted, in others it may be
347 required.
348 type: string
349 name:
350 description: |-
351 Name of the resource being referred to.
352 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
353 type: string
354 required:
355 - name
356 type: object
357 environment:
358 description: name of the Azure environment (default AzurePublicCloud)
359 enum:
360 - AzurePublicCloud
361 - AzureChinaCloud
362 - AzureGermanCloud
363 - AzureUSGovernmentCloud
364 type: string
365 hostedZoneName:
366 description: name of the DNS zone that should be used
367 type: string
368 managedIdentity:
369 description: |-
370 Auth: Azure Workload Identity or Azure Managed Service Identity:
371 Settings to enable Azure Workload Identity or Azure Managed Service Identity
372 If set, ClientID, ClientSecret and TenantID must not be set.
373 properties:
374 clientID:
375 description: client ID of the managed identity, cannot be used at the same time as resourceID
376 type: string
377 resourceID:
378 description: |-
379 resource ID of the managed identity, cannot be used at the same time as clientID
380 Cannot be used for Azure Managed Service Identity
381 type: string
382 tenantID:
383 description: tenant ID of the managed identity, cannot be used at the same time as resourceID
384 type: string
385 type: object
386 resourceGroupName:
387 description: resource group the DNS zone is located in
388 type: string
389 subscriptionID:
390 description: ID of the Azure subscription
391 type: string
392 tenantID:
393 description: |-
394 Auth: Azure Service Principal:
395 The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
396 If set, ClientID and ClientSecret must also be set.
397 type: string
398 required:
399 - resourceGroupName
400 - subscriptionID
401 type: object
402 cloudDNS:
403 description: Use the Google Cloud DNS API to manage DNS01 challenge records.
404 properties:
405 hostedZoneName:
406 description: |-
407 HostedZoneName is an optional field that tells cert-manager in which
408 Cloud DNS zone the challenge record has to be created.
409 If left empty cert-manager will automatically choose a zone.
410 type: string
411 project:
412 type: string
413 serviceAccountSecretRef:
414 description: |-
415 A reference to a specific 'key' within a Secret resource.
416 In some instances, `key` is a required field.
417 properties:
418 key:
419 description: |-
420 The key of the entry in the Secret resource's `data` field to be used.
421 Some instances of this field may be defaulted, in others it may be
422 required.
423 type: string
424 name:
425 description: |-
426 Name of the resource being referred to.
427 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
428 type: string
429 required:
430 - name
431 type: object
432 required:
433 - project
434 type: object
435 cloudflare:
436 description: Use the Cloudflare API to manage DNS01 challenge records.
437 properties:
438 apiKeySecretRef:
439 description: |-
440 API key to use to authenticate with Cloudflare.
441 Note: using an API token to authenticate is now the recommended method
442 as it allows greater control of permissions.
443 properties:
444 key:
445 description: |-
446 The key of the entry in the Secret resource's `data` field to be used.
447 Some instances of this field may be defaulted, in others it may be
448 required.
449 type: string
450 name:
451 description: |-
452 Name of the resource being referred to.
453 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
454 type: string
455 required:
456 - name
457 type: object
458 apiTokenSecretRef:
459 description: API token used to authenticate with Cloudflare.
460 properties:
461 key:
462 description: |-
463 The key of the entry in the Secret resource's `data` field to be used.
464 Some instances of this field may be defaulted, in others it may be
465 required.
466 type: string
467 name:
468 description: |-
469 Name of the resource being referred to.
470 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
471 type: string
472 required:
473 - name
474 type: object
475 email:
476 description: Email of the account, only required when using API key based authentication.
477 type: string
478 type: object
479 cnameStrategy:
480 description: |-
481 CNAMEStrategy configures how the DNS01 provider should handle CNAME
482 records when found in DNS zones.
483 enum:
484 - None
485 - Follow
486 type: string
487 digitalocean:
488 description: Use the DigitalOcean DNS API to manage DNS01 challenge records.
489 properties:
490 tokenSecretRef:
491 description: |-
492 A reference to a specific 'key' within a Secret resource.
493 In some instances, `key` is a required field.
494 properties:
495 key:
496 description: |-
497 The key of the entry in the Secret resource's `data` field to be used.
498 Some instances of this field may be defaulted, in others it may be
499 required.
500 type: string
501 name:
502 description: |-
503 Name of the resource being referred to.
504 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
505 type: string
506 required:
507 - name
508 type: object
509 required:
510 - tokenSecretRef
511 type: object
512 rfc2136:
513 description: |-
514 Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
515 to manage DNS01 challenge records.
516 properties:
517 nameserver:
518 description: |-
519 The IP address or hostname of an authoritative DNS server supporting
520 RFC2136 in the form host:port. If the host is an IPv6 address it must be
521 enclosed in square brackets (e.g [2001:db8::1]); port is optional.
522 This field is required.
523 type: string
524 protocol:
525 description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).
526 enum:
527 - TCP
528 - UDP
529 type: string
530 tsigAlgorithm:
531 description: |-
532 The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
533 when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
534 Supported values are (case-insensitive): ``HMACMD5`` (default),
535 ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
536 type: string
537 tsigKeyName:
538 description: |-
539 The TSIG Key name configured in the DNS.
540 If ``tsigSecretSecretRef`` is defined, this field is required.
541 type: string
542 tsigSecretSecretRef:
543 description: |-
544 The name of the secret containing the TSIG value.
545 If ``tsigKeyName`` is defined, this field is required.
546 properties:
547 key:
548 description: |-
549 The key of the entry in the Secret resource's `data` field to be used.
550 Some instances of this field may be defaulted, in others it may be
551 required.
552 type: string
553 name:
554 description: |-
555 Name of the resource being referred to.
556 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
557 type: string
558 required:
559 - name
560 type: object
561 required:
562 - nameserver
563 type: object
564 route53:
565 description: Use the AWS Route53 API to manage DNS01 challenge records.
566 properties:
567 accessKeyID:
568 description: |-
569 The AccessKeyID is used for authentication.
570 Cannot be set when SecretAccessKeyID is set.
571 If neither the Access Key nor Key ID are set, we fall-back to using env
572 vars, shared credentials file or AWS Instance metadata,
573 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
574 type: string
575 accessKeyIDSecretRef:
576 description: |-
577 The SecretAccessKey is used for authentication. If set, pull the AWS
578 access key ID from a key within a Kubernetes Secret.
579 Cannot be set when AccessKeyID is set.
580 If neither the Access Key nor Key ID are set, we fall-back to using env
581 vars, shared credentials file or AWS Instance metadata,
582 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
583 properties:
584 key:
585 description: |-
586 The key of the entry in the Secret resource's `data` field to be used.
587 Some instances of this field may be defaulted, in others it may be
588 required.
589 type: string
590 name:
591 description: |-
592 Name of the resource being referred to.
593 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
594 type: string
595 required:
596 - name
597 type: object
598 auth:
599 description: Auth configures how cert-manager authenticates.
600 properties:
601 kubernetes:
602 description: |-
603 Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
604 by passing a bound ServiceAccount token.
605 properties:
606 serviceAccountRef:
607 description: |-
608 A reference to a service account that will be used to request a bound
609 token (also known as "projected token"). To use this field, you must
610 configure an RBAC rule to let cert-manager request a token.
611 properties:
612 audiences:
613 description: |-
614 TokenAudiences is an optional list of audiences to include in the
615 token passed to AWS. The default token consisting of the issuer's namespace
616 and name is always included.
617 If unset the audience defaults to `sts.amazonaws.com`.
618 items:
619 type: string
620 type: array
621 x-kubernetes-list-type: atomic
622 name:
623 description: Name of the ServiceAccount used to request a token.
624 type: string
625 required:
626 - name
627 type: object
628 required:
629 - serviceAccountRef
630 type: object
631 required:
632 - kubernetes
633 type: object
634 hostedZoneID:
635 description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.
636 type: string
637 region:
638 description: |-
639 Override the AWS region.
640
641 Route53 is a global service and does not have regional endpoints but the
642 region specified here (or via environment variables) is used as a hint to
643 help compute the correct AWS credential scope and partition when it
644 connects to Route53. See:
645 - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
646 - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)
647
648 If you omit this region field, cert-manager will use the region from
649 AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
650 in the cert-manager controller Pod.
651
652 The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
653 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
654 [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
655 In this case this `region` field value is ignored.
656
657 The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
658 Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
659 [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
660 In this case this `region` field value is ignored.
661 type: string
662 role:
663 description: |-
664 Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
665 or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
666 type: string
667 secretAccessKeySecretRef:
668 description: |-
669 The SecretAccessKey is used for authentication.
670 If neither the Access Key nor Key ID are set, we fall-back to using env
671 vars, shared credentials file or AWS Instance metadata,
672 see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
673 properties:
674 key:
675 description: |-
676 The key of the entry in the Secret resource's `data` field to be used.
677 Some instances of this field may be defaulted, in others it may be
678 required.
679 type: string
680 name:
681 description: |-
682 Name of the resource being referred to.
683 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
684 type: string
685 required:
686 - name
687 type: object
688 type: object
689 webhook:
690 description: |-
691 Configure an external webhook based DNS01 challenge solver to manage
692 DNS01 challenge records.
693 properties:
694 config:
695 description: |-
696 Additional configuration that should be passed to the webhook apiserver
697 when challenges are processed.
698 This can contain arbitrary JSON data.
699 Secret values should not be specified in this stanza.
700 If secret values are needed (e.g., credentials for a DNS service), you
701 should use a SecretKeySelector to reference a Secret resource.
702 For details on the schema of this field, consult the webhook provider
703 implementation's documentation.
704 x-kubernetes-preserve-unknown-fields: true
705 groupName:
706 description: |-
707 The API group name that should be used when POSTing ChallengePayload
708 resources to the webhook apiserver.
709 This should be the same as the GroupName specified in the webhook
710 provider implementation.
711 type: string
712 solverName:
713 description: |-
714 The name of the solver to use, as defined in the webhook provider
715 implementation.
716 This will typically be the name of the provider, e.g., 'cloudflare'.
717 type: string
718 required:
719 - groupName
720 - solverName
721 type: object
722 type: object
723 http01:
724 description: |-
725 Configures cert-manager to attempt to complete authorizations by
726 performing the HTTP01 challenge flow.
727 It is not possible to obtain certificates for wildcard domain names
728 (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
729 properties:
730 gatewayHTTPRoute:
731 description: |-
732 The Gateway API is a sig-network community API that models service networking
733 in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
734 create HTTPRoutes with the specified labels in the same namespace as the challenge.
735 This solver is experimental, and fields / behaviour may change in the future.
736 properties:
737 labels:
738 additionalProperties:
739 type: string
740 description: |-
741 Custom labels that will be applied to HTTPRoutes created by cert-manager
742 while solving HTTP-01 challenges.
743 type: object
744 parentRefs:
745 description: |-
746 When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
747 cert-manager needs to know which parentRefs should be used when creating
748 the HTTPRoute. Usually, the parentRef references a Gateway. See:
749 https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
750 items:
751 description: |-
752 ParentReference identifies an API object (usually a Gateway) that can be considered
753 a parent of this resource (usually a route). There are two kinds of parent resources
754 with "Core" support:
755
756 * Gateway (Gateway conformance profile)
757 * Service (Mesh conformance profile, ClusterIP Services only)
758
759 This API may be extended in the future to support additional kinds of parent
760 resources.
761
762 The API object must be valid in the cluster; the Group and Kind must
763 be registered in the cluster for this reference to be valid.
764 properties:
765 group:
766 default: gateway.networking.k8s.io
767 description: |-
768 Group is the group of the referent.
769 When unspecified, "gateway.networking.k8s.io" is inferred.
770 To set the core API group (such as for a "Service" kind referent),
771 Group must be explicitly set to "" (empty string).
772
773 Support: Core
774 maxLength: 253
775 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
776 type: string
777 kind:
778 default: Gateway
779 description: |-
780 Kind is kind of the referent.
781
782 There are two kinds of parent resources with "Core" support:
783
784 * Gateway (Gateway conformance profile)
785 * Service (Mesh conformance profile, ClusterIP Services only)
786
787 Support for other resources is Implementation-Specific.
788 maxLength: 63
789 minLength: 1
790 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
791 type: string
792 name:
793 description: |-
794 Name is the name of the referent.
795
796 Support: Core
797 maxLength: 253
798 minLength: 1
799 type: string
800 namespace:
801 description: |-
802 Namespace is the namespace of the referent. When unspecified, this refers
803 to the local namespace of the Route.
804
805 Note that there are specific rules for ParentRefs which cross namespace
806 boundaries. Cross-namespace references are only valid if they are explicitly
807 allowed by something in the namespace they are referring to. For example:
808 Gateway has the AllowedRoutes field, and ReferenceGrant provides a
809 generic way to enable any other kind of cross-namespace reference.
810
811 <gateway:experimental:description>
812 ParentRefs from a Route to a Service in the same namespace are "producer"
813 routes, which apply default routing rules to inbound connections from
814 any namespace to the Service.
815
816 ParentRefs from a Route to a Service in a different namespace are
817 "consumer" routes, and these routing rules are only applied to outbound
818 connections originating from the same namespace as the Route, for which
819 the intended destination of the connections are a Service targeted as a
820 ParentRef of the Route.
821 </gateway:experimental:description>
822
823 Support: Core
824 maxLength: 63
825 minLength: 1
826 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
827 type: string
828 port:
829 description: |-
830 Port is the network port this Route targets. It can be interpreted
831 differently based on the type of parent resource.
832
833 When the parent resource is a Gateway, this targets all listeners
834 listening on the specified port that also support this kind of Route(and
835 select this Route). It's not recommended to set `Port` unless the
836 networking behaviors specified in a Route must apply to a specific port
837 as opposed to a listener(s) whose port(s) may be changed. When both Port
838 and SectionName are specified, the name and port of the selected listener
839 must match both specified values.
840
841 <gateway:experimental:description>
842 When the parent resource is a Service, this targets a specific port in the
843 Service spec. When both Port (experimental) and SectionName are specified,
844 the name and port of the selected port must match both specified values.
845 </gateway:experimental:description>
846
847 Implementations MAY choose to support other parent resources.
848 Implementations supporting other types of parent resources MUST clearly
849 document how/if Port is interpreted.
850
851 For the purpose of status, an attachment is considered successful as
852 long as the parent resource accepts it partially. For example, Gateway
853 listeners can restrict which Routes can attach to them by Route kind,
854 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
855 from the referencing Route, the Route MUST be considered successfully
856 attached. If no Gateway listeners accept attachment from this Route,
857 the Route MUST be considered detached from the Gateway.
858
859 Support: Extended
860 format: int32
861 maximum: 65535
862 minimum: 1
863 type: integer
864 sectionName:
865 description: |-
866 SectionName is the name of a section within the target resource. In the
867 following resources, SectionName is interpreted as the following:
868
869 * Gateway: Listener name. When both Port (experimental) and SectionName
870 are specified, the name and port of the selected listener must match
871 both specified values.
872 * Service: Port name. When both Port (experimental) and SectionName
873 are specified, the name and port of the selected listener must match
874 both specified values.
875
876 Implementations MAY choose to support attaching Routes to other resources.
877 If that is the case, they MUST clearly document how SectionName is
878 interpreted.
879
880 When unspecified (empty string), this will reference the entire resource.
881 For the purpose of status, an attachment is considered successful if at
882 least one section in the parent resource accepts it. For example, Gateway
883 listeners can restrict which Routes can attach to them by Route kind,
884 namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
885 the referencing Route, the Route MUST be considered successfully
886 attached. If no Gateway listeners accept attachment from this Route, the
887 Route MUST be considered detached from the Gateway.
888
889 Support: Core
890 maxLength: 253
891 minLength: 1
892 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
893 type: string
894 required:
895 - name
896 type: object
897 type: array
898 x-kubernetes-list-type: atomic
899 podTemplate:
900 description: |-
901 Optional pod template used to configure the ACME challenge solver pods
902 used for HTTP01 challenges.
903 properties:
904 metadata:
905 description: |-
906 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
907 Only the 'labels' and 'annotations' fields may be set.
908 If labels or annotations overlap with in-built values, the values here
909 will override the in-built values.
910 properties:
911 annotations:
912 additionalProperties:
913 type: string
914 description: Annotations that should be added to the created ACME HTTP01 solver pods.
915 type: object
916 labels:
917 additionalProperties:
918 type: string
919 description: Labels that should be added to the created ACME HTTP01 solver pods.
920 type: object
921 type: object
922 spec:
923 description: |-
924 PodSpec defines overrides for the HTTP01 challenge solver pod.
925 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
926 All other fields will be ignored.
927 properties:
928 affinity:
929 description: If specified, the pod's scheduling constraints
930 properties:
931 nodeAffinity:
932 description: Describes node affinity scheduling rules for the pod.
933 properties:
934 preferredDuringSchedulingIgnoredDuringExecution:
935 description: |-
936 The scheduler will prefer to schedule pods to nodes that satisfy
937 the affinity expressions specified by this field, but it may choose
938 a node that violates one or more of the expressions. The node that is
939 most preferred is the one with the greatest sum of weights, i.e.
940 for each node that meets all of the scheduling requirements (resource
941 request, requiredDuringScheduling affinity expressions, etc.),
942 compute a sum by iterating through the elements of this field and adding
943 "weight" to the sum if the node matches the corresponding matchExpressions; the
944 node(s) with the highest sum are the most preferred.
945 items:
946 description: |-
947 An empty preferred scheduling term matches all objects with implicit weight 0
948 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
949 properties:
950 preference:
951 description: A node selector term, associated with the corresponding weight.
952 properties:
953 matchExpressions:
954 description: A list of node selector requirements by node's labels.
955 items:
956 description: |-
957 A node selector requirement is a selector that contains values, a key, and an operator
958 that relates the key and values.
959 properties:
960 key:
961 description: The label key that the selector applies to.
962 type: string
963 operator:
964 description: |-
965 Represents a key's relationship to a set of values.
966 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
967 type: string
968 values:
969 description: |-
970 An array of string values. If the operator is In or NotIn,
971 the values array must be non-empty. If the operator is Exists or DoesNotExist,
972 the values array must be empty. If the operator is Gt or Lt, the values
973 array must have a single element, which will be interpreted as an integer.
974 This array is replaced during a strategic merge patch.
975 items:
976 type: string
977 type: array
978 x-kubernetes-list-type: atomic
979 required:
980 - key
981 - operator
982 type: object
983 type: array
984 x-kubernetes-list-type: atomic
985 matchFields:
986 description: A list of node selector requirements by node's fields.
987 items:
988 description: |-
989 A node selector requirement is a selector that contains values, a key, and an operator
990 that relates the key and values.
991 properties:
992 key:
993 description: The label key that the selector applies to.
994 type: string
995 operator:
996 description: |-
997 Represents a key's relationship to a set of values.
998 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
999 type: string
1000 values:
1001 description: |-
1002 An array of string values. If the operator is In or NotIn,
1003 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1004 the values array must be empty. If the operator is Gt or Lt, the values
1005 array must have a single element, which will be interpreted as an integer.
1006 This array is replaced during a strategic merge patch.
1007 items:
1008 type: string
1009 type: array
1010 x-kubernetes-list-type: atomic
1011 required:
1012 - key
1013 - operator
1014 type: object
1015 type: array
1016 x-kubernetes-list-type: atomic
1017 type: object
1018 x-kubernetes-map-type: atomic
1019 weight:
1020 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
1021 format: int32
1022 type: integer
1023 required:
1024 - preference
1025 - weight
1026 type: object
1027 type: array
1028 x-kubernetes-list-type: atomic
1029 requiredDuringSchedulingIgnoredDuringExecution:
1030 description: |-
1031 If the affinity requirements specified by this field are not met at
1032 scheduling time, the pod will not be scheduled onto the node.
1033 If the affinity requirements specified by this field cease to be met
1034 at some point during pod execution (e.g. due to an update), the system
1035 may or may not try to eventually evict the pod from its node.
1036 properties:
1037 nodeSelectorTerms:
1038 description: Required. A list of node selector terms. The terms are ORed.
1039 items:
1040 description: |-
1041 A null or empty node selector term matches no objects. The requirements of
1042 them are ANDed.
1043 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
1044 properties:
1045 matchExpressions:
1046 description: A list of node selector requirements by node's labels.
1047 items:
1048 description: |-
1049 A node selector requirement is a selector that contains values, a key, and an operator
1050 that relates the key and values.
1051 properties:
1052 key:
1053 description: The label key that the selector applies to.
1054 type: string
1055 operator:
1056 description: |-
1057 Represents a key's relationship to a set of values.
1058 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1059 type: string
1060 values:
1061 description: |-
1062 An array of string values. If the operator is In or NotIn,
1063 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1064 the values array must be empty. If the operator is Gt or Lt, the values
1065 array must have a single element, which will be interpreted as an integer.
1066 This array is replaced during a strategic merge patch.
1067 items:
1068 type: string
1069 type: array
1070 x-kubernetes-list-type: atomic
1071 required:
1072 - key
1073 - operator
1074 type: object
1075 type: array
1076 x-kubernetes-list-type: atomic
1077 matchFields:
1078 description: A list of node selector requirements by node's fields.
1079 items:
1080 description: |-
1081 A node selector requirement is a selector that contains values, a key, and an operator
1082 that relates the key and values.
1083 properties:
1084 key:
1085 description: The label key that the selector applies to.
1086 type: string
1087 operator:
1088 description: |-
1089 Represents a key's relationship to a set of values.
1090 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
1091 type: string
1092 values:
1093 description: |-
1094 An array of string values. If the operator is In or NotIn,
1095 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1096 the values array must be empty. If the operator is Gt or Lt, the values
1097 array must have a single element, which will be interpreted as an integer.
1098 This array is replaced during a strategic merge patch.
1099 items:
1100 type: string
1101 type: array
1102 x-kubernetes-list-type: atomic
1103 required:
1104 - key
1105 - operator
1106 type: object
1107 type: array
1108 x-kubernetes-list-type: atomic
1109 type: object
1110 x-kubernetes-map-type: atomic
1111 type: array
1112 x-kubernetes-list-type: atomic
1113 required:
1114 - nodeSelectorTerms
1115 type: object
1116 x-kubernetes-map-type: atomic
1117 type: object
1118 podAffinity:
1119 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
1120 properties:
1121 preferredDuringSchedulingIgnoredDuringExecution:
1122 description: |-
1123 The scheduler will prefer to schedule pods to nodes that satisfy
1124 the affinity expressions specified by this field, but it may choose
1125 a node that violates one or more of the expressions. The node that is
1126 most preferred is the one with the greatest sum of weights, i.e.
1127 for each node that meets all of the scheduling requirements (resource
1128 request, requiredDuringScheduling affinity expressions, etc.),
1129 compute a sum by iterating through the elements of this field and adding
1130 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
1131 node(s) with the highest sum are the most preferred.
1132 items:
1133 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1134 properties:
1135 podAffinityTerm:
1136 description: Required. A pod affinity term, associated with the corresponding weight.
1137 properties:
1138 labelSelector:
1139 description: |-
1140 A label query over a set of resources, in this case pods.
1141 If it's null, this PodAffinityTerm matches with no Pods.
1142 properties:
1143 matchExpressions:
1144 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1145 items:
1146 description: |-
1147 A label selector requirement is a selector that contains values, a key, and an operator that
1148 relates the key and values.
1149 properties:
1150 key:
1151 description: key is the label key that the selector applies to.
1152 type: string
1153 operator:
1154 description: |-
1155 operator represents a key's relationship to a set of values.
1156 Valid operators are In, NotIn, Exists and DoesNotExist.
1157 type: string
1158 values:
1159 description: |-
1160 values is an array of string values. If the operator is In or NotIn,
1161 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1162 the values array must be empty. This array is replaced during a strategic
1163 merge patch.
1164 items:
1165 type: string
1166 type: array
1167 x-kubernetes-list-type: atomic
1168 required:
1169 - key
1170 - operator
1171 type: object
1172 type: array
1173 x-kubernetes-list-type: atomic
1174 matchLabels:
1175 additionalProperties:
1176 type: string
1177 description: |-
1178 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1179 map is equivalent to an element of matchExpressions, whose key field is "key", the
1180 operator is "In", and the values array contains only "value". The requirements are ANDed.
1181 type: object
1182 type: object
1183 x-kubernetes-map-type: atomic
1184 matchLabelKeys:
1185 description: |-
1186 MatchLabelKeys is a set of pod label keys to select which pods will
1187 be taken into consideration. The keys are used to lookup values from the
1188 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1189 to select the group of existing pods which pods will be taken into consideration
1190 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1191 pod labels will be ignored. The default value is empty.
1192 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1193 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1194 items:
1195 type: string
1196 type: array
1197 x-kubernetes-list-type: atomic
1198 mismatchLabelKeys:
1199 description: |-
1200 MismatchLabelKeys is a set of pod label keys to select which pods will
1201 be taken into consideration. The keys are used to lookup values from the
1202 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1203 to select the group of existing pods which pods will be taken into consideration
1204 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1205 pod labels will be ignored. The default value is empty.
1206 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1207 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1208 items:
1209 type: string
1210 type: array
1211 x-kubernetes-list-type: atomic
1212 namespaceSelector:
1213 description: |-
1214 A label query over the set of namespaces that the term applies to.
1215 The term is applied to the union of the namespaces selected by this field
1216 and the ones listed in the namespaces field.
1217 null selector and null or empty namespaces list means "this pod's namespace".
1218 An empty selector ({}) matches all namespaces.
1219 properties:
1220 matchExpressions:
1221 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1222 items:
1223 description: |-
1224 A label selector requirement is a selector that contains values, a key, and an operator that
1225 relates the key and values.
1226 properties:
1227 key:
1228 description: key is the label key that the selector applies to.
1229 type: string
1230 operator:
1231 description: |-
1232 operator represents a key's relationship to a set of values.
1233 Valid operators are In, NotIn, Exists and DoesNotExist.
1234 type: string
1235 values:
1236 description: |-
1237 values is an array of string values. If the operator is In or NotIn,
1238 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1239 the values array must be empty. This array is replaced during a strategic
1240 merge patch.
1241 items:
1242 type: string
1243 type: array
1244 x-kubernetes-list-type: atomic
1245 required:
1246 - key
1247 - operator
1248 type: object
1249 type: array
1250 x-kubernetes-list-type: atomic
1251 matchLabels:
1252 additionalProperties:
1253 type: string
1254 description: |-
1255 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1256 map is equivalent to an element of matchExpressions, whose key field is "key", the
1257 operator is "In", and the values array contains only "value". The requirements are ANDed.
1258 type: object
1259 type: object
1260 x-kubernetes-map-type: atomic
1261 namespaces:
1262 description: |-
1263 namespaces specifies a static list of namespace names that the term applies to.
1264 The term is applied to the union of the namespaces listed in this field
1265 and the ones selected by namespaceSelector.
1266 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1267 items:
1268 type: string
1269 type: array
1270 x-kubernetes-list-type: atomic
1271 topologyKey:
1272 description: |-
1273 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1274 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1275 whose value of the label with key topologyKey matches that of any node on which any of the
1276 selected pods is running.
1277 Empty topologyKey is not allowed.
1278 type: string
1279 required:
1280 - topologyKey
1281 type: object
1282 weight:
1283 description: |-
1284 weight associated with matching the corresponding podAffinityTerm,
1285 in the range 1-100.
1286 format: int32
1287 type: integer
1288 required:
1289 - podAffinityTerm
1290 - weight
1291 type: object
1292 type: array
1293 x-kubernetes-list-type: atomic
1294 requiredDuringSchedulingIgnoredDuringExecution:
1295 description: |-
1296 If the affinity requirements specified by this field are not met at
1297 scheduling time, the pod will not be scheduled onto the node.
1298 If the affinity requirements specified by this field cease to be met
1299 at some point during pod execution (e.g. due to a pod label update), the
1300 system may or may not try to eventually evict the pod from its node.
1301 When there are multiple elements, the lists of nodes corresponding to each
1302 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1303 items:
1304 description: |-
1305 Defines a set of pods (namely those matching the labelSelector
1306 relative to the given namespace(s)) that this pod should be
1307 co-located (affinity) or not co-located (anti-affinity) with,
1308 where co-located is defined as running on a node whose value of
1309 the label with key <topologyKey> matches that of any node on which
1310 a pod of the set of pods is running
1311 properties:
1312 labelSelector:
1313 description: |-
1314 A label query over a set of resources, in this case pods.
1315 If it's null, this PodAffinityTerm matches with no Pods.
1316 properties:
1317 matchExpressions:
1318 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1319 items:
1320 description: |-
1321 A label selector requirement is a selector that contains values, a key, and an operator that
1322 relates the key and values.
1323 properties:
1324 key:
1325 description: key is the label key that the selector applies to.
1326 type: string
1327 operator:
1328 description: |-
1329 operator represents a key's relationship to a set of values.
1330 Valid operators are In, NotIn, Exists and DoesNotExist.
1331 type: string
1332 values:
1333 description: |-
1334 values is an array of string values. If the operator is In or NotIn,
1335 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1336 the values array must be empty. This array is replaced during a strategic
1337 merge patch.
1338 items:
1339 type: string
1340 type: array
1341 x-kubernetes-list-type: atomic
1342 required:
1343 - key
1344 - operator
1345 type: object
1346 type: array
1347 x-kubernetes-list-type: atomic
1348 matchLabels:
1349 additionalProperties:
1350 type: string
1351 description: |-
1352 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1353 map is equivalent to an element of matchExpressions, whose key field is "key", the
1354 operator is "In", and the values array contains only "value". The requirements are ANDed.
1355 type: object
1356 type: object
1357 x-kubernetes-map-type: atomic
1358 matchLabelKeys:
1359 description: |-
1360 MatchLabelKeys is a set of pod label keys to select which pods will
1361 be taken into consideration. The keys are used to lookup values from the
1362 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1363 to select the group of existing pods which pods will be taken into consideration
1364 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1365 pod labels will be ignored. The default value is empty.
1366 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1367 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1368 items:
1369 type: string
1370 type: array
1371 x-kubernetes-list-type: atomic
1372 mismatchLabelKeys:
1373 description: |-
1374 MismatchLabelKeys is a set of pod label keys to select which pods will
1375 be taken into consideration. The keys are used to lookup values from the
1376 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1377 to select the group of existing pods which pods will be taken into consideration
1378 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1379 pod labels will be ignored. The default value is empty.
1380 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1381 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1382 items:
1383 type: string
1384 type: array
1385 x-kubernetes-list-type: atomic
1386 namespaceSelector:
1387 description: |-
1388 A label query over the set of namespaces that the term applies to.
1389 The term is applied to the union of the namespaces selected by this field
1390 and the ones listed in the namespaces field.
1391 null selector and null or empty namespaces list means "this pod's namespace".
1392 An empty selector ({}) matches all namespaces.
1393 properties:
1394 matchExpressions:
1395 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1396 items:
1397 description: |-
1398 A label selector requirement is a selector that contains values, a key, and an operator that
1399 relates the key and values.
1400 properties:
1401 key:
1402 description: key is the label key that the selector applies to.
1403 type: string
1404 operator:
1405 description: |-
1406 operator represents a key's relationship to a set of values.
1407 Valid operators are In, NotIn, Exists and DoesNotExist.
1408 type: string
1409 values:
1410 description: |-
1411 values is an array of string values. If the operator is In or NotIn,
1412 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1413 the values array must be empty. This array is replaced during a strategic
1414 merge patch.
1415 items:
1416 type: string
1417 type: array
1418 x-kubernetes-list-type: atomic
1419 required:
1420 - key
1421 - operator
1422 type: object
1423 type: array
1424 x-kubernetes-list-type: atomic
1425 matchLabels:
1426 additionalProperties:
1427 type: string
1428 description: |-
1429 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1430 map is equivalent to an element of matchExpressions, whose key field is "key", the
1431 operator is "In", and the values array contains only "value". The requirements are ANDed.
1432 type: object
1433 type: object
1434 x-kubernetes-map-type: atomic
1435 namespaces:
1436 description: |-
1437 namespaces specifies a static list of namespace names that the term applies to.
1438 The term is applied to the union of the namespaces listed in this field
1439 and the ones selected by namespaceSelector.
1440 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1441 items:
1442 type: string
1443 type: array
1444 x-kubernetes-list-type: atomic
1445 topologyKey:
1446 description: |-
1447 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1448 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1449 whose value of the label with key topologyKey matches that of any node on which any of the
1450 selected pods is running.
1451 Empty topologyKey is not allowed.
1452 type: string
1453 required:
1454 - topologyKey
1455 type: object
1456 type: array
1457 x-kubernetes-list-type: atomic
1458 type: object
1459 podAntiAffinity:
1460 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
1461 properties:
1462 preferredDuringSchedulingIgnoredDuringExecution:
1463 description: |-
1464 The scheduler will prefer to schedule pods to nodes that satisfy
1465 the anti-affinity expressions specified by this field, but it may choose
1466 a node that violates one or more of the expressions. The node that is
1467 most preferred is the one with the greatest sum of weights, i.e.
1468 for each node that meets all of the scheduling requirements (resource
1469 request, requiredDuringScheduling anti-affinity expressions, etc.),
1470 compute a sum by iterating through the elements of this field and subtracting
1471 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
1472 node(s) with the highest sum are the most preferred.
1473 items:
1474 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
1475 properties:
1476 podAffinityTerm:
1477 description: Required. A pod affinity term, associated with the corresponding weight.
1478 properties:
1479 labelSelector:
1480 description: |-
1481 A label query over a set of resources, in this case pods.
1482 If it's null, this PodAffinityTerm matches with no Pods.
1483 properties:
1484 matchExpressions:
1485 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1486 items:
1487 description: |-
1488 A label selector requirement is a selector that contains values, a key, and an operator that
1489 relates the key and values.
1490 properties:
1491 key:
1492 description: key is the label key that the selector applies to.
1493 type: string
1494 operator:
1495 description: |-
1496 operator represents a key's relationship to a set of values.
1497 Valid operators are In, NotIn, Exists and DoesNotExist.
1498 type: string
1499 values:
1500 description: |-
1501 values is an array of string values. If the operator is In or NotIn,
1502 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1503 the values array must be empty. This array is replaced during a strategic
1504 merge patch.
1505 items:
1506 type: string
1507 type: array
1508 x-kubernetes-list-type: atomic
1509 required:
1510 - key
1511 - operator
1512 type: object
1513 type: array
1514 x-kubernetes-list-type: atomic
1515 matchLabels:
1516 additionalProperties:
1517 type: string
1518 description: |-
1519 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1520 map is equivalent to an element of matchExpressions, whose key field is "key", the
1521 operator is "In", and the values array contains only "value". The requirements are ANDed.
1522 type: object
1523 type: object
1524 x-kubernetes-map-type: atomic
1525 matchLabelKeys:
1526 description: |-
1527 MatchLabelKeys is a set of pod label keys to select which pods will
1528 be taken into consideration. The keys are used to lookup values from the
1529 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1530 to select the group of existing pods which pods will be taken into consideration
1531 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1532 pod labels will be ignored. The default value is empty.
1533 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1534 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1535 items:
1536 type: string
1537 type: array
1538 x-kubernetes-list-type: atomic
1539 mismatchLabelKeys:
1540 description: |-
1541 MismatchLabelKeys is a set of pod label keys to select which pods will
1542 be taken into consideration. The keys are used to lookup values from the
1543 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1544 to select the group of existing pods which pods will be taken into consideration
1545 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1546 pod labels will be ignored. The default value is empty.
1547 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1548 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1549 items:
1550 type: string
1551 type: array
1552 x-kubernetes-list-type: atomic
1553 namespaceSelector:
1554 description: |-
1555 A label query over the set of namespaces that the term applies to.
1556 The term is applied to the union of the namespaces selected by this field
1557 and the ones listed in the namespaces field.
1558 null selector and null or empty namespaces list means "this pod's namespace".
1559 An empty selector ({}) matches all namespaces.
1560 properties:
1561 matchExpressions:
1562 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1563 items:
1564 description: |-
1565 A label selector requirement is a selector that contains values, a key, and an operator that
1566 relates the key and values.
1567 properties:
1568 key:
1569 description: key is the label key that the selector applies to.
1570 type: string
1571 operator:
1572 description: |-
1573 operator represents a key's relationship to a set of values.
1574 Valid operators are In, NotIn, Exists and DoesNotExist.
1575 type: string
1576 values:
1577 description: |-
1578 values is an array of string values. If the operator is In or NotIn,
1579 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1580 the values array must be empty. This array is replaced during a strategic
1581 merge patch.
1582 items:
1583 type: string
1584 type: array
1585 x-kubernetes-list-type: atomic
1586 required:
1587 - key
1588 - operator
1589 type: object
1590 type: array
1591 x-kubernetes-list-type: atomic
1592 matchLabels:
1593 additionalProperties:
1594 type: string
1595 description: |-
1596 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1597 map is equivalent to an element of matchExpressions, whose key field is "key", the
1598 operator is "In", and the values array contains only "value". The requirements are ANDed.
1599 type: object
1600 type: object
1601 x-kubernetes-map-type: atomic
1602 namespaces:
1603 description: |-
1604 namespaces specifies a static list of namespace names that the term applies to.
1605 The term is applied to the union of the namespaces listed in this field
1606 and the ones selected by namespaceSelector.
1607 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1608 items:
1609 type: string
1610 type: array
1611 x-kubernetes-list-type: atomic
1612 topologyKey:
1613 description: |-
1614 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1615 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1616 whose value of the label with key topologyKey matches that of any node on which any of the
1617 selected pods is running.
1618 Empty topologyKey is not allowed.
1619 type: string
1620 required:
1621 - topologyKey
1622 type: object
1623 weight:
1624 description: |-
1625 weight associated with matching the corresponding podAffinityTerm,
1626 in the range 1-100.
1627 format: int32
1628 type: integer
1629 required:
1630 - podAffinityTerm
1631 - weight
1632 type: object
1633 type: array
1634 x-kubernetes-list-type: atomic
1635 requiredDuringSchedulingIgnoredDuringExecution:
1636 description: |-
1637 If the anti-affinity requirements specified by this field are not met at
1638 scheduling time, the pod will not be scheduled onto the node.
1639 If the anti-affinity requirements specified by this field cease to be met
1640 at some point during pod execution (e.g. due to a pod label update), the
1641 system may or may not try to eventually evict the pod from its node.
1642 When there are multiple elements, the lists of nodes corresponding to each
1643 podAffinityTerm are intersected, i.e. all terms must be satisfied.
1644 items:
1645 description: |-
1646 Defines a set of pods (namely those matching the labelSelector
1647 relative to the given namespace(s)) that this pod should be
1648 co-located (affinity) or not co-located (anti-affinity) with,
1649 where co-located is defined as running on a node whose value of
1650 the label with key <topologyKey> matches that of any node on which
1651 a pod of the set of pods is running
1652 properties:
1653 labelSelector:
1654 description: |-
1655 A label query over a set of resources, in this case pods.
1656 If it's null, this PodAffinityTerm matches with no Pods.
1657 properties:
1658 matchExpressions:
1659 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1660 items:
1661 description: |-
1662 A label selector requirement is a selector that contains values, a key, and an operator that
1663 relates the key and values.
1664 properties:
1665 key:
1666 description: key is the label key that the selector applies to.
1667 type: string
1668 operator:
1669 description: |-
1670 operator represents a key's relationship to a set of values.
1671 Valid operators are In, NotIn, Exists and DoesNotExist.
1672 type: string
1673 values:
1674 description: |-
1675 values is an array of string values. If the operator is In or NotIn,
1676 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1677 the values array must be empty. This array is replaced during a strategic
1678 merge patch.
1679 items:
1680 type: string
1681 type: array
1682 x-kubernetes-list-type: atomic
1683 required:
1684 - key
1685 - operator
1686 type: object
1687 type: array
1688 x-kubernetes-list-type: atomic
1689 matchLabels:
1690 additionalProperties:
1691 type: string
1692 description: |-
1693 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1694 map is equivalent to an element of matchExpressions, whose key field is "key", the
1695 operator is "In", and the values array contains only "value". The requirements are ANDed.
1696 type: object
1697 type: object
1698 x-kubernetes-map-type: atomic
1699 matchLabelKeys:
1700 description: |-
1701 MatchLabelKeys is a set of pod label keys to select which pods will
1702 be taken into consideration. The keys are used to lookup values from the
1703 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
1704 to select the group of existing pods which pods will be taken into consideration
1705 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1706 pod labels will be ignored. The default value is empty.
1707 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
1708 Also, matchLabelKeys cannot be set when labelSelector isn't set.
1709 items:
1710 type: string
1711 type: array
1712 x-kubernetes-list-type: atomic
1713 mismatchLabelKeys:
1714 description: |-
1715 MismatchLabelKeys is a set of pod label keys to select which pods will
1716 be taken into consideration. The keys are used to lookup values from the
1717 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
1718 to select the group of existing pods which pods will be taken into consideration
1719 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
1720 pod labels will be ignored. The default value is empty.
1721 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
1722 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1723 items:
1724 type: string
1725 type: array
1726 x-kubernetes-list-type: atomic
1727 namespaceSelector:
1728 description: |-
1729 A label query over the set of namespaces that the term applies to.
1730 The term is applied to the union of the namespaces selected by this field
1731 and the ones listed in the namespaces field.
1732 null selector and null or empty namespaces list means "this pod's namespace".
1733 An empty selector ({}) matches all namespaces.
1734 properties:
1735 matchExpressions:
1736 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
1737 items:
1738 description: |-
1739 A label selector requirement is a selector that contains values, a key, and an operator that
1740 relates the key and values.
1741 properties:
1742 key:
1743 description: key is the label key that the selector applies to.
1744 type: string
1745 operator:
1746 description: |-
1747 operator represents a key's relationship to a set of values.
1748 Valid operators are In, NotIn, Exists and DoesNotExist.
1749 type: string
1750 values:
1751 description: |-
1752 values is an array of string values. If the operator is In or NotIn,
1753 the values array must be non-empty. If the operator is Exists or DoesNotExist,
1754 the values array must be empty. This array is replaced during a strategic
1755 merge patch.
1756 items:
1757 type: string
1758 type: array
1759 x-kubernetes-list-type: atomic
1760 required:
1761 - key
1762 - operator
1763 type: object
1764 type: array
1765 x-kubernetes-list-type: atomic
1766 matchLabels:
1767 additionalProperties:
1768 type: string
1769 description: |-
1770 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1771 map is equivalent to an element of matchExpressions, whose key field is "key", the
1772 operator is "In", and the values array contains only "value". The requirements are ANDed.
1773 type: object
1774 type: object
1775 x-kubernetes-map-type: atomic
1776 namespaces:
1777 description: |-
1778 namespaces specifies a static list of namespace names that the term applies to.
1779 The term is applied to the union of the namespaces listed in this field
1780 and the ones selected by namespaceSelector.
1781 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
1782 items:
1783 type: string
1784 type: array
1785 x-kubernetes-list-type: atomic
1786 topologyKey:
1787 description: |-
1788 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
1789 the labelSelector in the specified namespaces, where co-located is defined as running on a node
1790 whose value of the label with key topologyKey matches that of any node on which any of the
1791 selected pods is running.
1792 Empty topologyKey is not allowed.
1793 type: string
1794 required:
1795 - topologyKey
1796 type: object
1797 type: array
1798 x-kubernetes-list-type: atomic
1799 type: object
1800 type: object
1801 imagePullSecrets:
1802 description: If specified, the pod's imagePullSecrets
1803 items:
1804 description: |-
1805 LocalObjectReference contains enough information to let you locate the
1806 referenced object inside the same namespace.
1807 properties:
1808 name:
1809 default: ""
1810 description: |-
1811 Name of the referent.
1812 This field is effectively required, but due to backwards compatibility is
1813 allowed to be empty. Instances of this type with an empty value here are
1814 almost certainly wrong.
1815 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
1816 type: string
1817 type: object
1818 x-kubernetes-map-type: atomic
1819 type: array
1820 x-kubernetes-list-map-keys:
1821 - name
1822 x-kubernetes-list-type: map
1823 nodeSelector:
1824 additionalProperties:
1825 type: string
1826 description: |-
1827 NodeSelector is a selector which must be true for the pod to fit on a node.
1828 Selector which must match a node's labels for the pod to be scheduled on that node.
1829 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
1830 type: object
1831 priorityClassName:
1832 description: If specified, the pod's priorityClassName.
1833 type: string
1834 resources:
1835 description: |-
1836 If specified, the pod's resource requirements.
1837 These values override the global resource configuration flags.
1838 Note that when only specifying resource limits, ensure they are greater than or equal
1839 to the corresponding global resource requests configured via controller flags
1840 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
1841 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
1842 properties:
1843 limits:
1844 additionalProperties:
1845 anyOf:
1846 - type: integer
1847 - type: string
1848 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1849 x-kubernetes-int-or-string: true
1850 description: |-
1851 Limits describes the maximum amount of compute resources allowed.
1852 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1853 type: object
1854 requests:
1855 additionalProperties:
1856 anyOf:
1857 - type: integer
1858 - type: string
1859 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
1860 x-kubernetes-int-or-string: true
1861 description: |-
1862 Requests describes the minimum amount of compute resources required.
1863 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
1864 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
1865 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
1866 type: object
1867 type: object
1868 securityContext:
1869 description: If specified, the pod's security context
1870 properties:
1871 fsGroup:
1872 description: |-
1873 A special supplemental group that applies to all containers in a pod.
1874 Some volume types allow the Kubelet to change the ownership of that volume
1875 to be owned by the pod:
1876
1877 1. The owning GID will be the FSGroup
1878 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
1879 3. The permission bits are OR'd with rw-rw----
1880
1881 If unset, the Kubelet will not modify the ownership and permissions of any volume.
1882 Note that this field cannot be set when spec.os.name is windows.
1883 format: int64
1884 type: integer
1885 fsGroupChangePolicy:
1886 description: |-
1887 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
1888 before being exposed inside Pod. This field will only apply to
1889 volume types which support fsGroup based ownership(and permissions).
1890 It will have no effect on ephemeral volume types such as: secret, configmaps
1891 and emptydir.
1892 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
1893 Note that this field cannot be set when spec.os.name is windows.
1894 type: string
1895 runAsGroup:
1896 description: |-
1897 The GID to run the entrypoint of the container process.
1898 Uses runtime default if unset.
1899 May also be set in SecurityContext. If set in both SecurityContext and
1900 PodSecurityContext, the value specified in SecurityContext takes precedence
1901 for that container.
1902 Note that this field cannot be set when spec.os.name is windows.
1903 format: int64
1904 type: integer
1905 runAsNonRoot:
1906 description: |-
1907 Indicates that the container must run as a non-root user.
1908 If true, the Kubelet will validate the image at runtime to ensure that it
1909 does not run as UID 0 (root) and fail to start the container if it does.
1910 If unset or false, no such validation will be performed.
1911 May also be set in SecurityContext. If set in both SecurityContext and
1912 PodSecurityContext, the value specified in SecurityContext takes precedence.
1913 type: boolean
1914 runAsUser:
1915 description: |-
1916 The UID to run the entrypoint of the container process.
1917 Defaults to user specified in image metadata if unspecified.
1918 May also be set in SecurityContext. If set in both SecurityContext and
1919 PodSecurityContext, the value specified in SecurityContext takes precedence
1920 for that container.
1921 Note that this field cannot be set when spec.os.name is windows.
1922 format: int64
1923 type: integer
1924 seLinuxOptions:
1925 description: |-
1926 The SELinux context to be applied to all containers.
1927 If unspecified, the container runtime will allocate a random SELinux context for each
1928 container. May also be set in SecurityContext. If set in
1929 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
1930 takes precedence for that container.
1931 Note that this field cannot be set when spec.os.name is windows.
1932 properties:
1933 level:
1934 description: Level is SELinux level label that applies to the container.
1935 type: string
1936 role:
1937 description: Role is a SELinux role label that applies to the container.
1938 type: string
1939 type:
1940 description: Type is a SELinux type label that applies to the container.
1941 type: string
1942 user:
1943 description: User is a SELinux user label that applies to the container.
1944 type: string
1945 type: object
1946 seccompProfile:
1947 description: |-
1948 The seccomp options to use by the containers in this pod.
1949 Note that this field cannot be set when spec.os.name is windows.
1950 properties:
1951 localhostProfile:
1952 description: |-
1953 localhostProfile indicates a profile defined in a file on the node should be used.
1954 The profile must be preconfigured on the node to work.
1955 Must be a descending path, relative to the kubelet's configured seccomp profile location.
1956 Must be set if type is "Localhost". Must NOT be set for any other type.
1957 type: string
1958 type:
1959 description: |-
1960 type indicates which kind of seccomp profile will be applied.
1961 Valid options are:
1962
1963 Localhost - a profile defined in a file on the node should be used.
1964 RuntimeDefault - the container runtime default profile should be used.
1965 Unconfined - no profile should be applied.
1966 type: string
1967 required:
1968 - type
1969 type: object
1970 supplementalGroups:
1971 description: |-
1972 A list of groups applied to the first process run in each container, in addition
1973 to the container's primary GID, the fsGroup (if specified), and group memberships
1974 defined in the container image for the uid of the container process. If unspecified,
1975 no additional groups are added to any container. Note that group memberships
1976 defined in the container image for the uid of the container process are still effective,
1977 even if they are not included in this list.
1978 Note that this field cannot be set when spec.os.name is windows.
1979 items:
1980 format: int64
1981 type: integer
1982 type: array
1983 x-kubernetes-list-type: atomic
1984 sysctls:
1985 description: |-
1986 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
1987 sysctls (by the container runtime) might fail to launch.
1988 Note that this field cannot be set when spec.os.name is windows.
1989 items:
1990 description: Sysctl defines a kernel parameter to be set
1991 properties:
1992 name:
1993 description: Name of a property to set
1994 type: string
1995 value:
1996 description: Value of a property to set
1997 type: string
1998 required:
1999 - name
2000 - value
2001 type: object
2002 type: array
2003 x-kubernetes-list-type: atomic
2004 type: object
2005 serviceAccountName:
2006 description: If specified, the pod's service account
2007 type: string
2008 tolerations:
2009 description: If specified, the pod's tolerations.
2010 items:
2011 description: |-
2012 The pod this Toleration is attached to tolerates any taint that matches
2013 the triple <key,value,effect> using the matching operator <operator>.
2014 properties:
2015 effect:
2016 description: |-
2017 Effect indicates the taint effect to match. Empty means match all taint effects.
2018 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
2019 type: string
2020 key:
2021 description: |-
2022 Key is the taint key that the toleration applies to. Empty means match all taint keys.
2023 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
2024 type: string
2025 operator:
2026 description: |-
2027 Operator represents a key's relationship to the value.
2028 Valid operators are Exists and Equal. Defaults to Equal.
2029 Exists is equivalent to wildcard for value, so that a pod can
2030 tolerate all taints of a particular category.
2031 type: string
2032 tolerationSeconds:
2033 description: |-
2034 TolerationSeconds represents the period of time the toleration (which must be
2035 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
2036 it is not set, which means tolerate the taint forever (do not evict). Zero and
2037 negative values will be treated as 0 (evict immediately) by the system.
2038 format: int64
2039 type: integer
2040 value:
2041 description: |-
2042 Value is the taint value the toleration matches to.
2043 If the operator is Exists, the value should be empty, otherwise just a regular string.
2044 type: string
2045 type: object
2046 type: array
2047 x-kubernetes-list-type: atomic
2048 type: object
2049 type: object
2050 serviceType:
2051 description: |-
2052 Optional service type for Kubernetes solver service. Supported values
2053 are NodePort or ClusterIP. If unset, defaults to NodePort.
2054 type: string
2055 type: object
2056 ingress:
2057 description: |-
2058 The ingress based HTTP01 challenge solver will solve challenges by
2059 creating or modifying Ingress resources in order to route requests for
2060 '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
2061 provisioned by cert-manager for each Challenge to be completed.
2062 properties:
2063 class:
2064 description: |-
2065 This field configures the annotation `kubernetes.io/ingress.class` when
2066 creating Ingress resources to solve ACME challenges that use this
2067 challenge solver. Only one of `class`, `name` or `ingressClassName` may
2068 be specified.
2069 type: string
2070 ingressClassName:
2071 description: |-
2072 This field configures the field `ingressClassName` on the created Ingress
2073 resources used to solve ACME challenges that use this challenge solver.
2074 This is the recommended way of configuring the ingress class. Only one of
2075 `class`, `name` or `ingressClassName` may be specified.
2076 type: string
2077 ingressTemplate:
2078 description: |-
2079 Optional ingress template used to configure the ACME challenge solver
2080 ingress used for HTTP01 challenges.
2081 properties:
2082 metadata:
2083 description: |-
2084 ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
2085 Only the 'labels' and 'annotations' fields may be set.
2086 If labels or annotations overlap with in-built values, the values here
2087 will override the in-built values.
2088 properties:
2089 annotations:
2090 additionalProperties:
2091 type: string
2092 description: Annotations that should be added to the created ACME HTTP01 solver ingress.
2093 type: object
2094 labels:
2095 additionalProperties:
2096 type: string
2097 description: Labels that should be added to the created ACME HTTP01 solver ingress.
2098 type: object
2099 type: object
2100 type: object
2101 name:
2102 description: |-
2103 The name of the ingress resource that should have ACME challenge solving
2104 routes inserted into it in order to solve HTTP01 challenges.
2105 This is typically used in conjunction with ingress controllers like
2106 ingress-gce, which maintains a 1:1 mapping between external IPs and
2107 ingress resources. Only one of `class`, `name` or `ingressClassName` may
2108 be specified.
2109 type: string
2110 podTemplate:
2111 description: |-
2112 Optional pod template used to configure the ACME challenge solver pods
2113 used for HTTP01 challenges.
2114 properties:
2115 metadata:
2116 description: |-
2117 ObjectMeta overrides for the pod used to solve HTTP01 challenges.
2118 Only the 'labels' and 'annotations' fields may be set.
2119 If labels or annotations overlap with in-built values, the values here
2120 will override the in-built values.
2121 properties:
2122 annotations:
2123 additionalProperties:
2124 type: string
2125 description: Annotations that should be added to the created ACME HTTP01 solver pods.
2126 type: object
2127 labels:
2128 additionalProperties:
2129 type: string
2130 description: Labels that should be added to the created ACME HTTP01 solver pods.
2131 type: object
2132 type: object
2133 spec:
2134 description: |-
2135 PodSpec defines overrides for the HTTP01 challenge solver pod.
2136 Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
2137 All other fields will be ignored.
2138 properties:
2139 affinity:
2140 description: If specified, the pod's scheduling constraints
2141 properties:
2142 nodeAffinity:
2143 description: Describes node affinity scheduling rules for the pod.
2144 properties:
2145 preferredDuringSchedulingIgnoredDuringExecution:
2146 description: |-
2147 The scheduler will prefer to schedule pods to nodes that satisfy
2148 the affinity expressions specified by this field, but it may choose
2149 a node that violates one or more of the expressions. The node that is
2150 most preferred is the one with the greatest sum of weights, i.e.
2151 for each node that meets all of the scheduling requirements (resource
2152 request, requiredDuringScheduling affinity expressions, etc.),
2153 compute a sum by iterating through the elements of this field and adding
2154 "weight" to the sum if the node matches the corresponding matchExpressions; the
2155 node(s) with the highest sum are the most preferred.
2156 items:
2157 description: |-
2158 An empty preferred scheduling term matches all objects with implicit weight 0
2159 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
2160 properties:
2161 preference:
2162 description: A node selector term, associated with the corresponding weight.
2163 properties:
2164 matchExpressions:
2165 description: A list of node selector requirements by node's labels.
2166 items:
2167 description: |-
2168 A node selector requirement is a selector that contains values, a key, and an operator
2169 that relates the key and values.
2170 properties:
2171 key:
2172 description: The label key that the selector applies to.
2173 type: string
2174 operator:
2175 description: |-
2176 Represents a key's relationship to a set of values.
2177 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2178 type: string
2179 values:
2180 description: |-
2181 An array of string values. If the operator is In or NotIn,
2182 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2183 the values array must be empty. If the operator is Gt or Lt, the values
2184 array must have a single element, which will be interpreted as an integer.
2185 This array is replaced during a strategic merge patch.
2186 items:
2187 type: string
2188 type: array
2189 x-kubernetes-list-type: atomic
2190 required:
2191 - key
2192 - operator
2193 type: object
2194 type: array
2195 x-kubernetes-list-type: atomic
2196 matchFields:
2197 description: A list of node selector requirements by node's fields.
2198 items:
2199 description: |-
2200 A node selector requirement is a selector that contains values, a key, and an operator
2201 that relates the key and values.
2202 properties:
2203 key:
2204 description: The label key that the selector applies to.
2205 type: string
2206 operator:
2207 description: |-
2208 Represents a key's relationship to a set of values.
2209 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2210 type: string
2211 values:
2212 description: |-
2213 An array of string values. If the operator is In or NotIn,
2214 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2215 the values array must be empty. If the operator is Gt or Lt, the values
2216 array must have a single element, which will be interpreted as an integer.
2217 This array is replaced during a strategic merge patch.
2218 items:
2219 type: string
2220 type: array
2221 x-kubernetes-list-type: atomic
2222 required:
2223 - key
2224 - operator
2225 type: object
2226 type: array
2227 x-kubernetes-list-type: atomic
2228 type: object
2229 x-kubernetes-map-type: atomic
2230 weight:
2231 description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
2232 format: int32
2233 type: integer
2234 required:
2235 - preference
2236 - weight
2237 type: object
2238 type: array
2239 x-kubernetes-list-type: atomic
2240 requiredDuringSchedulingIgnoredDuringExecution:
2241 description: |-
2242 If the affinity requirements specified by this field are not met at
2243 scheduling time, the pod will not be scheduled onto the node.
2244 If the affinity requirements specified by this field cease to be met
2245 at some point during pod execution (e.g. due to an update), the system
2246 may or may not try to eventually evict the pod from its node.
2247 properties:
2248 nodeSelectorTerms:
2249 description: Required. A list of node selector terms. The terms are ORed.
2250 items:
2251 description: |-
2252 A null or empty node selector term matches no objects. The requirements of
2253 them are ANDed.
2254 The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
2255 properties:
2256 matchExpressions:
2257 description: A list of node selector requirements by node's labels.
2258 items:
2259 description: |-
2260 A node selector requirement is a selector that contains values, a key, and an operator
2261 that relates the key and values.
2262 properties:
2263 key:
2264 description: The label key that the selector applies to.
2265 type: string
2266 operator:
2267 description: |-
2268 Represents a key's relationship to a set of values.
2269 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2270 type: string
2271 values:
2272 description: |-
2273 An array of string values. If the operator is In or NotIn,
2274 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2275 the values array must be empty. If the operator is Gt or Lt, the values
2276 array must have a single element, which will be interpreted as an integer.
2277 This array is replaced during a strategic merge patch.
2278 items:
2279 type: string
2280 type: array
2281 x-kubernetes-list-type: atomic
2282 required:
2283 - key
2284 - operator
2285 type: object
2286 type: array
2287 x-kubernetes-list-type: atomic
2288 matchFields:
2289 description: A list of node selector requirements by node's fields.
2290 items:
2291 description: |-
2292 A node selector requirement is a selector that contains values, a key, and an operator
2293 that relates the key and values.
2294 properties:
2295 key:
2296 description: The label key that the selector applies to.
2297 type: string
2298 operator:
2299 description: |-
2300 Represents a key's relationship to a set of values.
2301 Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
2302 type: string
2303 values:
2304 description: |-
2305 An array of string values. If the operator is In or NotIn,
2306 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2307 the values array must be empty. If the operator is Gt or Lt, the values
2308 array must have a single element, which will be interpreted as an integer.
2309 This array is replaced during a strategic merge patch.
2310 items:
2311 type: string
2312 type: array
2313 x-kubernetes-list-type: atomic
2314 required:
2315 - key
2316 - operator
2317 type: object
2318 type: array
2319 x-kubernetes-list-type: atomic
2320 type: object
2321 x-kubernetes-map-type: atomic
2322 type: array
2323 x-kubernetes-list-type: atomic
2324 required:
2325 - nodeSelectorTerms
2326 type: object
2327 x-kubernetes-map-type: atomic
2328 type: object
2329 podAffinity:
2330 description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
2331 properties:
2332 preferredDuringSchedulingIgnoredDuringExecution:
2333 description: |-
2334 The scheduler will prefer to schedule pods to nodes that satisfy
2335 the affinity expressions specified by this field, but it may choose
2336 a node that violates one or more of the expressions. The node that is
2337 most preferred is the one with the greatest sum of weights, i.e.
2338 for each node that meets all of the scheduling requirements (resource
2339 request, requiredDuringScheduling affinity expressions, etc.),
2340 compute a sum by iterating through the elements of this field and adding
2341 "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
2342 node(s) with the highest sum are the most preferred.
2343 items:
2344 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2345 properties:
2346 podAffinityTerm:
2347 description: Required. A pod affinity term, associated with the corresponding weight.
2348 properties:
2349 labelSelector:
2350 description: |-
2351 A label query over a set of resources, in this case pods.
2352 If it's null, this PodAffinityTerm matches with no Pods.
2353 properties:
2354 matchExpressions:
2355 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2356 items:
2357 description: |-
2358 A label selector requirement is a selector that contains values, a key, and an operator that
2359 relates the key and values.
2360 properties:
2361 key:
2362 description: key is the label key that the selector applies to.
2363 type: string
2364 operator:
2365 description: |-
2366 operator represents a key's relationship to a set of values.
2367 Valid operators are In, NotIn, Exists and DoesNotExist.
2368 type: string
2369 values:
2370 description: |-
2371 values is an array of string values. If the operator is In or NotIn,
2372 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2373 the values array must be empty. This array is replaced during a strategic
2374 merge patch.
2375 items:
2376 type: string
2377 type: array
2378 x-kubernetes-list-type: atomic
2379 required:
2380 - key
2381 - operator
2382 type: object
2383 type: array
2384 x-kubernetes-list-type: atomic
2385 matchLabels:
2386 additionalProperties:
2387 type: string
2388 description: |-
2389 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2390 map is equivalent to an element of matchExpressions, whose key field is "key", the
2391 operator is "In", and the values array contains only "value". The requirements are ANDed.
2392 type: object
2393 type: object
2394 x-kubernetes-map-type: atomic
2395 matchLabelKeys:
2396 description: |-
2397 MatchLabelKeys is a set of pod label keys to select which pods will
2398 be taken into consideration. The keys are used to lookup values from the
2399 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2400 to select the group of existing pods which pods will be taken into consideration
2401 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2402 pod labels will be ignored. The default value is empty.
2403 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2404 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2405 items:
2406 type: string
2407 type: array
2408 x-kubernetes-list-type: atomic
2409 mismatchLabelKeys:
2410 description: |-
2411 MismatchLabelKeys is a set of pod label keys to select which pods will
2412 be taken into consideration. The keys are used to lookup values from the
2413 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2414 to select the group of existing pods which pods will be taken into consideration
2415 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2416 pod labels will be ignored. The default value is empty.
2417 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2418 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2419 items:
2420 type: string
2421 type: array
2422 x-kubernetes-list-type: atomic
2423 namespaceSelector:
2424 description: |-
2425 A label query over the set of namespaces that the term applies to.
2426 The term is applied to the union of the namespaces selected by this field
2427 and the ones listed in the namespaces field.
2428 null selector and null or empty namespaces list means "this pod's namespace".
2429 An empty selector ({}) matches all namespaces.
2430 properties:
2431 matchExpressions:
2432 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2433 items:
2434 description: |-
2435 A label selector requirement is a selector that contains values, a key, and an operator that
2436 relates the key and values.
2437 properties:
2438 key:
2439 description: key is the label key that the selector applies to.
2440 type: string
2441 operator:
2442 description: |-
2443 operator represents a key's relationship to a set of values.
2444 Valid operators are In, NotIn, Exists and DoesNotExist.
2445 type: string
2446 values:
2447 description: |-
2448 values is an array of string values. If the operator is In or NotIn,
2449 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2450 the values array must be empty. This array is replaced during a strategic
2451 merge patch.
2452 items:
2453 type: string
2454 type: array
2455 x-kubernetes-list-type: atomic
2456 required:
2457 - key
2458 - operator
2459 type: object
2460 type: array
2461 x-kubernetes-list-type: atomic
2462 matchLabels:
2463 additionalProperties:
2464 type: string
2465 description: |-
2466 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2467 map is equivalent to an element of matchExpressions, whose key field is "key", the
2468 operator is "In", and the values array contains only "value". The requirements are ANDed.
2469 type: object
2470 type: object
2471 x-kubernetes-map-type: atomic
2472 namespaces:
2473 description: |-
2474 namespaces specifies a static list of namespace names that the term applies to.
2475 The term is applied to the union of the namespaces listed in this field
2476 and the ones selected by namespaceSelector.
2477 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2478 items:
2479 type: string
2480 type: array
2481 x-kubernetes-list-type: atomic
2482 topologyKey:
2483 description: |-
2484 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2485 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2486 whose value of the label with key topologyKey matches that of any node on which any of the
2487 selected pods is running.
2488 Empty topologyKey is not allowed.
2489 type: string
2490 required:
2491 - topologyKey
2492 type: object
2493 weight:
2494 description: |-
2495 weight associated with matching the corresponding podAffinityTerm,
2496 in the range 1-100.
2497 format: int32
2498 type: integer
2499 required:
2500 - podAffinityTerm
2501 - weight
2502 type: object
2503 type: array
2504 x-kubernetes-list-type: atomic
2505 requiredDuringSchedulingIgnoredDuringExecution:
2506 description: |-
2507 If the affinity requirements specified by this field are not met at
2508 scheduling time, the pod will not be scheduled onto the node.
2509 If the affinity requirements specified by this field cease to be met
2510 at some point during pod execution (e.g. due to a pod label update), the
2511 system may or may not try to eventually evict the pod from its node.
2512 When there are multiple elements, the lists of nodes corresponding to each
2513 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2514 items:
2515 description: |-
2516 Defines a set of pods (namely those matching the labelSelector
2517 relative to the given namespace(s)) that this pod should be
2518 co-located (affinity) or not co-located (anti-affinity) with,
2519 where co-located is defined as running on a node whose value of
2520 the label with key <topologyKey> matches that of any node on which
2521 a pod of the set of pods is running
2522 properties:
2523 labelSelector:
2524 description: |-
2525 A label query over a set of resources, in this case pods.
2526 If it's null, this PodAffinityTerm matches with no Pods.
2527 properties:
2528 matchExpressions:
2529 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2530 items:
2531 description: |-
2532 A label selector requirement is a selector that contains values, a key, and an operator that
2533 relates the key and values.
2534 properties:
2535 key:
2536 description: key is the label key that the selector applies to.
2537 type: string
2538 operator:
2539 description: |-
2540 operator represents a key's relationship to a set of values.
2541 Valid operators are In, NotIn, Exists and DoesNotExist.
2542 type: string
2543 values:
2544 description: |-
2545 values is an array of string values. If the operator is In or NotIn,
2546 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2547 the values array must be empty. This array is replaced during a strategic
2548 merge patch.
2549 items:
2550 type: string
2551 type: array
2552 x-kubernetes-list-type: atomic
2553 required:
2554 - key
2555 - operator
2556 type: object
2557 type: array
2558 x-kubernetes-list-type: atomic
2559 matchLabels:
2560 additionalProperties:
2561 type: string
2562 description: |-
2563 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2564 map is equivalent to an element of matchExpressions, whose key field is "key", the
2565 operator is "In", and the values array contains only "value". The requirements are ANDed.
2566 type: object
2567 type: object
2568 x-kubernetes-map-type: atomic
2569 matchLabelKeys:
2570 description: |-
2571 MatchLabelKeys is a set of pod label keys to select which pods will
2572 be taken into consideration. The keys are used to lookup values from the
2573 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2574 to select the group of existing pods which pods will be taken into consideration
2575 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2576 pod labels will be ignored. The default value is empty.
2577 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2578 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2579 items:
2580 type: string
2581 type: array
2582 x-kubernetes-list-type: atomic
2583 mismatchLabelKeys:
2584 description: |-
2585 MismatchLabelKeys is a set of pod label keys to select which pods will
2586 be taken into consideration. The keys are used to lookup values from the
2587 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2588 to select the group of existing pods which pods will be taken into consideration
2589 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2590 pod labels will be ignored. The default value is empty.
2591 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2592 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2593 items:
2594 type: string
2595 type: array
2596 x-kubernetes-list-type: atomic
2597 namespaceSelector:
2598 description: |-
2599 A label query over the set of namespaces that the term applies to.
2600 The term is applied to the union of the namespaces selected by this field
2601 and the ones listed in the namespaces field.
2602 null selector and null or empty namespaces list means "this pod's namespace".
2603 An empty selector ({}) matches all namespaces.
2604 properties:
2605 matchExpressions:
2606 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2607 items:
2608 description: |-
2609 A label selector requirement is a selector that contains values, a key, and an operator that
2610 relates the key and values.
2611 properties:
2612 key:
2613 description: key is the label key that the selector applies to.
2614 type: string
2615 operator:
2616 description: |-
2617 operator represents a key's relationship to a set of values.
2618 Valid operators are In, NotIn, Exists and DoesNotExist.
2619 type: string
2620 values:
2621 description: |-
2622 values is an array of string values. If the operator is In or NotIn,
2623 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2624 the values array must be empty. This array is replaced during a strategic
2625 merge patch.
2626 items:
2627 type: string
2628 type: array
2629 x-kubernetes-list-type: atomic
2630 required:
2631 - key
2632 - operator
2633 type: object
2634 type: array
2635 x-kubernetes-list-type: atomic
2636 matchLabels:
2637 additionalProperties:
2638 type: string
2639 description: |-
2640 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2641 map is equivalent to an element of matchExpressions, whose key field is "key", the
2642 operator is "In", and the values array contains only "value". The requirements are ANDed.
2643 type: object
2644 type: object
2645 x-kubernetes-map-type: atomic
2646 namespaces:
2647 description: |-
2648 namespaces specifies a static list of namespace names that the term applies to.
2649 The term is applied to the union of the namespaces listed in this field
2650 and the ones selected by namespaceSelector.
2651 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2652 items:
2653 type: string
2654 type: array
2655 x-kubernetes-list-type: atomic
2656 topologyKey:
2657 description: |-
2658 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2659 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2660 whose value of the label with key topologyKey matches that of any node on which any of the
2661 selected pods is running.
2662 Empty topologyKey is not allowed.
2663 type: string
2664 required:
2665 - topologyKey
2666 type: object
2667 type: array
2668 x-kubernetes-list-type: atomic
2669 type: object
2670 podAntiAffinity:
2671 description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
2672 properties:
2673 preferredDuringSchedulingIgnoredDuringExecution:
2674 description: |-
2675 The scheduler will prefer to schedule pods to nodes that satisfy
2676 the anti-affinity expressions specified by this field, but it may choose
2677 a node that violates one or more of the expressions. The node that is
2678 most preferred is the one with the greatest sum of weights, i.e.
2679 for each node that meets all of the scheduling requirements (resource
2680 request, requiredDuringScheduling anti-affinity expressions, etc.),
2681 compute a sum by iterating through the elements of this field and subtracting
2682 "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
2683 node(s) with the highest sum are the most preferred.
2684 items:
2685 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
2686 properties:
2687 podAffinityTerm:
2688 description: Required. A pod affinity term, associated with the corresponding weight.
2689 properties:
2690 labelSelector:
2691 description: |-
2692 A label query over a set of resources, in this case pods.
2693 If it's null, this PodAffinityTerm matches with no Pods.
2694 properties:
2695 matchExpressions:
2696 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2697 items:
2698 description: |-
2699 A label selector requirement is a selector that contains values, a key, and an operator that
2700 relates the key and values.
2701 properties:
2702 key:
2703 description: key is the label key that the selector applies to.
2704 type: string
2705 operator:
2706 description: |-
2707 operator represents a key's relationship to a set of values.
2708 Valid operators are In, NotIn, Exists and DoesNotExist.
2709 type: string
2710 values:
2711 description: |-
2712 values is an array of string values. If the operator is In or NotIn,
2713 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2714 the values array must be empty. This array is replaced during a strategic
2715 merge patch.
2716 items:
2717 type: string
2718 type: array
2719 x-kubernetes-list-type: atomic
2720 required:
2721 - key
2722 - operator
2723 type: object
2724 type: array
2725 x-kubernetes-list-type: atomic
2726 matchLabels:
2727 additionalProperties:
2728 type: string
2729 description: |-
2730 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2731 map is equivalent to an element of matchExpressions, whose key field is "key", the
2732 operator is "In", and the values array contains only "value". The requirements are ANDed.
2733 type: object
2734 type: object
2735 x-kubernetes-map-type: atomic
2736 matchLabelKeys:
2737 description: |-
2738 MatchLabelKeys is a set of pod label keys to select which pods will
2739 be taken into consideration. The keys are used to lookup values from the
2740 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2741 to select the group of existing pods which pods will be taken into consideration
2742 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2743 pod labels will be ignored. The default value is empty.
2744 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2745 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2746 items:
2747 type: string
2748 type: array
2749 x-kubernetes-list-type: atomic
2750 mismatchLabelKeys:
2751 description: |-
2752 MismatchLabelKeys is a set of pod label keys to select which pods will
2753 be taken into consideration. The keys are used to lookup values from the
2754 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2755 to select the group of existing pods which pods will be taken into consideration
2756 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2757 pod labels will be ignored. The default value is empty.
2758 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2759 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2760 items:
2761 type: string
2762 type: array
2763 x-kubernetes-list-type: atomic
2764 namespaceSelector:
2765 description: |-
2766 A label query over the set of namespaces that the term applies to.
2767 The term is applied to the union of the namespaces selected by this field
2768 and the ones listed in the namespaces field.
2769 null selector and null or empty namespaces list means "this pod's namespace".
2770 An empty selector ({}) matches all namespaces.
2771 properties:
2772 matchExpressions:
2773 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2774 items:
2775 description: |-
2776 A label selector requirement is a selector that contains values, a key, and an operator that
2777 relates the key and values.
2778 properties:
2779 key:
2780 description: key is the label key that the selector applies to.
2781 type: string
2782 operator:
2783 description: |-
2784 operator represents a key's relationship to a set of values.
2785 Valid operators are In, NotIn, Exists and DoesNotExist.
2786 type: string
2787 values:
2788 description: |-
2789 values is an array of string values. If the operator is In or NotIn,
2790 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2791 the values array must be empty. This array is replaced during a strategic
2792 merge patch.
2793 items:
2794 type: string
2795 type: array
2796 x-kubernetes-list-type: atomic
2797 required:
2798 - key
2799 - operator
2800 type: object
2801 type: array
2802 x-kubernetes-list-type: atomic
2803 matchLabels:
2804 additionalProperties:
2805 type: string
2806 description: |-
2807 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2808 map is equivalent to an element of matchExpressions, whose key field is "key", the
2809 operator is "In", and the values array contains only "value". The requirements are ANDed.
2810 type: object
2811 type: object
2812 x-kubernetes-map-type: atomic
2813 namespaces:
2814 description: |-
2815 namespaces specifies a static list of namespace names that the term applies to.
2816 The term is applied to the union of the namespaces listed in this field
2817 and the ones selected by namespaceSelector.
2818 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2819 items:
2820 type: string
2821 type: array
2822 x-kubernetes-list-type: atomic
2823 topologyKey:
2824 description: |-
2825 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
2826 the labelSelector in the specified namespaces, where co-located is defined as running on a node
2827 whose value of the label with key topologyKey matches that of any node on which any of the
2828 selected pods is running.
2829 Empty topologyKey is not allowed.
2830 type: string
2831 required:
2832 - topologyKey
2833 type: object
2834 weight:
2835 description: |-
2836 weight associated with matching the corresponding podAffinityTerm,
2837 in the range 1-100.
2838 format: int32
2839 type: integer
2840 required:
2841 - podAffinityTerm
2842 - weight
2843 type: object
2844 type: array
2845 x-kubernetes-list-type: atomic
2846 requiredDuringSchedulingIgnoredDuringExecution:
2847 description: |-
2848 If the anti-affinity requirements specified by this field are not met at
2849 scheduling time, the pod will not be scheduled onto the node.
2850 If the anti-affinity requirements specified by this field cease to be met
2851 at some point during pod execution (e.g. due to a pod label update), the
2852 system may or may not try to eventually evict the pod from its node.
2853 When there are multiple elements, the lists of nodes corresponding to each
2854 podAffinityTerm are intersected, i.e. all terms must be satisfied.
2855 items:
2856 description: |-
2857 Defines a set of pods (namely those matching the labelSelector
2858 relative to the given namespace(s)) that this pod should be
2859 co-located (affinity) or not co-located (anti-affinity) with,
2860 where co-located is defined as running on a node whose value of
2861 the label with key <topologyKey> matches that of any node on which
2862 a pod of the set of pods is running
2863 properties:
2864 labelSelector:
2865 description: |-
2866 A label query over a set of resources, in this case pods.
2867 If it's null, this PodAffinityTerm matches with no Pods.
2868 properties:
2869 matchExpressions:
2870 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2871 items:
2872 description: |-
2873 A label selector requirement is a selector that contains values, a key, and an operator that
2874 relates the key and values.
2875 properties:
2876 key:
2877 description: key is the label key that the selector applies to.
2878 type: string
2879 operator:
2880 description: |-
2881 operator represents a key's relationship to a set of values.
2882 Valid operators are In, NotIn, Exists and DoesNotExist.
2883 type: string
2884 values:
2885 description: |-
2886 values is an array of string values. If the operator is In or NotIn,
2887 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2888 the values array must be empty. This array is replaced during a strategic
2889 merge patch.
2890 items:
2891 type: string
2892 type: array
2893 x-kubernetes-list-type: atomic
2894 required:
2895 - key
2896 - operator
2897 type: object
2898 type: array
2899 x-kubernetes-list-type: atomic
2900 matchLabels:
2901 additionalProperties:
2902 type: string
2903 description: |-
2904 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2905 map is equivalent to an element of matchExpressions, whose key field is "key", the
2906 operator is "In", and the values array contains only "value". The requirements are ANDed.
2907 type: object
2908 type: object
2909 x-kubernetes-map-type: atomic
2910 matchLabelKeys:
2911 description: |-
2912 MatchLabelKeys is a set of pod label keys to select which pods will
2913 be taken into consideration. The keys are used to lookup values from the
2914 incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
2915 to select the group of existing pods which pods will be taken into consideration
2916 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2917 pod labels will be ignored. The default value is empty.
2918 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
2919 Also, matchLabelKeys cannot be set when labelSelector isn't set.
2920 items:
2921 type: string
2922 type: array
2923 x-kubernetes-list-type: atomic
2924 mismatchLabelKeys:
2925 description: |-
2926 MismatchLabelKeys is a set of pod label keys to select which pods will
2927 be taken into consideration. The keys are used to lookup values from the
2928 incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
2929 to select the group of existing pods which pods will be taken into consideration
2930 for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
2931 pod labels will be ignored. The default value is empty.
2932 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
2933 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
2934 items:
2935 type: string
2936 type: array
2937 x-kubernetes-list-type: atomic
2938 namespaceSelector:
2939 description: |-
2940 A label query over the set of namespaces that the term applies to.
2941 The term is applied to the union of the namespaces selected by this field
2942 and the ones listed in the namespaces field.
2943 null selector and null or empty namespaces list means "this pod's namespace".
2944 An empty selector ({}) matches all namespaces.
2945 properties:
2946 matchExpressions:
2947 description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
2948 items:
2949 description: |-
2950 A label selector requirement is a selector that contains values, a key, and an operator that
2951 relates the key and values.
2952 properties:
2953 key:
2954 description: key is the label key that the selector applies to.
2955 type: string
2956 operator:
2957 description: |-
2958 operator represents a key's relationship to a set of values.
2959 Valid operators are In, NotIn, Exists and DoesNotExist.
2960 type: string
2961 values:
2962 description: |-
2963 values is an array of string values. If the operator is In or NotIn,
2964 the values array must be non-empty. If the operator is Exists or DoesNotExist,
2965 the values array must be empty. This array is replaced during a strategic
2966 merge patch.
2967 items:
2968 type: string
2969 type: array
2970 x-kubernetes-list-type: atomic
2971 required:
2972 - key
2973 - operator
2974 type: object
2975 type: array
2976 x-kubernetes-list-type: atomic
2977 matchLabels:
2978 additionalProperties:
2979 type: string
2980 description: |-
2981 matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2982 map is equivalent to an element of matchExpressions, whose key field is "key", the
2983 operator is "In", and the values array contains only "value". The requirements are ANDed.
2984 type: object
2985 type: object
2986 x-kubernetes-map-type: atomic
2987 namespaces:
2988 description: |-
2989 namespaces specifies a static list of namespace names that the term applies to.
2990 The term is applied to the union of the namespaces listed in this field
2991 and the ones selected by namespaceSelector.
2992 null or empty namespaces list and null namespaceSelector means "this pod's namespace".
2993 items:
2994 type: string
2995 type: array
2996 x-kubernetes-list-type: atomic
2997 topologyKey:
2998 description: |-
2999 This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
3000 the labelSelector in the specified namespaces, where co-located is defined as running on a node
3001 whose value of the label with key topologyKey matches that of any node on which any of the
3002 selected pods is running.
3003 Empty topologyKey is not allowed.
3004 type: string
3005 required:
3006 - topologyKey
3007 type: object
3008 type: array
3009 x-kubernetes-list-type: atomic
3010 type: object
3011 type: object
3012 imagePullSecrets:
3013 description: If specified, the pod's imagePullSecrets
3014 items:
3015 description: |-
3016 LocalObjectReference contains enough information to let you locate the
3017 referenced object inside the same namespace.
3018 properties:
3019 name:
3020 default: ""
3021 description: |-
3022 Name of the referent.
3023 This field is effectively required, but due to backwards compatibility is
3024 allowed to be empty. Instances of this type with an empty value here are
3025 almost certainly wrong.
3026 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3027 type: string
3028 type: object
3029 x-kubernetes-map-type: atomic
3030 type: array
3031 x-kubernetes-list-map-keys:
3032 - name
3033 x-kubernetes-list-type: map
3034 nodeSelector:
3035 additionalProperties:
3036 type: string
3037 description: |-
3038 NodeSelector is a selector which must be true for the pod to fit on a node.
3039 Selector which must match a node's labels for the pod to be scheduled on that node.
3040 More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
3041 type: object
3042 priorityClassName:
3043 description: If specified, the pod's priorityClassName.
3044 type: string
3045 resources:
3046 description: |-
3047 If specified, the pod's resource requirements.
3048 These values override the global resource configuration flags.
3049 Note that when only specifying resource limits, ensure they are greater than or equal
3050 to the corresponding global resource requests configured via controller flags
3051 (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
3052 Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
3053 properties:
3054 limits:
3055 additionalProperties:
3056 anyOf:
3057 - type: integer
3058 - type: string
3059 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3060 x-kubernetes-int-or-string: true
3061 description: |-
3062 Limits describes the maximum amount of compute resources allowed.
3063 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3064 type: object
3065 requests:
3066 additionalProperties:
3067 anyOf:
3068 - type: integer
3069 - type: string
3070 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3071 x-kubernetes-int-or-string: true
3072 description: |-
3073 Requests describes the minimum amount of compute resources required.
3074 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
3075 otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
3076 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
3077 type: object
3078 type: object
3079 securityContext:
3080 description: If specified, the pod's security context
3081 properties:
3082 fsGroup:
3083 description: |-
3084 A special supplemental group that applies to all containers in a pod.
3085 Some volume types allow the Kubelet to change the ownership of that volume
3086 to be owned by the pod:
3087
3088 1. The owning GID will be the FSGroup
3089 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3090 3. The permission bits are OR'd with rw-rw----
3091
3092 If unset, the Kubelet will not modify the ownership and permissions of any volume.
3093 Note that this field cannot be set when spec.os.name is windows.
3094 format: int64
3095 type: integer
3096 fsGroupChangePolicy:
3097 description: |-
3098 fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
3099 before being exposed inside Pod. This field will only apply to
3100 volume types which support fsGroup based ownership(and permissions).
3101 It will have no effect on ephemeral volume types such as: secret, configmaps
3102 and emptydir.
3103 Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
3104 Note that this field cannot be set when spec.os.name is windows.
3105 type: string
3106 runAsGroup:
3107 description: |-
3108 The GID to run the entrypoint of the container process.
3109 Uses runtime default if unset.
3110 May also be set in SecurityContext. If set in both SecurityContext and
3111 PodSecurityContext, the value specified in SecurityContext takes precedence
3112 for that container.
3113 Note that this field cannot be set when spec.os.name is windows.
3114 format: int64
3115 type: integer
3116 runAsNonRoot:
3117 description: |-
3118 Indicates that the container must run as a non-root user.
3119 If true, the Kubelet will validate the image at runtime to ensure that it
3120 does not run as UID 0 (root) and fail to start the container if it does.
3121 If unset or false, no such validation will be performed.
3122 May also be set in SecurityContext. If set in both SecurityContext and
3123 PodSecurityContext, the value specified in SecurityContext takes precedence.
3124 type: boolean
3125 runAsUser:
3126 description: |-
3127 The UID to run the entrypoint of the container process.
3128 Defaults to user specified in image metadata if unspecified.
3129 May also be set in SecurityContext. If set in both SecurityContext and
3130 PodSecurityContext, the value specified in SecurityContext takes precedence
3131 for that container.
3132 Note that this field cannot be set when spec.os.name is windows.
3133 format: int64
3134 type: integer
3135 seLinuxOptions:
3136 description: |-
3137 The SELinux context to be applied to all containers.
3138 If unspecified, the container runtime will allocate a random SELinux context for each
3139 container. May also be set in SecurityContext. If set in
3140 both SecurityContext and PodSecurityContext, the value specified in SecurityContext
3141 takes precedence for that container.
3142 Note that this field cannot be set when spec.os.name is windows.
3143 properties:
3144 level:
3145 description: Level is SELinux level label that applies to the container.
3146 type: string
3147 role:
3148 description: Role is a SELinux role label that applies to the container.
3149 type: string
3150 type:
3151 description: Type is a SELinux type label that applies to the container.
3152 type: string
3153 user:
3154 description: User is a SELinux user label that applies to the container.
3155 type: string
3156 type: object
3157 seccompProfile:
3158 description: |-
3159 The seccomp options to use by the containers in this pod.
3160 Note that this field cannot be set when spec.os.name is windows.
3161 properties:
3162 localhostProfile:
3163 description: |-
3164 localhostProfile indicates a profile defined in a file on the node should be used.
3165 The profile must be preconfigured on the node to work.
3166 Must be a descending path, relative to the kubelet's configured seccomp profile location.
3167 Must be set if type is "Localhost". Must NOT be set for any other type.
3168 type: string
3169 type:
3170 description: |-
3171 type indicates which kind of seccomp profile will be applied.
3172 Valid options are:
3173
3174 Localhost - a profile defined in a file on the node should be used.
3175 RuntimeDefault - the container runtime default profile should be used.
3176 Unconfined - no profile should be applied.
3177 type: string
3178 required:
3179 - type
3180 type: object
3181 supplementalGroups:
3182 description: |-
3183 A list of groups applied to the first process run in each container, in addition
3184 to the container's primary GID, the fsGroup (if specified), and group memberships
3185 defined in the container image for the uid of the container process. If unspecified,
3186 no additional groups are added to any container. Note that group memberships
3187 defined in the container image for the uid of the container process are still effective,
3188 even if they are not included in this list.
3189 Note that this field cannot be set when spec.os.name is windows.
3190 items:
3191 format: int64
3192 type: integer
3193 type: array
3194 x-kubernetes-list-type: atomic
3195 sysctls:
3196 description: |-
3197 Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
3198 sysctls (by the container runtime) might fail to launch.
3199 Note that this field cannot be set when spec.os.name is windows.
3200 items:
3201 description: Sysctl defines a kernel parameter to be set
3202 properties:
3203 name:
3204 description: Name of a property to set
3205 type: string
3206 value:
3207 description: Value of a property to set
3208 type: string
3209 required:
3210 - name
3211 - value
3212 type: object
3213 type: array
3214 x-kubernetes-list-type: atomic
3215 type: object
3216 serviceAccountName:
3217 description: If specified, the pod's service account
3218 type: string
3219 tolerations:
3220 description: If specified, the pod's tolerations.
3221 items:
3222 description: |-
3223 The pod this Toleration is attached to tolerates any taint that matches
3224 the triple <key,value,effect> using the matching operator <operator>.
3225 properties:
3226 effect:
3227 description: |-
3228 Effect indicates the taint effect to match. Empty means match all taint effects.
3229 When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
3230 type: string
3231 key:
3232 description: |-
3233 Key is the taint key that the toleration applies to. Empty means match all taint keys.
3234 If the key is empty, operator must be Exists; this combination means to match all values and all keys.
3235 type: string
3236 operator:
3237 description: |-
3238 Operator represents a key's relationship to the value.
3239 Valid operators are Exists and Equal. Defaults to Equal.
3240 Exists is equivalent to wildcard for value, so that a pod can
3241 tolerate all taints of a particular category.
3242 type: string
3243 tolerationSeconds:
3244 description: |-
3245 TolerationSeconds represents the period of time the toleration (which must be
3246 of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
3247 it is not set, which means tolerate the taint forever (do not evict). Zero and
3248 negative values will be treated as 0 (evict immediately) by the system.
3249 format: int64
3250 type: integer
3251 value:
3252 description: |-
3253 Value is the taint value the toleration matches to.
3254 If the operator is Exists, the value should be empty, otherwise just a regular string.
3255 type: string
3256 type: object
3257 type: array
3258 x-kubernetes-list-type: atomic
3259 type: object
3260 type: object
3261 serviceType:
3262 description: |-
3263 Optional service type for Kubernetes solver service. Supported values
3264 are NodePort or ClusterIP. If unset, defaults to NodePort.
3265 type: string
3266 type: object
3267 type: object
3268 selector:
3269 description: |-
3270 Selector selects a set of DNSNames on the Certificate resource that
3271 should be solved using this challenge solver.
3272 If not specified, the solver will be treated as the 'default' solver
3273 with the lowest priority, i.e. if any other solver has a more specific
3274 match, it will be used instead.
3275 properties:
3276 dnsNames:
3277 description: |-
3278 List of DNSNames that this solver will be used to solve.
3279 If specified and a match is found, a dnsNames selector will take
3280 precedence over a dnsZones selector.
3281 If multiple solvers match with the same dnsNames value, the solver
3282 with the most matching labels in matchLabels will be selected.
3283 If neither has more matches, the solver defined earlier in the list
3284 will be selected.
3285 items:
3286 type: string
3287 type: array
3288 x-kubernetes-list-type: atomic
3289 dnsZones:
3290 description: |-
3291 List of DNSZones that this solver will be used to solve.
3292 The most specific DNS zone match specified here will take precedence
3293 over other DNS zone matches, so a solver specifying sys.example.com
3294 will be selected over one specifying example.com for the domain
3295 www.sys.example.com.
3296 If multiple solvers match with the same dnsZones value, the solver
3297 with the most matching labels in matchLabels will be selected.
3298 If neither has more matches, the solver defined earlier in the list
3299 will be selected.
3300 items:
3301 type: string
3302 type: array
3303 x-kubernetes-list-type: atomic
3304 matchLabels:
3305 additionalProperties:
3306 type: string
3307 description: |-
3308 A label selector that is used to refine the set of certificate's that
3309 this challenge solver will apply to.
3310 type: object
3311 type: object
3312 type: object
3313 type: array
3314 x-kubernetes-list-type: atomic
3315 required:
3316 - privateKeySecretRef
3317 - server
3318 type: object
3319 ca:
3320 description: |-
3321 CA configures this issuer to sign certificates using a signing CA keypair
3322 stored in a Secret resource.
3323 This is used to build internal PKIs that are managed by cert-manager.
3324 properties:
3325 crlDistributionPoints:
3326 description: |-
3327 The CRL distribution points is an X.509 v3 certificate extension which identifies
3328 the location of the CRL from which the revocation of this certificate can be checked.
3329 If not set, certificates will be issued without distribution points set.
3330 items:
3331 type: string
3332 type: array
3333 x-kubernetes-list-type: atomic
3334 issuingCertificateURLs:
3335 description: |-
3336 IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
3337 it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
3338 As an example, such a URL might be "http://ca.domain.com/ca.crt".
3339 items:
3340 type: string
3341 type: array
3342 x-kubernetes-list-type: atomic
3343 ocspServers:
3344 description: |-
3345 The OCSP server list is an X.509 v3 extension that defines a list of
3346 URLs of OCSP responders. The OCSP responders can be queried for the
3347 revocation status of an issued certificate. If not set, the
3348 certificate will be issued with no OCSP servers set. For example, an
3349 OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
3350 items:
3351 type: string
3352 type: array
3353 x-kubernetes-list-type: atomic
3354 secretName:
3355 description: |-
3356 SecretName is the name of the secret used to sign Certificates issued
3357 by this Issuer.
3358 type: string
3359 required:
3360 - secretName
3361 type: object
3362 selfSigned:
3363 description: |-
3364 SelfSigned configures this issuer to 'self sign' certificates using the
3365 private key used to create the CertificateRequest object.
3366 properties:
3367 crlDistributionPoints:
3368 description: |-
3369 The CRL distribution points is an X.509 v3 certificate extension which identifies
3370 the location of the CRL from which the revocation of this certificate can be checked.
3371 If not set certificate will be issued without CDP. Values are strings.
3372 items:
3373 type: string
3374 type: array
3375 x-kubernetes-list-type: atomic
3376 type: object
3377 vault:
3378 description: |-
3379 Vault configures this issuer to sign certificates using a HashiCorp Vault
3380 PKI backend.
3381 properties:
3382 auth:
3383 description: Auth configures how cert-manager authenticates with the Vault server.
3384 properties:
3385 appRole:
3386 description: |-
3387 AppRole authenticates with Vault using the App Role auth mechanism,
3388 with the role and secret stored in a Kubernetes Secret resource.
3389 properties:
3390 path:
3391 description: |-
3392 Path where the App Role authentication backend is mounted in Vault, e.g:
3393 "approle"
3394 type: string
3395 roleId:
3396 description: |-
3397 RoleID configured in the App Role authentication backend when setting
3398 up the authentication backend in Vault.
3399 type: string
3400 secretRef:
3401 description: |-
3402 Reference to a key in a Secret that contains the App Role secret used
3403 to authenticate with Vault.
3404 The `key` field must be specified and denotes which entry within the Secret
3405 resource is used as the app role secret.
3406 properties:
3407 key:
3408 description: |-
3409 The key of the entry in the Secret resource's `data` field to be used.
3410 Some instances of this field may be defaulted, in others it may be
3411 required.
3412 type: string
3413 name:
3414 description: |-
3415 Name of the resource being referred to.
3416 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3417 type: string
3418 required:
3419 - name
3420 type: object
3421 required:
3422 - path
3423 - roleId
3424 - secretRef
3425 type: object
3426 clientCertificate:
3427 description: |-
3428 ClientCertificate authenticates with Vault by presenting a client
3429 certificate during the request's TLS handshake.
3430 Works only when using HTTPS protocol.
3431 properties:
3432 mountPath:
3433 description: |-
3434 The Vault mountPath here is the mount path to use when authenticating with
3435 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3436 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3437 default value "/v1/auth/cert" will be used.
3438 type: string
3439 name:
3440 description: |-
3441 Name of the certificate role to authenticate against.
3442 If not set, matching any certificate role, if available.
3443 type: string
3444 secretName:
3445 description: |-
3446 Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
3447 tls.crt and tls.key) used to authenticate to Vault using TLS client
3448 authentication.
3449 type: string
3450 type: object
3451 kubernetes:
3452 description: |-
3453 Kubernetes authenticates with Vault by passing the ServiceAccount
3454 token stored in the named Secret resource to the Vault server.
3455 properties:
3456 mountPath:
3457 description: |-
3458 The Vault mountPath here is the mount path to use when authenticating with
3459 Vault. For example, setting a value to `/v1/auth/foo`, will use the path
3460 `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
3461 default value "/v1/auth/kubernetes" will be used.
3462 type: string
3463 role:
3464 description: |-
3465 A required field containing the Vault Role to assume. A Role binds a
3466 Kubernetes ServiceAccount with a set of Vault policies.
3467 type: string
3468 secretRef:
3469 description: |-
3470 The required Secret field containing a Kubernetes ServiceAccount JWT used
3471 for authenticating with Vault. Use of 'ambient credentials' is not
3472 supported.
3473 properties:
3474 key:
3475 description: |-
3476 The key of the entry in the Secret resource's `data` field to be used.
3477 Some instances of this field may be defaulted, in others it may be
3478 required.
3479 type: string
3480 name:
3481 description: |-
3482 Name of the resource being referred to.
3483 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3484 type: string
3485 required:
3486 - name
3487 type: object
3488 serviceAccountRef:
3489 description: |-
3490 A reference to a service account that will be used to request a bound
3491 token (also known as "projected token"). Compared to using "secretRef",
3492 using this field means that you don't rely on statically bound tokens. To
3493 use this field, you must configure an RBAC rule to let cert-manager
3494 request a token.
3495 properties:
3496 audiences:
3497 description: |-
3498 TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
3499 consisting of the issuer's namespace and name is always included.
3500 items:
3501 type: string
3502 type: array
3503 x-kubernetes-list-type: atomic
3504 name:
3505 description: Name of the ServiceAccount used to request a token.
3506 type: string
3507 required:
3508 - name
3509 type: object
3510 required:
3511 - role
3512 type: object
3513 tokenSecretRef:
3514 description: TokenSecretRef authenticates with Vault by presenting a token.
3515 properties:
3516 key:
3517 description: |-
3518 The key of the entry in the Secret resource's `data` field to be used.
3519 Some instances of this field may be defaulted, in others it may be
3520 required.
3521 type: string
3522 name:
3523 description: |-
3524 Name of the resource being referred to.
3525 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3526 type: string
3527 required:
3528 - name
3529 type: object
3530 type: object
3531 caBundle:
3532 description: |-
3533 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3534 chain presented by Vault. Only used if using HTTPS to connect to Vault and
3535 ignored for HTTP connections.
3536 Mutually exclusive with CABundleSecretRef.
3537 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3538 the cert-manager controller container is used to validate the TLS connection.
3539 format: byte
3540 type: string
3541 caBundleSecretRef:
3542 description: |-
3543 Reference to a Secret containing a bundle of PEM-encoded CAs to use when
3544 verifying the certificate chain presented by Vault when using HTTPS.
3545 Mutually exclusive with CABundle.
3546 If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
3547 the cert-manager controller container is used to validate the TLS connection.
3548 If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
3549 properties:
3550 key:
3551 description: |-
3552 The key of the entry in the Secret resource's `data` field to be used.
3553 Some instances of this field may be defaulted, in others it may be
3554 required.
3555 type: string
3556 name:
3557 description: |-
3558 Name of the resource being referred to.
3559 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3560 type: string
3561 required:
3562 - name
3563 type: object
3564 clientCertSecretRef:
3565 description: |-
3566 Reference to a Secret containing a PEM-encoded Client Certificate to use when the
3567 Vault server requires mTLS.
3568 properties:
3569 key:
3570 description: |-
3571 The key of the entry in the Secret resource's `data` field to be used.
3572 Some instances of this field may be defaulted, in others it may be
3573 required.
3574 type: string
3575 name:
3576 description: |-
3577 Name of the resource being referred to.
3578 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3579 type: string
3580 required:
3581 - name
3582 type: object
3583 clientKeySecretRef:
3584 description: |-
3585 Reference to a Secret containing a PEM-encoded Client Private Key to use when the
3586 Vault server requires mTLS.
3587 properties:
3588 key:
3589 description: |-
3590 The key of the entry in the Secret resource's `data` field to be used.
3591 Some instances of this field may be defaulted, in others it may be
3592 required.
3593 type: string
3594 name:
3595 description: |-
3596 Name of the resource being referred to.
3597 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3598 type: string
3599 required:
3600 - name
3601 type: object
3602 namespace:
3603 description: |-
3604 Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
3605 More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
3606 type: string
3607 path:
3608 description: |-
3609 Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
3610 "my_pki_mount/sign/my-role-name".
3611 type: string
3612 server:
3613 description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
3614 type: string
3615 serverName:
3616 description: |-
3617 ServerName is used to verify the hostname on the returned certificates
3618 by the Vault server.
3619 type: string
3620 required:
3621 - auth
3622 - path
3623 - server
3624 type: object
3625 venafi:
3626 description: |-
3627 Venafi configures this issuer to sign certificates using a Venafi TPP
3628 or Venafi Cloud policy zone.
3629 properties:
3630 cloud:
3631 description: |-
3632 Cloud specifies the Venafi cloud configuration settings.
3633 Only one of TPP or Cloud may be specified.
3634 properties:
3635 apiTokenSecretRef:
3636 description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
3637 properties:
3638 key:
3639 description: |-
3640 The key of the entry in the Secret resource's `data` field to be used.
3641 Some instances of this field may be defaulted, in others it may be
3642 required.
3643 type: string
3644 name:
3645 description: |-
3646 Name of the resource being referred to.
3647 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3648 type: string
3649 required:
3650 - name
3651 type: object
3652 url:
3653 description: |-
3654 URL is the base URL for Venafi Cloud.
3655 Defaults to "https://api.venafi.cloud/".
3656 type: string
3657 required:
3658 - apiTokenSecretRef
3659 type: object
3660 tpp:
3661 description: |-
3662 TPP specifies Trust Protection Platform configuration settings.
3663 Only one of TPP or Cloud may be specified.
3664 properties:
3665 caBundle:
3666 description: |-
3667 Base64-encoded bundle of PEM CAs which will be used to validate the certificate
3668 chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
3669 If undefined, the certificate bundle in the cert-manager controller container
3670 is used to validate the chain.
3671 format: byte
3672 type: string
3673 caBundleSecretRef:
3674 description: |-
3675 Reference to a Secret containing a base64-encoded bundle of PEM CAs
3676 which will be used to validate the certificate chain presented by the TPP server.
3677 Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
3678 If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
3679 the cert-manager controller container is used to validate the TLS connection.
3680 properties:
3681 key:
3682 description: |-
3683 The key of the entry in the Secret resource's `data` field to be used.
3684 Some instances of this field may be defaulted, in others it may be
3685 required.
3686 type: string
3687 name:
3688 description: |-
3689 Name of the resource being referred to.
3690 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3691 type: string
3692 required:
3693 - name
3694 type: object
3695 credentialsRef:
3696 description: |-
3697 CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
3698 The secret must contain the key 'access-token' for the Access Token Authentication,
3699 or two keys, 'username' and 'password' for the API Keys Authentication.
3700 properties:
3701 name:
3702 description: |-
3703 Name of the resource being referred to.
3704 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3705 type: string
3706 required:
3707 - name
3708 type: object
3709 url:
3710 description: |-
3711 URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
3712 for example: "https://tpp.example.com/vedsdk".
3713 type: string
3714 required:
3715 - credentialsRef
3716 - url
3717 type: object
3718 zone:
3719 description: |-
3720 Zone is the Venafi Policy Zone to use for this issuer.
3721 All requests made to the Venafi platform will be restricted by the named
3722 zone policy.
3723 This field is required.
3724 type: string
3725 required:
3726 - zone
3727 type: object
3728 type: object
3729 status:
3730 description: Status of the Issuer. This is set and managed automatically.
3731 properties:
3732 acme:
3733 description: |-
3734 ACME specific status options.
3735 This field should only be set if the Issuer is configured to use an ACME
3736 server to issue certificates.
3737 properties:
3738 lastPrivateKeyHash:
3739 description: |-
3740 LastPrivateKeyHash is a hash of the private key associated with the latest
3741 registered ACME account, in order to track changes made to registered account
3742 associated with the Issuer
3743 type: string
3744 lastRegisteredEmail:
3745 description: |-
3746 LastRegisteredEmail is the email associated with the latest registered
3747 ACME account, in order to track changes made to registered account
3748 associated with the Issuer
3749 type: string
3750 uri:
3751 description: |-
3752 URI is the unique account identifier, which can also be used to retrieve
3753 account details from the CA
3754 type: string
3755 type: object
3756 conditions:
3757 description: |-
3758 List of status conditions to indicate the status of a CertificateRequest.
3759 Known condition types are `Ready`.
3760 items:
3761 description: IssuerCondition contains condition information for an Issuer.
3762 properties:
3763 lastTransitionTime:
3764 description: |-
3765 LastTransitionTime is the timestamp corresponding to the last status
3766 change of this condition.
3767 format: date-time
3768 type: string
3769 message:
3770 description: |-
3771 Message is a human readable description of the details of the last
3772 transition, complementing reason.
3773 type: string
3774 observedGeneration:
3775 description: |-
3776 If set, this represents the .metadata.generation that the condition was
3777 set based upon.
3778 For instance, if .metadata.generation is currently 12, but the
3779 .status.condition[x].observedGeneration is 9, the condition is out of date
3780 with respect to the current state of the Issuer.
3781 format: int64
3782 type: integer
3783 reason:
3784 description: |-
3785 Reason is a brief machine readable explanation for the condition's last
3786 transition.
3787 type: string
3788 status:
3789 description: Status of the condition, one of (`True`, `False`, `Unknown`).
3790 enum:
3791 - "True"
3792 - "False"
3793 - Unknown
3794 type: string
3795 type:
3796 description: Type of the condition, known values are (`Ready`).
3797 type: string
3798 required:
3799 - status
3800 - type
3801 type: object
3802 type: array
3803 x-kubernetes-list-map-keys:
3804 - type
3805 x-kubernetes-list-type: map
3806 type: object
3807 required:
3808 - spec
3809 type: object
3810 served: true
3811 storage: true
3812 subresources:
3813 status: {}
3814{{- end }}