diff --git a/cmd/capi-controllers/main.go b/cmd/capi-controllers/main.go index fe2f76449d..a8d6054d5c 100644 --- a/cmd/capi-controllers/main.go +++ b/cmd/capi-controllers/main.go @@ -14,11 +14,14 @@ package main import ( + "context" "errors" "flag" + "fmt" "os" "time" + "github.com/go-logr/logr" metal3v1 "github.com/metal3-io/cluster-api-provider-metal3/api/v1beta1" admissionregistrationv1 "k8s.io/api/admissionregistration/v1" @@ -27,7 +30,6 @@ import ( "k8s.io/apimachinery/pkg/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime" clientgoscheme "k8s.io/client-go/kubernetes/scheme" - klog "k8s.io/klog/v2" awsv1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2" azurev1 "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1" @@ -87,128 +89,131 @@ func initScheme(scheme *runtime.Scheme) { } func main() { + cfg := ctrl.GetConfigOrDie() + ctx := ctrl.SetupSignalHandler() scheme := runtime.NewScheme() initScheme(scheme) - opts := commoncmdoptions.InitCommonOptions(managerName, controllers.DefaultCAPINamespace) - - webhookPort := flag.Int( + extraflags := flag.NewFlagSet("", flag.ContinueOnError) + webhookPort := extraflags.Int( "webhook-port", 9443, "The port for the webhook server to listen on.", ) - webhookCertDir := flag.String( + webhookCertDir := extraflags.String( "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/", "Webhook cert dir, only used when webhook-port is specified.", ) - opts.Parse() - - cacheOpts := getDefaultCacheOptions(*opts.CAPINamespace, 10*time.Minute) - - cfg := ctrl.GetConfigOrDie() - ctx := ctrl.SetupSignalHandler() + log, operatorConfig, mgrOpts, initManager, err := commoncmdoptions.InitOperatorConfig(ctx, cfg, scheme, managerName, controllers.DefaultCAPINamespace, extraflags) + if err != nil { + log.Error(err, "unable to initialize operator config") + os.Exit(1) + } - mgrOpts, tlsOptions := opts.GetCommonManagerOptions() - mgrOpts.Cache = cacheOpts - mgrOpts.Scheme = scheme + mgrOpts.Cache = getDefaultCacheOptions(*operatorConfig.CAPINamespace, 10*time.Minute) mgrOpts.WebhookServer = crwebhook.NewServer(crwebhook.Options{ Port: *webhookPort, CertDir: *webhookCertDir, - TLSOpts: tlsOptions, + TLSOpts: operatorConfig.TLSOptions, }) - mgr, err := ctrl.NewManager(cfg, mgrOpts) - if err != nil { - klog.Error(err, "unable to start manager") - os.Exit(1) - } + ctx, cancel := context.WithCancel(ctx) - if err := commoncmdoptions.AddCommonChecks(mgr); err != nil { - klog.Error(err, "unable to add common checks") + mgr, err := initManager(ctx, cancel, mgrOpts) + if err != nil { + log.Error(err, "unable to initialize manager") os.Exit(1) } platform, infra, err := util.GetPlatform(ctx, mgr.GetAPIReader()) if err != nil { - klog.Error(err, "unable to get platform") + log.Error(err, "unable to get platform") os.Exit(1) } - setupPlatformReconcilers(mgr, opts, infra, platform) + if err := setupPlatformReconcilers(log, mgr, operatorConfig, infra, platform); err != nil { + log.Error(err, "unable to setup platform reconcilers") + os.Exit(1) + } - klog.Info("Starting manager") + log.Info("Starting manager") if err := mgr.Start(ctx); err != nil { - klog.Error(err, "problem running manager") + log.Error(err, "problem running manager") os.Exit(1) } } -func setupPlatformReconcilers(mgr manager.Manager, opts *commoncmdoptions.CommonOptions, infra *configv1.Infrastructure, platform configv1.PlatformType) { +func setupPlatformReconcilers(log logr.Logger, mgr manager.Manager, operatorConfig commoncmdoptions.OperatorConfig, infra *configv1.Infrastructure, platform configv1.PlatformType) error { // Only setup reconcile controllers and webhooks when the platform is supported. // This avoids unnecessary CAPI providers discovery, installs and reconciles when the platform is not supported. infraTypes, _, err := util.GetCAPITypesForInfrastructure(infra) if err != nil { if errors.Is(err, util.ErrUnsupportedPlatform) { - klog.Infof("Detected platform %q is not supported, skipping capi controllers setup", platform) - return + log.Info("Detected platform is not supported, skipping capi controllers setup", "platform", platform) + return nil } - klog.Error(err, "unable to get infrastructure objects") - os.Exit(1) + return fmt.Errorf("unable to get infrastructure objects: %w", err) + } + + if err := setupReconcilers(mgr, operatorConfig, infra, platform, infraTypes.Cluster()); err != nil { + return fmt.Errorf("unable to setup reconcilers: %w", err) + } + + if err := setupWebhooks(mgr); err != nil { + return fmt.Errorf("unable to setup webhooks: %w", err) } - setupReconcilers(mgr, opts, infra, platform, infraTypes.Cluster()) - setupWebhooks(mgr) + return nil } -func setupReconcilers(mgr manager.Manager, opts *commoncmdoptions.CommonOptions, infra *configv1.Infrastructure, platform configv1.PlatformType, infraClusterObject client.Object) { +func setupReconcilers(mgr manager.Manager, operatorConfig commoncmdoptions.OperatorConfig, infra *configv1.Infrastructure, platform configv1.PlatformType, infraClusterObject client.Object) error { if err := (&corecluster.CoreClusterController{ - ClusterOperatorStatusClient: opts.GetClusterOperatorStatusClient(mgr, platform, "cluster-resource"), + ClusterOperatorStatusClient: operatorConfig.GetClusterOperatorStatusClient(mgr, platform, "cluster-resource"), Cluster: &clusterv1.Cluster{}, Platform: platform, Infra: infra, }).SetupWithManager(mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "CoreCluster") - os.Exit(1) + return fmt.Errorf("unable to create corecluster controller: %w", err) } if err := (&secretsync.UserDataSecretController{ - ClusterOperatorStatusClient: opts.GetClusterOperatorStatusClient(mgr, platform, "user-data-secret"), + ClusterOperatorStatusClient: operatorConfig.GetClusterOperatorStatusClient(mgr, platform, "user-data-secret"), Scheme: mgr.GetScheme(), }).SetupWithManager(mgr); err != nil { - klog.Error(err, "unable to create user-data-secret controller", "controller", "UserDataSecret") - os.Exit(1) + return fmt.Errorf("unable to create user-data-secret controller: %w", err) } if err := (&kubeconfig.KubeconfigReconciler{ - ClusterOperatorStatusClient: opts.GetClusterOperatorStatusClient(mgr, platform, "kubeconfig"), + ClusterOperatorStatusClient: operatorConfig.GetClusterOperatorStatusClient(mgr, platform, "kubeconfig"), Scheme: mgr.GetScheme(), RestCfg: mgr.GetConfig(), }).SetupWithManager(mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "Kubeconfig") - os.Exit(1) + return fmt.Errorf("unable to create kubeconfig controller: %w", err) } if err := (&infracluster.InfraClusterController{ - ClusterOperatorStatusClient: opts.GetClusterOperatorStatusClient(mgr, platform, "infracluster"), + ClusterOperatorStatusClient: operatorConfig.GetClusterOperatorStatusClient(mgr, platform, "infracluster"), Scheme: mgr.GetScheme(), RestCfg: mgr.GetConfig(), Platform: platform, Infra: infra, }).SetupWithManager(mgr, infraClusterObject); err != nil { - klog.Error(err, "unable to create infracluster controller", "controller", "InfraCluster") - os.Exit(1) + return fmt.Errorf("unable to create infracluster controller: %w", err) } + + return nil } -func setupWebhooks(mgr ctrl.Manager) { +func setupWebhooks(mgr ctrl.Manager) error { if err := (&webhook.ClusterWebhook{}).SetupWebhookWithManager(mgr); err != nil { - klog.Error(err, "unable to create webhook", "webhook", "Cluster") - os.Exit(1) + return fmt.Errorf("unable to create webhook: %w", err) } + + return nil } func getDefaultCacheOptions(capiNamespace string, sync time.Duration) cache.Options { diff --git a/cmd/capi-operator/main.go b/cmd/capi-operator/main.go index 28d0fcec15..44c3facf72 100644 --- a/cmd/capi-operator/main.go +++ b/cmd/capi-operator/main.go @@ -63,49 +63,40 @@ func initScheme(scheme *runtime.Scheme) { } func main() { + ctx, cancel := context.WithCancel(ctrl.SetupSignalHandler()) + cfg := ctrl.GetConfigOrDie() + scheme := runtime.NewScheme() initScheme(scheme) - opts := commoncmdoptions.InitCommonOptions(managerName, controllers.DefaultOperatorNamespace) - - imagesFile := flag.String( + extraflags := flag.NewFlagSet("", flag.ContinueOnError) + imagesFile := extraflags.String( "images-json", defaultImagesLocation, "The location of images file to use by operator for managed CAPI binaries.", ) - opts.Parse() - - log := ctrl.Log.WithName("capi-operator") + log, operatorConfig, mgrOpts, initManager, err := commoncmdoptions.InitOperatorConfig(ctx, cfg, scheme, managerName, controllers.DefaultOperatorNamespace, extraflags) + if err != nil { + log.Error(err, "unable to initialize operator config") + os.Exit(1) + } - cacheOpts := cache.Options{ + mgrOpts.Cache = cache.Options{ DefaultNamespaces: map[string]cache.Config{ - *opts.CAPINamespace: {}, - *opts.OperatorNamespace: {}, + *operatorConfig.CAPINamespace: {}, + *operatorConfig.OperatorNamespace: {}, }, SyncPeriod: ptr.To(10 * time.Minute), } - mgrOpts, _ := opts.GetCommonManagerOptions() - mgrOpts.Cache = cacheOpts - mgrOpts.Scheme = scheme - mgrOpts.Logger = log - - cfg := ctrl.GetConfigOrDie() - ctx, cancel := context.WithCancel(ctrl.SetupSignalHandler()) - - mgr, err := ctrl.NewManager(cfg, mgrOpts) + mgr, err := initManager(ctx, cancel, mgrOpts) if err != nil { - log.Error(err, "unable to create manager") + log.Error(err, "unable to initialize manager") os.Exit(1) } - if err := commoncmdoptions.AddCommonChecks(mgr); err != nil { - log.Error(err, "unable to add common checks") - os.Exit(1) - } - - if err := setupControllers(ctx, log, mgr, opts, *imagesFile, cancel); err != nil { + if err := setupControllers(ctx, log, mgr, operatorConfig, *imagesFile, cancel); err != nil { log.Error(err, "unable to setup controllers") os.Exit(1) } @@ -118,7 +109,7 @@ func main() { } } -func setupControllers(ctx context.Context, log logr.Logger, mgr ctrl.Manager, opts *commoncmdoptions.CommonOptions, imagesFile string, cancel context.CancelFunc) error { +func setupControllers(ctx context.Context, log logr.Logger, mgr ctrl.Manager, operatorConfig commoncmdoptions.OperatorConfig, imagesFile string, cancel context.CancelFunc) error { infra, err := util.GetInfra(ctx, mgr.GetAPIReader()) if err != nil { return fmt.Errorf("unable to get infrastructure: %w", err) @@ -137,7 +128,7 @@ func setupControllers(ctx context.Context, log logr.Logger, mgr ctrl.Manager, op supportedPlatform := util.IsCAPIEnabledForPlatform(featureGates, infra.Status.PlatformStatus.Type) if err := (&clusteroperator.ClusterOperatorController{ - ClusterOperatorStatusClient: opts.GetClusterOperatorStatusClient(mgr, platform, "clusteroperator"), + ClusterOperatorStatusClient: operatorConfig.GetClusterOperatorStatusClient(mgr, platform, "clusteroperator"), Scheme: mgr.GetScheme(), IsUnsupportedPlatform: !supportedPlatform, }).SetupWithManager(mgr); err != nil { @@ -157,8 +148,17 @@ func setupControllers(ctx context.Context, log logr.Logger, mgr ctrl.Manager, op return err } - if err := setupCapiInstallerController(mgr, log, providerProfiles); err != nil { - return err + if err := (&revision.RevisionController{ + Client: mgr.GetClient(), + ProviderProfiles: providerProfiles, + ReleaseVersion: util.GetReleaseVersion(), + }).SetupWithManager(mgr, operatorConfig.TLSOptions); err != nil { + log.Error(err, "unable to create revision controller", "controller", "RevisionController") + return fmt.Errorf("unable to create revision controller: %w", err) + } + + if err := installer.SetupWithManager(mgr, providerProfiles); err != nil { + return fmt.Errorf("unable to create installer controller: %w", err) } return nil @@ -184,20 +184,3 @@ func loadProviderImages(ctx context.Context, mgr ctrl.Manager, imagesFile string return providerProfiles, nil } - -func setupCapiInstallerController(mgr ctrl.Manager, log logr.Logger, providerProfiles []providerimages.ProviderImageManifests) error { - if err := (&revision.RevisionController{ - Client: mgr.GetClient(), - ProviderProfiles: providerProfiles, - ReleaseVersion: util.GetReleaseVersion(), - }).SetupWithManager(mgr); err != nil { - log.Error(err, "unable to create revision controller", "controller", "RevisionController") - return fmt.Errorf("unable to create revision controller: %w", err) - } - - if err := installer.SetupWithManager(mgr, providerProfiles); err != nil { - return fmt.Errorf("unable to create installer controller: %w", err) - } - - return nil -} diff --git a/cmd/crd-compatibility-checker/main.go b/cmd/crd-compatibility-checker/main.go index 221dc3ec52..10cea45edc 100644 --- a/cmd/crd-compatibility-checker/main.go +++ b/cmd/crd-compatibility-checker/main.go @@ -14,21 +14,19 @@ package main import ( + "context" "flag" + "fmt" "os" - "github.com/spf13/pflag" - admissionregistrationv1 "k8s.io/api/admissionregistration/v1" apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" "k8s.io/apimachinery/pkg/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime" clientgoscheme "k8s.io/client-go/kubernetes/scheme" - "k8s.io/component-base/config" - "k8s.io/component-base/config/options" - klog "k8s.io/klog/v2" apiextensionsv1alpha1 "github.com/openshift/api/apiextensions/v1alpha1" + configv1 "github.com/openshift/api/config/v1" operatorv1 "github.com/openshift/api/operator/v1" "github.com/openshift/cluster-capi-operator/pkg/controllers/crdcompatibility" crdcompatibilitybindata "github.com/openshift/cluster-capi-operator/pkg/controllers/crdcompatibility/bindata" @@ -37,148 +35,106 @@ import ( "github.com/openshift/cluster-capi-operator/pkg/controllers/crdcompatibility/objectvalidation" "github.com/openshift/cluster-capi-operator/pkg/controllers/staticresourceinstaller" - capiflags "sigs.k8s.io/cluster-api/util/flags" ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/healthz" crwebhook "sigs.k8s.io/controller-runtime/pkg/webhook" "github.com/openshift/cluster-capi-operator/pkg/commoncmdoptions" ) func initScheme(scheme *runtime.Scheme) { - utilruntime.Must(clientgoscheme.AddToScheme(scheme)) utilruntime.Must(admissionregistrationv1.AddToScheme(scheme)) utilruntime.Must(apiextensionsv1.AddToScheme(scheme)) utilruntime.Must(apiextensionsv1alpha1.AddToScheme(scheme)) + utilruntime.Must(clientgoscheme.AddToScheme(scheme)) + utilruntime.Must(configv1.AddToScheme(scheme)) utilruntime.Must(operatorv1.AddToScheme(scheme)) } -//nolint:funlen +const ( + managerName = "crd-compatibility-checker" + defaultManagerNamespace = "openshift-compatibility-requirements-operator" +) + func main() { + cfg := ctrl.GetConfigOrDie() + ctx := ctrl.SetupSignalHandler() scheme := runtime.NewScheme() initScheme(scheme) - leaderElectionConfig := config.LeaderElectionConfiguration{ - LeaderElect: true, - LeaseDuration: commoncmdoptions.LeaseDuration, - RenewDeadline: commoncmdoptions.RenewDeadline, - RetryPeriod: commoncmdoptions.RetryPeriod, - ResourceName: "crd-compatibility-checker-leader", - ResourceNamespace: "openshift-compatibility-requirements-operator", - } - - healthAddr := flag.String( - "health-addr", - ":9441", - "The address for health checking.", - ) - - webhookPort := flag.Int( + extraflags := flag.NewFlagSet("", flag.ContinueOnError) + webhookPort := extraflags.Int( "webhook-port", 9443, "The port for the webhook server to listen on.", ) - webhookCertDir := flag.String( + webhookCertDir := extraflags.String( "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/", "Webhook cert dir, only used when webhook-port is specified.", ) - logToStderr := flag.Bool( - "logtostderr", - true, - "log to standard error instead of files", - ) - - // klog.Background will automatically use the right logger. - ctrl.SetLogger(klog.Background()) + log, operatorConfig, mgrOpts, initManager, err := commoncmdoptions.InitOperatorConfig(ctx, cfg, scheme, managerName, defaultManagerNamespace, extraflags) + if err != nil { + log.Error(err, "unable to initialize operator config") + os.Exit(1) + } - // Once all the flags are registered, switch to pflag - // to allow leader election flags to be bound - pflag.CommandLine.AddGoFlagSet(flag.CommandLine) - options.BindLeaderElectionFlags(&leaderElectionConfig, pflag.CommandLine) + mgrOpts.WebhookServer = crwebhook.NewServer(crwebhook.Options{ + Port: *webhookPort, + CertDir: *webhookCertDir, + TLSOpts: operatorConfig.TLSOptions, + }) - // Register CAPI flags for the diagnostics endpoint. - capiManagerOptions := capiflags.ManagerOptions{} - capiflags.AddManagerOptions(pflag.CommandLine, &capiManagerOptions) + ctx, cancel := context.WithCancel(ctx) - pflag.Parse() + mgr, err := initManager(ctx, cancel, mgrOpts) + if err != nil { + log.Error(err, "unable to initialize manager") + os.Exit(1) + } - if logToStderr != nil { - klog.LogToStderr(*logToStderr) + if err := setupControllers(ctx, mgr); err != nil { + log.Error(err, "unable to setup controllers") + os.Exit(1) } - cfg := ctrl.GetConfigOrDie() + log.Info("Starting CRD compatibility checker manager") - mgr, err := ctrl.NewManager(cfg, ctrl.Options{ - Scheme: scheme, - HealthProbeBindAddress: *healthAddr, - LeaderElectionNamespace: leaderElectionConfig.ResourceNamespace, - LeaderElection: leaderElectionConfig.LeaderElect, - LeaseDuration: &leaderElectionConfig.LeaseDuration.Duration, - LeaderElectionID: leaderElectionConfig.ResourceName, - RetryPeriod: &leaderElectionConfig.RetryPeriod.Duration, - RenewDeadline: &leaderElectionConfig.RenewDeadline.Duration, - WebhookServer: crwebhook.NewServer(crwebhook.Options{ - Port: *webhookPort, - CertDir: *webhookCertDir, - }), - }) - if err != nil { - klog.Error(err, "unable to start manager") + if err := mgr.Start(ctx); err != nil { + log.Error(err, "problem running manager") os.Exit(1) } +} - ctx := ctrl.SetupSignalHandler() - - compatibilityRequirementReconciler := crdcompatibility.NewCompatibilityRequirementReconciler(mgr.GetClient()) +func setupControllers(ctx context.Context, mgr ctrl.Manager) error { // Setup the CRD compatibility controller + compatibilityRequirementReconciler := crdcompatibility.NewCompatibilityRequirementReconciler(mgr.GetClient()) if err := compatibilityRequirementReconciler.SetupWithManager(ctx, mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "CompatibilityRequirement") - os.Exit(1) + return fmt.Errorf("unable to create controller %s: %w", "CompatibilityRequirement", err) } // Setup the validator for CustomResourceDefinition Create/Update/Delete events. crdValidator := crdvalidation.NewValidator(mgr.GetClient()) if err := crdValidator.SetupWithManager(ctx, mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "CRDValidator") - os.Exit(1) + return fmt.Errorf("unable to create controller %s: %w", "CRDValidator", err) } staticResourceInstaller := staticresourceinstaller.NewStaticResourceInstallerController(crdcompatibilitybindata.Assets) if err := staticResourceInstaller.SetupWithManager(ctx, mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "StaticResourceInstaller") - os.Exit(1) + return fmt.Errorf("unable to create controller %s: %w", "StaticResourceInstaller", err) } - objectValidator := objectvalidation.NewValidator() // Setup the objectvalidation webhook + objectValidator := objectvalidation.NewValidator() if err := objectValidator.SetupWithManager(ctx, mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "ObjectValidator") - os.Exit(1) + return fmt.Errorf("unable to create controller %s: %w", "ObjectValidator", err) } - objectPruner := objectpruning.NewValidator() // Setup the objectpruning controller and webhook + objectPruner := objectpruning.NewValidator() if err := objectPruner.SetupWithManager(ctx, mgr); err != nil { - klog.Error(err, "unable to create controller", "controller", "ObjectPruner") - os.Exit(1) - } - - if err := mgr.AddHealthzCheck("health", healthz.Ping); err != nil { - klog.Error(err, "unable to set up health check") - os.Exit(1) - } - - if err := mgr.AddReadyzCheck("check", healthz.Ping); err != nil { - klog.Error(err, "unable to set up ready check") - os.Exit(1) + return fmt.Errorf("unable to create controller %s: %w", "ObjectPruner", err) } - klog.Info("Starting CRD compatibility checker manager") - - if err := mgr.Start(ctx); err != nil { - klog.Error(err, "problem running manager") - os.Exit(1) - } + return nil } diff --git a/cmd/machine-api-migration/main.go b/cmd/machine-api-migration/main.go index c094a33793..c550ad43ad 100644 --- a/cmd/machine-api-migration/main.go +++ b/cmd/machine-api-migration/main.go @@ -20,11 +20,13 @@ import ( "os" "time" + "github.com/go-logr/logr" configv1 "github.com/openshift/api/config/v1" mapiv1alpha1 "github.com/openshift/api/machine/v1alpha1" mapiv1beta1 "github.com/openshift/api/machine/v1beta1" configv1client "github.com/openshift/client-go/config/clientset/versioned" configinformers "github.com/openshift/client-go/config/informers/externalversions" + "k8s.io/klog" "k8s.io/utils/clock" awsv1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2" openstackv1 "sigs.k8s.io/cluster-api-provider-openstack/api/v1beta1" @@ -35,7 +37,6 @@ import ( "github.com/openshift/library-go/pkg/operator/events" "k8s.io/apimachinery/pkg/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime" - klog "k8s.io/klog/v2" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/cache" "sigs.k8s.io/controller-runtime/pkg/client" @@ -69,93 +70,92 @@ func initScheme(scheme *runtime.Scheme) { } func main() { + cfg := ctrl.GetConfigOrDie() + ctx := ctrl.SetupSignalHandler() scheme := runtime.NewScheme() initScheme(scheme) - opts := commoncmdoptions.InitCommonOptions(managerName, controllers.DefaultCAPINamespace) - - opts.Parse() + log, operatorConfig, mgrOpts, initManager, err := commoncmdoptions.InitOperatorConfig(ctx, cfg, scheme, managerName, controllers.DefaultCAPINamespace, nil) + if err != nil { + log.Error(err, "unable to initialize operator config") + os.Exit(1) + } - cfg := ctrl.GetConfigOrDie() + mgrOpts.Cache = getDefaultCacheOptions(*operatorConfig.CAPINamespace, *operatorConfig.MAPINamespace, 10*time.Minute) - mgrOpts, _ := opts.GetCommonManagerOptions() - mgrOpts.Scheme = scheme - mgrOpts.Cache = getDefaultCacheOptions(*opts.CAPINamespace, *opts.MAPINamespace, 10*time.Minute) + ctx, cancel := context.WithCancel(ctx) - mgr, err := ctrl.NewManager(cfg, mgrOpts) + mgr, err := initManager(ctx, cancel, mgrOpts) if err != nil { - klog.Error(err, "unable to create manager") + log.Error(err, "unable to initialize manager") os.Exit(1) } - if err := commoncmdoptions.AddCommonChecks(mgr); err != nil { - klog.Error(err, "unable to add common checks") + if err := checkFeatureGates(ctx, log, mgr); err != nil { + log.Error(err, "unable to check feature gates") os.Exit(1) } - ctx := ctrl.SetupSignalHandler() - checkFeatureGates(ctx, mgr) - infra, err := util.GetInfra(ctx, mgr.GetAPIReader()) if err != nil { - klog.Error(err, "unable to get infrastructure") + log.Error(err, "unable to get infrastructure") os.Exit(1) } infraTypes, platform, err := util.GetCAPITypesForInfrastructure(infra) if err != nil { if errors.Is(err, util.ErrUnsupportedPlatform) { - klog.Info(fmt.Sprintf("MachineAPIMigration not implemented for platform %s, nothing to do. Waiting for termination signal.", platform)) + log.Info("MachineAPIMigration not implemented for platform, nothing to do. Waiting for termination signal.", "platform", platform) exitAfterTerminationSignal(ctx) } - klog.Error(err, "unable to get infrastructure types") + log.Error(err, "unable to get infrastructure types") os.Exit(1) } - checkPlatformSupported(ctx, platform) + checkPlatformSupported(ctx, log, platform) - for name, controller := range getControllers(opts, platform, infra, infraTypes) { + for name, controller := range getControllers(operatorConfig, platform, infra, infraTypes) { if err := controller.SetupWithManager(mgr); err != nil { - klog.Error(err, fmt.Sprintf("failed to set up %s reconciler with manager", name)) + log.Error(err, "failed to set up reconciler with manager", "reconciler", name) os.Exit(1) } } - klog.Info("Starting manager") + log.Info("Starting manager") if err := mgr.Start(ctx); err != nil { - klog.Error(err, "problem running manager") + log.Error(err, "problem running manager") os.Exit(1) } } -func checkFeatureGates(ctx context.Context, mgr ctrl.Manager) { +func checkFeatureGates(ctx context.Context, log logr.Logger, mgr ctrl.Manager) error { featureGateAccessor, err := getFeatureGates(ctx, mgr) if err != nil { - klog.Error(err, "unable to get feature gates") - os.Exit(1) + return fmt.Errorf("unable to get feature gates: %w", err) } currentFeatureGates, err := featureGateAccessor.CurrentFeatureGates() if err != nil { - klog.Error(err, "unable to get current feature gates") - os.Exit(1) + return fmt.Errorf("unable to get current feature gates: %w", err) } if !currentFeatureGates.Enabled(features.FeatureGateMachineAPIMigration) { - klog.Info("MachineAPIMigration feature gate is not enabled, nothing to do. Waiting for termination signal.") + log.Info("MachineAPIMigration feature gate is not enabled, nothing to do. Waiting for termination signal.") exitAfterTerminationSignal(ctx) } + + return nil } -func checkPlatformSupported(ctx context.Context, platform configv1.PlatformType) { +func checkPlatformSupported(ctx context.Context, log logr.Logger, platform configv1.PlatformType) { switch platform { case configv1.AWSPlatformType, configv1.OpenStackPlatformType: - klog.Infof("MachineAPIMigration: starting %s controllers", platform) + log.Info("starting controllers", "platform", platform) default: - klog.Infof("MachineAPIMigration not implemented for platform %s, nothing to do. Waiting for termination signal.", platform) + log.Info("MachineAPIMigration not implemented for platform, nothing to do. Waiting for termination signal.", "platform", platform) exitAfterTerminationSignal(ctx) } } @@ -164,7 +164,7 @@ type controller interface { SetupWithManager(mgr ctrl.Manager) error } -func getControllers(opts *commoncmdoptions.CommonOptions, platform configv1.PlatformType, infra *configv1.Infrastructure, infraTypes util.InfraTypes) map[string]controller { +func getControllers(opts commoncmdoptions.OperatorConfig, platform configv1.PlatformType, infra *configv1.Infrastructure, infraTypes util.InfraTypes) map[string]controller { return map[string]controller{ "machine sync": &machinesync.MachineSyncReconciler{ Infra: infra, diff --git a/e2e/e2e_common.go b/e2e/e2e_common.go index 4482c876cd..6d80b67704 100644 --- a/e2e/e2e_common.go +++ b/e2e/e2e_common.go @@ -27,6 +27,7 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" utilruntime "k8s.io/apimachinery/pkg/util/runtime" "k8s.io/client-go/kubernetes/scheme" + "k8s.io/client-go/rest" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/config" "sigs.k8s.io/yaml" @@ -57,6 +58,7 @@ const ( var ( cl client.Client + restConfig *rest.Config ctx = context.Background() platform configv1.PlatformType clusterName string @@ -90,6 +92,8 @@ func InitCommonVariables() { cfg, err := config.GetConfig() Expect(err).ToNot(HaveOccurred()) + restConfig = cfg + cl, err = client.New(cfg, client.Options{Scheme: scheme.Scheme}) Expect(err).ToNot(HaveOccurred()) @@ -292,3 +296,7 @@ func dumpNamespaceEvents(buf *strings.Builder, namespace string) { e.Reason, e.Message) } } + +func kWithCtx(ctx context.Context) komega.Komega { + return komega.New(cl).WithContext(ctx) +} diff --git a/e2e/framework/framework.go b/e2e/framework/framework.go index fa601b335a..5fb75b9e65 100644 --- a/e2e/framework/framework.go +++ b/e2e/framework/framework.go @@ -26,8 +26,10 @@ import ( ) const ( - CAPINamespace = "openshift-cluster-api" - MAPINamespace = "openshift-machine-api" + CAPINamespace = "openshift-cluster-api" + CAPIOperatorNamespace = "openshift-cluster-api-operator" + CompatibilityRequirementsNamespace = "openshift-compatibility-requirements-operator" + MAPINamespace = "openshift-machine-api" RetryShort = 1 * time.Second RetryMedium = 5 * time.Second diff --git a/e2e/framework/util.go b/e2e/framework/util.go index 95d7c04dc4..ad3ae363bd 100644 --- a/e2e/framework/util.go +++ b/e2e/framework/util.go @@ -20,6 +20,7 @@ import ( "net/url" "sort" "strconv" + "time" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -27,7 +28,6 @@ import ( "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/envtest/komega" ) // SortListByName sorts the Items of a Kubernetes list object in place by metadata name. @@ -69,17 +69,16 @@ func GetControlPlaneHostAndPort(ctx context.Context, cl client.Client) (string, return apiUrl.Hostname(), int32(port), nil } -// IsMachineAPIMigrationEnabled checks if the "MachineAPIMigration" feature is enabled via FeatureGate status. -func IsMachineAPIMigrationEnabled(ctx context.Context) bool { - // First we need to check ClusterVersion because: - // 1. Feature gates might change across versions - // 2. For upgrade, we need to select only the version that we upgraded to +// IsFeatureGateEnabled checks if the named feature gate is enabled for the +// current cluster version. +func IsFeatureGateEnabled(ctx context.Context, cl client.Client, name configv1.FeatureGateName) bool { clusterVersion := &configv1.ClusterVersion{ - ObjectMeta: metav1.ObjectMeta{ - Name: "version", - }, + ObjectMeta: metav1.ObjectMeta{Name: "version"}, } - Eventually(komega.Get(clusterVersion)).Should(Succeed(), "clusterVersion should be available") + Eventually(func() error { return cl.Get(ctx, client.ObjectKey{Name: "version"}, clusterVersion) }). + WithContext(ctx). + WithTimeout(10*time.Second). + Should(Succeed(), "clusterVersion should be available") desiredVersion := clusterVersion.Status.Desired.Version if len(desiredVersion) == 0 && len(clusterVersion.Status.History) > 0 { @@ -87,19 +86,19 @@ func IsMachineAPIMigrationEnabled(ctx context.Context) bool { } featureGate := &configv1.FeatureGate{ - ObjectMeta: metav1.ObjectMeta{ - Name: "cluster", - }, + ObjectMeta: metav1.ObjectMeta{Name: "cluster"}, } - Eventually(komega.Get(featureGate)).Should(Succeed(), "featureGate should be available") + Eventually(func() error { return cl.Get(ctx, client.ObjectKey{Name: "cluster"}, featureGate) }). + WithContext(ctx). + WithTimeout(10*time.Second). + Should(Succeed(), "featureGate should be available") for _, fg := range featureGate.Status.FeatureGates { if fg.Version != desiredVersion { continue } - for _, enabled := range fg.Enabled { - if enabled.Name == "MachineAPIMigration" { + if enabled.Name == name { return true } } diff --git a/e2e/go.mod b/e2e/go.mod index 6edbb6d558..fb1cac195d 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -8,6 +8,9 @@ replace ( //cluster-api-actuator-pkg uses a placeholder for cluster-api-actuator-pkg/testutils github.com/openshift/cluster-api-actuator-pkg/testutils => github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20260310144400-bec013a007a8 + + // manifests-gen is a local module in this repo + github.com/openshift/cluster-capi-operator/manifests-gen => ../manifests-gen ) require ( @@ -17,13 +20,13 @@ require ( github.com/metal3-io/cluster-api-provider-metal3/api v1.11.2 github.com/onsi/ginkgo/v2 v2.28.1 github.com/onsi/gomega v1.39.1 - github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 + github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 github.com/openshift/cluster-api-actuator-pkg v0.0.0-20260310144400-bec013a007a8 github.com/openshift/cluster-api-provider-baremetal v0.0.0-20250619124612-fb678fec5f7e k8s.io/api v0.35.3 k8s.io/apimachinery v0.35.3 k8s.io/client-go v0.35.3 - k8s.io/utils v0.0.0-20260108192941-914a6e750570 + k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 sigs.k8s.io/cluster-api v1.12.3 sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.2 sigs.k8s.io/cluster-api-provider-azure v1.22.1 @@ -97,10 +100,10 @@ require ( github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/oklog/ulid v1.3.1 // indirect - github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d // indirect + github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5 // indirect github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0 // indirect github.com/openshift/cluster-autoscaler-operator v0.0.1-0.20250702183526-4eb64d553940 // indirect - github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6 // indirect + github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1 // indirect github.com/openshift/machine-api-operator v0.2.1-0.20260226113419-88465550a74b // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect diff --git a/e2e/go.sum b/e2e/go.sum index 41beae6e67..9c526f61a7 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -216,10 +216,10 @@ github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= -github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 h1:NchDXEQxOEww4DDUNMSDcpSPOMTFmjlWz5bIjd9gLIY= -github.com/openshift/api v0.0.0-20260306141135-f595753a3e66/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= -github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d h1:T+9HFgEEcnu1TDDfsO5JcJC6N0/Kzob5AtG9IpITHJ8= -github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d/go.mod h1:tIA3XSb/WsC/Fg0YNRfs/JrMrloBKPGF+NKVutd7nMI= +github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 h1:r0S/yoZAI0iWo1JvoIijaIgWGWf/izg4WiV7Wrtz16k= +github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= +github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5 h1:R5gdIA+R7MONtwKIEfZ7WM0k9ELv6GM2AbYApaCRNrA= +github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5/go.mod h1:u56GmXEMF6bvws8ipkT1ZRNJH52RF5sZ/yRP+6PwkH4= github.com/openshift/cluster-api-actuator-pkg v0.0.0-20260310144400-bec013a007a8 h1:jcvcqfzVBgqCtywunP+/QW8V5nPTNfqqcaJFqTZlvns= github.com/openshift/cluster-api-actuator-pkg v0.0.0-20260310144400-bec013a007a8/go.mod h1:43G5mBEXpJosA/w2/MQyFCAxslgkRmU+aHD5EmIMui8= github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20260310144400-bec013a007a8 h1:x62h16RetnB1ZP+zjSM9fsoMz98g95zte+DXeUDF34o= @@ -228,8 +228,8 @@ github.com/openshift/cluster-api-provider-baremetal v0.0.0-20250619124612-fb678f github.com/openshift/cluster-api-provider-baremetal v0.0.0-20250619124612-fb678fec5f7e/go.mod h1:xMvpaHoSmJ48WvX970zF82PPD9Wj8cMuZBFH6UxnvbE= github.com/openshift/cluster-autoscaler-operator v0.0.1-0.20250702183526-4eb64d553940 h1:NCCRJ7JfGLpRu4IQSV7Qw9VoAdIgF1BiwospisP06a8= github.com/openshift/cluster-autoscaler-operator v0.0.1-0.20250702183526-4eb64d553940/go.mod h1:zCklcJwbnaNx46KvR38Rh86uZdow5gvub4ATcNDopTM= -github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6 h1:xjqy0OolrFdJ+ofI/aD0+2k9+MSk5anP5dXifFt539Q= -github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6/go.mod h1:D797O/ssKTNglbrGchjIguFq+DbyRYdeds5w4/VTrKM= +github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1 h1:NdVGxmPGwWoMlhSmTxMMgp2SszLtAH3nJ6AMGBpXclY= +github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1/go.mod h1:3bi4pLpYRdVd1aEhsHfRTJkwxwPLfRZ+ZePn3RmJd2k= github.com/openshift/machine-api-operator v0.2.1-0.20260226113419-88465550a74b h1:LtHX/qyWHCOf/KqTAUHZOi4Q7cKErhm9f4jGYW4o2sk= github.com/openshift/machine-api-operator v0.2.1-0.20260226113419-88465550a74b/go.mod h1:wQqKNHIG8ttCvqFHdiBhj48VNAnWqVfKIJpRR3bw6N4= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= @@ -379,8 +379,8 @@ k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY= k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY= -k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= sigs.k8s.io/cluster-api v1.12.3 h1:cuOl3fWXhlXFuQcyIH4C8i3ns8rLhtcnK+x00MVdKBs= sigs.k8s.io/cluster-api v1.12.3/go.mod h1:EAiTJtf/8M5eBetPwumi6t8DJJ55Ln6Fkvh2OAa7PD4= sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.2 h1:jg4R4FGVWLU/oHMsFPoYQHCxyykvixWKKU3k+OuknlE= diff --git a/e2e/machine_migration_capi_authoritative_test.go b/e2e/machine_migration_capi_authoritative_test.go index bf3afc83c6..86c881b890 100644 --- a/e2e/machine_migration_capi_authoritative_test.go +++ b/e2e/machine_migration_capi_authoritative_test.go @@ -20,6 +20,7 @@ import ( . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" configv1 "github.com/openshift/api/config/v1" + "github.com/openshift/api/features" mapiv1beta1 "github.com/openshift/api/machine/v1beta1" mapiframework "github.com/openshift/cluster-api-actuator-pkg/pkg/framework" capiframework "github.com/openshift/cluster-capi-operator/e2e/framework" @@ -35,7 +36,7 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:MachineAPIMigration] Ma Skip(fmt.Sprintf("Skipping tests on %s, this is only supported on AWS", platform)) } - if !capiframework.IsMachineAPIMigrationEnabled(ctx) { + if !capiframework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) { Skip("Skipping, this feature is only supported on MachineAPIMigration enabled clusters") } }) diff --git a/e2e/machine_migration_mapi_authoritative_test.go b/e2e/machine_migration_mapi_authoritative_test.go index 0339947d96..8380bbe3ef 100644 --- a/e2e/machine_migration_mapi_authoritative_test.go +++ b/e2e/machine_migration_mapi_authoritative_test.go @@ -21,6 +21,7 @@ import ( . "github.com/onsi/gomega" configv1 "github.com/openshift/api/config/v1" + "github.com/openshift/api/features" mapiv1beta1 "github.com/openshift/api/machine/v1beta1" mapiframework "github.com/openshift/cluster-api-actuator-pkg/pkg/framework" capiframework "github.com/openshift/cluster-capi-operator/e2e/framework" @@ -35,7 +36,7 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:MachineAPIMigration] Ma Skip(fmt.Sprintf("Skipping tests on %s, this is only supported on AWS", platform)) } - if !capiframework.IsMachineAPIMigrationEnabled(ctx) { + if !capiframework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) { Skip("Skipping, this feature is only supported on MachineAPIMigration enabled clusters") } }) diff --git a/e2e/machine_migration_vap_tests.go b/e2e/machine_migration_vap_tests.go index ddfa184c9e..a4de51ac35 100644 --- a/e2e/machine_migration_vap_tests.go +++ b/e2e/machine_migration_vap_tests.go @@ -21,6 +21,7 @@ import ( . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" configv1 "github.com/openshift/api/config/v1" + "github.com/openshift/api/features" mapiv1beta1 "github.com/openshift/api/machine/v1beta1" mapiframework "github.com/openshift/cluster-api-actuator-pkg/pkg/framework" capiframework "github.com/openshift/cluster-capi-operator/e2e/framework" @@ -58,7 +59,7 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:MachineAPIMigration] MA Skip(fmt.Sprintf("Skipping tests on %s, this is only supported on AWS", platform)) } - if !capiframework.IsMachineAPIMigrationEnabled(ctx) { + if !capiframework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) { Skip("Skipping, this feature is only supported on MachineAPIMigration enabled clusters") } }) diff --git a/e2e/machineset_migration_capi_authoritative_test.go b/e2e/machineset_migration_capi_authoritative_test.go index 813b86df87..2ab34cc486 100644 --- a/e2e/machineset_migration_capi_authoritative_test.go +++ b/e2e/machineset_migration_capi_authoritative_test.go @@ -21,6 +21,7 @@ import ( . "github.com/onsi/gomega" configv1 "github.com/openshift/api/config/v1" + "github.com/openshift/api/features" mapiv1beta1 "github.com/openshift/api/machine/v1beta1" mapiframework "github.com/openshift/cluster-api-actuator-pkg/pkg/framework" capiframework "github.com/openshift/cluster-capi-operator/e2e/framework" @@ -34,7 +35,7 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:MachineAPIMigration] Ma Skip(fmt.Sprintf("Skipping tests on %s, this is only supported on AWS", platform)) } - if !capiframework.IsMachineAPIMigrationEnabled(ctx) { + if !capiframework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) { Skip("Skipping, this feature is only supported on MachineAPIMigration enabled clusters") } }) diff --git a/e2e/machineset_migration_mapi_authoritative_test.go b/e2e/machineset_migration_mapi_authoritative_test.go index a5836151d3..6e40e24de5 100644 --- a/e2e/machineset_migration_mapi_authoritative_test.go +++ b/e2e/machineset_migration_mapi_authoritative_test.go @@ -21,6 +21,7 @@ import ( . "github.com/onsi/gomega" configv1 "github.com/openshift/api/config/v1" + "github.com/openshift/api/features" mapiv1beta1 "github.com/openshift/api/machine/v1beta1" mapiframework "github.com/openshift/cluster-api-actuator-pkg/pkg/framework" capiframework "github.com/openshift/cluster-capi-operator/e2e/framework" @@ -37,7 +38,7 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:MachineAPIMigration] Ma Skip(fmt.Sprintf("Skipping tests on %s, this is only supported on AWS", platform)) } - if !capiframework.IsMachineAPIMigrationEnabled(ctx) { + if !capiframework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) { Skip("Skipping, this feature is only supported on MachineAPIMigration enabled clusters") } diff --git a/go.mod b/go.mod index e96b36f2f1..82356cefe4 100644 --- a/go.mod +++ b/go.mod @@ -69,11 +69,12 @@ require ( github.com/metal3-io/cluster-api-provider-metal3/api v1.11.2 github.com/onsi/ginkgo/v2 v2.28.1 github.com/onsi/gomega v1.39.1 - github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 - github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d + github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 + github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5 github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0 github.com/openshift/cluster-capi-operator/manifests-gen v0.0.0-00010101000000-000000000000 - github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6 + github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2 + github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1 github.com/pkg/errors v0.9.1 github.com/spf13/pflag v1.0.10 golang.org/x/sync v0.20.0 @@ -84,9 +85,10 @@ require ( k8s.io/apiserver v0.35.3 k8s.io/client-go v0.35.3 k8s.io/component-base v0.35.3 + k8s.io/klog v1.0.0 k8s.io/klog/v2 v2.140.0 k8s.io/kubernetes v1.35.1 - k8s.io/utils v0.0.0-20260108192941-914a6e750570 + k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 pkg.package-operator.run/boxcutter v0.13.1 sigs.k8s.io/cluster-api v1.12.3 sigs.k8s.io/cluster-api-provider-aws/v2 v2.10.2 diff --git a/go.sum b/go.sum index 5f742c95ce..0dd4f12fdc 100644 --- a/go.sum +++ b/go.sum @@ -215,6 +215,7 @@ github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc= github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog= github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ= +github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -532,14 +533,16 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= -github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 h1:NchDXEQxOEww4DDUNMSDcpSPOMTFmjlWz5bIjd9gLIY= -github.com/openshift/api v0.0.0-20260306141135-f595753a3e66/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= -github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d h1:T+9HFgEEcnu1TDDfsO5JcJC6N0/Kzob5AtG9IpITHJ8= -github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d/go.mod h1:tIA3XSb/WsC/Fg0YNRfs/JrMrloBKPGF+NKVutd7nMI= +github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 h1:r0S/yoZAI0iWo1JvoIijaIgWGWf/izg4WiV7Wrtz16k= +github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= +github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5 h1:R5gdIA+R7MONtwKIEfZ7WM0k9ELv6GM2AbYApaCRNrA= +github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5/go.mod h1:u56GmXEMF6bvws8ipkT1ZRNJH52RF5sZ/yRP+6PwkH4= github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20260310144400-bec013a007a8 h1:x62h16RetnB1ZP+zjSM9fsoMz98g95zte+DXeUDF34o= github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20260310144400-bec013a007a8/go.mod h1:n8RwIitgr5SAfvisrU0Ps+Szrn545DBU7nqtwATZphw= -github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6 h1:xjqy0OolrFdJ+ofI/aD0+2k9+MSk5anP5dXifFt539Q= -github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6/go.mod h1:D797O/ssKTNglbrGchjIguFq+DbyRYdeds5w4/VTrKM= +github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2 h1:GrZlVichOCE/lz8fg1+eNrAtkM0VSlqa9buuzN0vnb0= +github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2/go.mod h1:XGabTMnNbz0M5Oa7IbscZp/jmcc7aHobvOCUWwkzKvM= +github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1 h1:NdVGxmPGwWoMlhSmTxMMgp2SszLtAH3nJ6AMGBpXclY= +github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1/go.mod h1:3bi4pLpYRdVd1aEhsHfRTJkwxwPLfRZ+ZePn3RmJd2k= github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw= github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU= github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w= @@ -942,6 +945,8 @@ k8s.io/component-helpers v0.35.3 h1:Rl2p3wNMC0YU21rziLkWXavr7MwkB5Td3lNZ/+gYGm8= k8s.io/component-helpers v0.35.3/go.mod h1:8BkyfcBA6XsCtFYxDB+mCfZqM6P39Aco12AKigNn0C8= k8s.io/controller-manager v0.35.3 h1:BlX95jtN41/vCwuTsmfzR9UpqweX7KDWdwm/mRHez/o= k8s.io/controller-manager v0.35.3/go.mod h1:OaG4bXsMfN5zpqowtdyfoRX20LrfwUh6V0zmpF7hw30= +k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8= +k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I= k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kms v0.35.3 h1:jaxr/7dNqcztGldnfCEZg8DegEOnHV6cfoBC2ACMWEg= @@ -954,8 +959,8 @@ k8s.io/kubelet v0.35.3 h1:Y6b9+U/aTBmou9JZ6qv18O4dpFbJOfl7cBe+ZksT7RY= k8s.io/kubelet v0.35.3/go.mod h1:aWoMogtyUEf/mTl8VjqHbSkW5ZZkB8vTkrg9Fi6TKwE= k8s.io/kubernetes v1.35.3 h1:J3dk2wybKFHwoH4eydDUGHJo4HAD+9CZbSlvk/YQuao= k8s.io/kubernetes v1.35.3/go.mod h1:AaPpCpiS8oAqRbEwpY5r3RitLpwpVp5lVXKFkJril58= -k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY= -k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4= mvdan.cc/gofumpt v0.9.2/go.mod h1:iB7Hn+ai8lPvofHd9ZFGVg2GOr8sBUw1QUWjNbmIL/s= mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 h1:ssMzja7PDPJV8FStj7hq9IKiuiKhgz9ErWw+m68e7DI= diff --git a/manifests-gen/go.mod b/manifests-gen/go.mod index 69b32be737..127c6bda34 100644 --- a/manifests-gen/go.mod +++ b/manifests-gen/go.mod @@ -16,8 +16,8 @@ require ( require ( github.com/google/go-containerregistry v0.20.7 - github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 - k8s.io/utils v0.0.0-20260108192941-914a6e750570 + github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 + k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 sigs.k8s.io/controller-runtime v0.23.3 ) diff --git a/manifests-gen/go.sum b/manifests-gen/go.sum index ad1451b1c7..33aa083aa5 100644 --- a/manifests-gen/go.sum +++ b/manifests-gen/go.sum @@ -96,8 +96,8 @@ github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 h1:NchDXEQxOEww4DDUNMSDcpSPOMTFmjlWz5bIjd9gLIY= -github.com/openshift/api v0.0.0-20260306141135-f595753a3e66/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= +github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 h1:r0S/yoZAI0iWo1JvoIijaIgWGWf/izg4WiV7Wrtz16k= +github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= @@ -182,8 +182,8 @@ k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY= k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY= -k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80= sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0= sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM= diff --git a/manifests/0000_20_cluster-api-tls-config_role.yaml b/manifests/0000_20_cluster-api-tls-config_role.yaml new file mode 100644 index 0000000000..15a8a53b49 --- /dev/null +++ b/manifests/0000_20_cluster-api-tls-config_role.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "ClusterAPIMachineManagement" + name: system:openshift:openshift-cluster-api:read-tls-configuration +rules: +- apiGroups: + - config.openshift.io + resources: + - apiservers + verbs: + - get + - list + - watch diff --git a/manifests/0000_20_crd-compatibility-checker_04_rbac_bindings.yaml b/manifests/0000_20_crd-compatibility-checker_04_rbac_bindings.yaml index bc3d4153c0..1f98b7f927 100644 --- a/manifests/0000_20_crd-compatibility-checker_04_rbac_bindings.yaml +++ b/manifests/0000_20_crd-compatibility-checker_04_rbac_bindings.yaml @@ -37,6 +37,24 @@ subjects: name: compatibility-requirements-controllers --- apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system:openshift:compatibility-requirements-read-tls-configuration + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "CRDCompatibilityRequirementOperator" +roleRef: + kind: ClusterRole + name: system:openshift:openshift-cluster-api:read-tls-configuration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-compatibility-requirements-operator + name: compatibility-requirements-controllers +--- +apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: system:openshift:compatibility-requirements-events diff --git a/manifests/0000_20_crd-compatibility-checker_05_metrics-service.yaml b/manifests/0000_20_crd-compatibility-checker_05_metrics-service.yaml new file mode 100644 index 0000000000..28408140c9 --- /dev/null +++ b/manifests/0000_20_crd-compatibility-checker_05_metrics-service.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "CRDCompatibilityRequirementOperator" + service.beta.openshift.io/serving-cert-secret-name: compatibility-requirements-controllers-metrics-tls + name: compatibility-requirements-controllers-metrics + namespace: openshift-compatibility-requirements-operator +spec: + ports: + - name: diagnostics + port: 8443 + targetPort: diagnostics + selector: + k8s-app: compatibility-requirements-controllers + type: ClusterIP + clusterIP: None + sessionAffinity: None diff --git a/manifests/0000_20_crd-compatibility-checker_08_deployment.yaml b/manifests/0000_20_crd-compatibility-checker_08_deployment.yaml index 7d66104947..98ff3e9045 100644 --- a/manifests/0000_20_crd-compatibility-checker_08_deployment.yaml +++ b/manifests/0000_20_crd-compatibility-checker_08_deployment.yaml @@ -66,7 +66,7 @@ spec: - containerPort: 9443 name: webhook-server protocol: TCP - - containerPort: 9441 + - containerPort: 9440 name: healthz protocol: TCP - containerPort: 8443 @@ -81,6 +81,9 @@ spec: - name: cert mountPath: /tmp/k8s-webhook-server/serving-certs readOnly: true + - name: metrics-cert + mountPath: /tmp/k8s-metrics-server/serving-certs + readOnly: true nodeSelector: node-role.kubernetes.io/master: "" priorityClassName: system-cluster-critical @@ -94,3 +97,7 @@ spec: secret: defaultMode: 420 secretName: compatibility-requirements-controllers-webhook-service-cert + - name: metrics-cert + secret: + defaultMode: 420 + secretName: compatibility-requirements-controllers-metrics-tls diff --git a/manifests/0000_30_cluster-api-installer_01_metrics-service.yaml b/manifests/0000_30_cluster-api-installer_01_metrics-service.yaml new file mode 100644 index 0000000000..409bfee021 --- /dev/null +++ b/manifests/0000_30_cluster-api-installer_01_metrics-service.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "ClusterAPIMachineManagement" + service.beta.openshift.io/serving-cert-secret-name: capi-operator-metrics-tls + name: capi-operator-metrics + namespace: openshift-cluster-api-operator +spec: + ports: + - name: diagnostics + port: 8443 + targetPort: diagnostics + selector: + k8s-app: capi-operator + type: ClusterIP + clusterIP: None + sessionAffinity: None diff --git a/manifests/0000_30_cluster-api-installer_03_clusterrolebinding.yaml b/manifests/0000_30_cluster-api-installer_03_clusterrolebinding.yaml index 8d02355242..d372cdaae1 100644 --- a/manifests/0000_30_cluster-api-installer_03_clusterrolebinding.yaml +++ b/manifests/0000_30_cluster-api-installer_03_clusterrolebinding.yaml @@ -16,3 +16,21 @@ subjects: - kind: ServiceAccount namespace: openshift-cluster-api-operator name: capi-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system:openshift:capi-operator-read-tls-configuration + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "ClusterAPIMachineManagement" +roleRef: + kind: ClusterRole + name: system:openshift:openshift-cluster-api:read-tls-configuration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-cluster-api-operator + name: capi-operator diff --git a/manifests/0000_30_cluster-api-installer_05_deployment.yaml b/manifests/0000_30_cluster-api-installer_05_deployment.yaml index c60e6b8014..885010ac28 100644 --- a/manifests/0000_30_cluster-api-installer_05_deployment.yaml +++ b/manifests/0000_30_cluster-api-installer_05_deployment.yaml @@ -53,6 +53,9 @@ spec: - name: images mountPath: /etc/cluster-api-config-images readOnly: true + - name: metrics-cert + mountPath: /tmp/k8s-metrics-server/serving-certs + readOnly: true livenessProbe: httpGet: path: /healthz @@ -81,3 +84,7 @@ spec: configMap: defaultMode: 420 name: cluster-capi-operator-images + - name: metrics-cert + secret: + defaultMode: 420 + secretName: capi-operator-metrics-tls diff --git a/manifests/0000_30_cluster-api_04_rbac_bindings.yaml b/manifests/0000_30_cluster-api_04_rbac_bindings.yaml index d7fa93bca8..44aeef10e0 100644 --- a/manifests/0000_30_cluster-api_04_rbac_bindings.yaml +++ b/manifests/0000_30_cluster-api_04_rbac_bindings.yaml @@ -37,6 +37,24 @@ subjects: name: capi-controllers --- apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system:openshift:capi-controllers-read-tls-configuration + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "ClusterAPIMachineManagement" +roleRef: + kind: ClusterRole + name: system:openshift:openshift-cluster-api:read-tls-configuration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-cluster-api + name: capi-controllers +--- +apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: cluster-capi-operator-pull-secret diff --git a/manifests/0000_30_cluster-api_10_metrics-service.yaml b/manifests/0000_30_cluster-api_10_metrics-service.yaml new file mode 100644 index 0000000000..f96d418fd5 --- /dev/null +++ b/manifests/0000_30_cluster-api_10_metrics-service.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "ClusterAPIMachineManagement" + service.beta.openshift.io/serving-cert-secret-name: capi-controllers-metrics-tls + name: capi-controllers-metrics + namespace: openshift-cluster-api +spec: + ports: + - name: capi-controllers-metrics + port: 8443 + targetPort: diagnostics-o + - name: machine-api-migration-metrics + port: 8442 + targetPort: diagnostics-m + selector: + k8s-app: capi-controllers + type: ClusterIP + clusterIP: None + sessionAffinity: None diff --git a/manifests/0000_30_cluster-api_11_deployment.yaml b/manifests/0000_30_cluster-api_11_deployment.yaml index 5a6aecbeb9..4db1843196 100644 --- a/manifests/0000_30_cluster-api_11_deployment.yaml +++ b/manifests/0000_30_cluster-api_11_deployment.yaml @@ -56,6 +56,9 @@ spec: - name: cert mountPath: /tmp/k8s-webhook-server/serving-certs readOnly: true + - name: metrics-cert + mountPath: /tmp/k8s-metrics-server/serving-certs + readOnly: true - name: provider-images mountPath: /var/lib/provider-images - name: machine-api-migration @@ -80,6 +83,10 @@ spec: cpu: 10m memory: 50Mi terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: metrics-cert + mountPath: /tmp/k8s-metrics-server/serving-certs + readOnly: true nodeSelector: node-role.kubernetes.io/control-plane: "" priorityClassName: system-node-critical @@ -96,5 +103,9 @@ spec: secret: defaultMode: 420 secretName: capi-controllers-webhook-service-cert + - name: metrics-cert + secret: + defaultMode: 420 + secretName: capi-controllers-metrics-tls - name: provider-images emptyDir: {} diff --git a/pkg/commoncmdoptions/commonoptions.go b/pkg/commoncmdoptions/commonoptions.go index cbea07aa7c..da09d6a8ab 100644 --- a/pkg/commoncmdoptions/commonoptions.go +++ b/pkg/commoncmdoptions/commonoptions.go @@ -16,26 +16,35 @@ limitations under the License. package commoncmdoptions import ( + "context" "crypto/tls" "errors" "flag" + "fmt" "os" + "strings" "time" + "github.com/go-logr/logr" + "github.com/spf13/pflag" capiflags "sigs.k8s.io/cluster-api/util/flags" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/healthz" - configv1 "github.com/openshift/api/config/v1" - "github.com/openshift/cluster-capi-operator/pkg/controllers" - "github.com/openshift/cluster-capi-operator/pkg/operatorstatus" - "github.com/openshift/cluster-capi-operator/pkg/util" - "github.com/spf13/pflag" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/rest" "k8s.io/component-base/config" "k8s.io/component-base/config/options" "k8s.io/klog/v2" "k8s.io/klog/v2/textlogger" + + configv1 "github.com/openshift/api/config/v1" + libgocrypto "github.com/openshift/library-go/pkg/crypto" + + "github.com/openshift/cluster-capi-operator/pkg/controllers" + "github.com/openshift/cluster-capi-operator/pkg/operatorstatus" + "github.com/openshift/cluster-capi-operator/pkg/util" ) // The default durations for the leader election operations. @@ -50,93 +59,129 @@ var ( RetryPeriod = metav1.Duration{Duration: 26 * time.Second} ) -// CommonOptions contains options common to all managers. -type CommonOptions struct { - HealthAddr *string - CAPINamespace *string - MAPINamespace *string - OperatorNamespace *string - LogToStderr *bool - CapiManagerOptions capiflags.ManagerOptions - TextLoggerConfig *textlogger.Config - LeaderElectionConfig config.LeaderElectionConfiguration +// OperatorConfig contains configuration options common to all CAPI operator managers. +type OperatorConfig struct { + CAPINamespace *string + MAPINamespace *string + OperatorNamespace *string + + // TLSOptions are the TLS options functions used by the manager. It + // defaults to the cluster-wide TLS profile, but can be overridden on the + // command line. Metrics and webhooks will use these. + TLSOptions []func(config *tls.Config) managerName string } -// InitCommonOptions configures command line flags for options common to all managers. -func InitCommonOptions(managerName, defaultManagerNamespace string) *CommonOptions { - opts := &CommonOptions{ - HealthAddr: flag.String("health-addr", ":9440", "The address for health checking."), - CAPINamespace: flag.String("capi-namespace", controllers.DefaultCAPINamespace, "The namespace where CAPI components are installed."), - MAPINamespace: flag.String("mapi-namespace", controllers.DefaultMAPINamespace, "The namespace where MAPI components are installed."), - OperatorNamespace: flag.String("operator-namespace", controllers.DefaultOperatorNamespace, "The namespace where the operator will run."), - LogToStderr: flag.Bool("logtostderr", true, "log to standard error instead of files"), +// InitOperatorConfig configures command line flags for options common to all managers. +// +//nolint:funlen +func InitOperatorConfig(ctx context.Context, cfg *rest.Config, scheme *runtime.Scheme, managerName, defaultManagerNamespace string, extraFlags *flag.FlagSet) ( + logr.Logger, OperatorConfig, ctrl.Options, + func(ctx context.Context, cancel context.CancelFunc, mgrOpts ctrl.Options) (ctrl.Manager, error), + error, +) { + // Note that we're using a mixture of pflag and flag here, which is tricky + // and confusing. The reasons for this are legacy, and because textlogger + // initialises its flags with `flag` while other tools use `pflag`. + + // Go flags + goflagset := flag.NewFlagSet("", flag.ContinueOnError) + operatorConfig := OperatorConfig{ + CAPINamespace: goflagset.String("capi-namespace", controllers.DefaultCAPINamespace, "The namespace where CAPI components are installed."), + MAPINamespace: goflagset.String("mapi-namespace", controllers.DefaultMAPINamespace, "The namespace where MAPI components are installed."), + OperatorNamespace: goflagset.String("operator-namespace", controllers.DefaultOperatorNamespace, "The namespace where the operator will run."), - CapiManagerOptions: capiflags.ManagerOptions{}, + managerName: managerName, + } - TextLoggerConfig: textlogger.NewConfig(), + healthAddr := goflagset.String("health-addr", ":9440", "The address for health checking.") + logToStderr := goflagset.Bool("logtostderr", true, "log to standard error instead of files") - LeaderElectionConfig: config.LeaderElectionConfiguration{ - LeaderElect: true, - LeaseDuration: LeaseDuration, - RenewDeadline: RenewDeadline, - RetryPeriod: RetryPeriod, - ResourceName: managerName + "-leader", - ResourceNamespace: defaultManagerNamespace, - }, + textLoggerConfig := textlogger.NewConfig() + textLoggerConfig.AddFlags(goflagset) - managerName: managerName, + // pflags + pflagset := pflag.NewFlagSet(managerName, pflag.ContinueOnError) + + capiManagerOptions := capiflags.ManagerOptions{} + leaderElectionConfig := config.LeaderElectionConfiguration{ + LeaderElect: true, + LeaseDuration: LeaseDuration, + RenewDeadline: RenewDeadline, + RetryPeriod: RetryPeriod, + ResourceName: managerName + "-leader", + ResourceNamespace: defaultManagerNamespace, } - capiflags.AddManagerOptions(pflag.CommandLine, &opts.CapiManagerOptions) - opts.TextLoggerConfig.AddFlags(flag.CommandLine) + capiflags.AddManagerOptions(pflagset, &capiManagerOptions) + options.BindLeaderElectionFlags(&leaderElectionConfig, pflagset) - return opts -} + // Add goflags to pflagset + pflagset.AddGoFlagSet(goflagset) -// Parse parses the command line flags, binding values to the CommonOptions. It -// also initialises the global logger based on the given options. -func (opts *CommonOptions) Parse() { - // Once all the flags are registered, switch to pflag - // to allow leader election flags to be bound - pflag.CommandLine.AddGoFlagSet(flag.CommandLine) - options.BindLeaderElectionFlags(&opts.LeaderElectionConfig, pflag.CommandLine) + if extraFlags != nil { + pflagset.AddGoFlagSet(extraFlags) + } - pflag.Parse() + if err := pflagset.Parse(os.Args[1:]); err != nil { + // Flags were not parsed; use default textlogger config defaults. + log := textlogger.NewLogger(textlogger.NewConfig()).WithName(managerName) + return log, OperatorConfig{}, ctrl.Options{}, nil, fmt.Errorf("failed to parse flags: %w", err) + } - if opts.LogToStderr != nil { - klog.LogToStderr(*opts.LogToStderr) + if logToStderr != nil { + klog.LogToStderr(*logToStderr) } - ctrl.SetLogger(textlogger.NewLogger(opts.TextLoggerConfig)) -} + log := textlogger.NewLogger(textLoggerConfig).WithName(managerName) + ctrl.SetLogger(log) -// GetCommonManagerOptions returns a ctrl.Options struct which has been -// initialised with values from the command line. -func (opts *CommonOptions) GetCommonManagerOptions() (ctrl.Options, []func(config *tls.Config)) { - tlsOptions, diagnosticsOpts, err := capiflags.GetManagerOptions(opts.CapiManagerOptions) + clusterTLSProfileSpec, setupSecurityProfileWatcher, err := resolveTLSProfile(ctx, cfg, scheme, log) + if err != nil { + return log, OperatorConfig{}, ctrl.Options{}, nil, fmt.Errorf("unable to resolve cluster TLS profile: %w", err) + } + + // Use the cluster-wide default TLS profile if --tls-min-version or + // --tls-cipher-suites were not set on the command line. Production + // deployments are expected to omit these flags and use the cluster-wide + // default. + if !pflagset.Changed("tls-min-version") { + capiManagerOptions.TLSMinVersion = libgocrypto.TLSVersionToNameOrDie(libgocrypto.TLSVersionOrDie(string(clusterTLSProfileSpec.MinTLSVersion))) + } + + if !pflagset.Changed("tls-cipher-suites") { + capiManagerOptions.TLSCipherSuites = libgocrypto.OpenSSLToIANACipherSuites(clusterTLSProfileSpec.Ciphers) + } + + tlsOptions, diagnosticsOpts, err := capiflags.GetManagerOptions(capiManagerOptions) if err != nil { - klog.Error(err, "unable to get manager options") - os.Exit(1) + return log, OperatorConfig{}, ctrl.Options{}, nil, fmt.Errorf("unable to get CAPI manager options: %w", err) } - return ctrl.Options{ + log.Info("Cluster TLS profile spec", "min_version", clusterTLSProfileSpec.MinTLSVersion, "ciphers", strings.Join(clusterTLSProfileSpec.Ciphers, ",")) + log.Info("Operator TLS options", "min_version", capiManagerOptions.TLSMinVersion, "ciphers", strings.Join(capiManagerOptions.TLSCipherSuites, ",")) + + operatorConfig.TLSOptions = tlsOptions + + return log, operatorConfig, ctrl.Options{ Metrics: *diagnosticsOpts, - HealthProbeBindAddress: *opts.HealthAddr, - LeaderElectionNamespace: opts.LeaderElectionConfig.ResourceNamespace, - LeaderElection: opts.LeaderElectionConfig.LeaderElect, + HealthProbeBindAddress: *healthAddr, + LeaderElectionNamespace: leaderElectionConfig.ResourceNamespace, + LeaderElection: leaderElectionConfig.LeaderElect, LeaderElectionReleaseOnCancel: true, - LeaseDuration: &opts.LeaderElectionConfig.LeaseDuration.Duration, - LeaderElectionID: opts.LeaderElectionConfig.ResourceName, - RetryPeriod: &opts.LeaderElectionConfig.RetryPeriod.Duration, - RenewDeadline: &opts.LeaderElectionConfig.RenewDeadline.Duration, - }, tlsOptions + LeaseDuration: &leaderElectionConfig.LeaseDuration.Duration, + LeaderElectionID: leaderElectionConfig.ResourceName, + RetryPeriod: &leaderElectionConfig.RetryPeriod.Duration, + RenewDeadline: &leaderElectionConfig.RenewDeadline.Duration, + Scheme: scheme, + Logger: log, + }, initManager(cfg, setupSecurityProfileWatcher), nil } // GetClusterOperatorStatusClient returns a ClusterOperatorStatusClient struct which has been // initialised with values from the command line. -func (opts *CommonOptions) GetClusterOperatorStatusClient(mgr ctrl.Manager, platform configv1.PlatformType, controllerName string) operatorstatus.ClusterOperatorStatusClient { +func (opts *OperatorConfig) GetClusterOperatorStatusClient(mgr ctrl.Manager, platform configv1.PlatformType, controllerName string) operatorstatus.ClusterOperatorStatusClient { return operatorstatus.ClusterOperatorStatusClient{ Client: mgr.GetClient(), Recorder: mgr.GetEventRecorderFor(opts.managerName + "-" + controllerName), @@ -147,10 +192,24 @@ func (opts *CommonOptions) GetClusterOperatorStatusClient(mgr ctrl.Manager, plat } } -// AddCommonChecks adds the common health and readyz checks to the manager. -func AddCommonChecks(mgr ctrl.Manager) error { - return errors.Join( - mgr.AddHealthzCheck("health", healthz.Ping), - mgr.AddReadyzCheck("check", healthz.Ping), - ) +func initManager(cfg *rest.Config, securityProfileWatcher func(ctrl.Manager, context.CancelFunc) error) func(ctx context.Context, cancel context.CancelFunc, mgrOpts ctrl.Options) (ctrl.Manager, error) { + return func(ctx context.Context, cancel context.CancelFunc, mgrOpts ctrl.Options) (ctrl.Manager, error) { + mgr, err := ctrl.NewManager(cfg, mgrOpts) + if err != nil { + return nil, fmt.Errorf("unable to create manager: %w", err) + } + + if err := errors.Join( + mgr.AddHealthzCheck("health", healthz.Ping), + mgr.AddReadyzCheck("check", healthz.Ping), + ); err != nil { + return nil, fmt.Errorf("unable to add common checks: %w", err) + } + + if err := securityProfileWatcher(mgr, cancel); err != nil { + return nil, fmt.Errorf("unable to set up security profile watcher: %w", err) + } + + return mgr, nil + } } diff --git a/pkg/commoncmdoptions/commonoptions_test.go b/pkg/commoncmdoptions/commonoptions_test.go new file mode 100644 index 0000000000..221f274497 --- /dev/null +++ b/pkg/commoncmdoptions/commonoptions_test.go @@ -0,0 +1,343 @@ +/* +Copyright 2026 Red Hat, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package commoncmdoptions_test + +import ( + "context" + "crypto/tls" + "encoding/json" + "errors" + "flag" + "fmt" + "os" + "os/exec" + "slices" + "testing" + + configv1 "github.com/openshift/api/config/v1" + utiltls "github.com/openshift/controller-runtime-common/pkg/tls" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + utilruntime "k8s.io/apimachinery/pkg/util/runtime" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + "k8s.io/client-go/tools/clientcmd" + "k8s.io/utils/ptr" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/envtest" + + "github.com/openshift/cluster-capi-operator/pkg/commoncmdoptions" + "github.com/openshift/cluster-capi-operator/pkg/controllers" + "github.com/openshift/cluster-capi-operator/pkg/test" +) + +// testExtraFlag* exercise InitOperatorConfig's extraFlags merge; names must not +// collide with CAPI manager or leader-election flags. +const ( + testExtraFlagName = "capi-operator-test-extra-string" + testExtraFlagDefault = "default-extra-test-value" + testExtraFlagCustom = "custom-extra-test-value" +) + +// configOutput is the JSON output from the re-exec'd subprocess. +type configOutput struct { + CAPINamespace string `json:"capiNamespace"` + MAPINamespace string `json:"mapiNamespace"` + OperatorNamespace string `json:"operatorNamespace"` + HealthAddr string `json:"healthAddr"` + LeaderElect bool `json:"leaderElect"` + LeaderElectionID string `json:"leaderElectionID"` //nolint:tagliatelle + LeaderElectionNS string `json:"leaderElectionNS"` //nolint:tagliatelle + LeaseDurationSecs int `json:"leaseDurationSecs"` + RenewDeadlineSecs int `json:"renewDeadlineSecs"` + RetryPeriodSecs int `json:"retryPeriodSecs"` + ManagerHealthAddr string `json:"managerHealthAddr,omitempty"` + ManagerExitReason string `json:"managerExitReason,omitempty"` + + // TLS: resolved manager options (after CLI override logic). + TLSMinVersion uint16 `json:"tlsMinVersion"` + TLSCipherSuites []string `json:"tlsCipherSuites"` + + // ExtraTestString is from the test-only extra flag.FlagSet passed to InitOperatorConfig. + ExtraTestString string `json:"extraTestString"` +} + +var ( + kubeconfigPath string + testEnv *envtest.Environment + cl client.Client +) + +type execMode string + +const ( + execModeInitConfig execMode = "initConfig" + + reexecModeEnvVar = "CAPIO_TEST_REEXEC" +) + +func TestMain(m *testing.M) { + // In reexec mode, the test reinvokes its own binary, passing the desired + // execution mode as an environment variable. + execMode := execMode(os.Getenv(reexecModeEnvVar)) + if execMode == execModeInitConfig { + runInitConfig() + return + } + + // Normal test path: start envtest, create APIServer object, run tests. + code, err := runTests(m) + if err != nil { + fmt.Fprintf(os.Stderr, "%v\n", err) + os.Exit(1) + } + + os.Exit(code) +} + +func runTests(m *testing.M) (_ int, err error) { + testEnv = &envtest.Environment{} + + _, cl, err = test.StartEnvTest(testEnv) + if err != nil { + return 1, fmt.Errorf("failed to start envtest: %w", err) + } + + defer func() { err = errors.Join(err, testEnv.Stop()) }() + + // Create the APIServer object required by resolveTLSProfile. + apiServer := &configv1.APIServer{ + ObjectMeta: metav1.ObjectMeta{ + Name: utiltls.APIServerName, + }, + } + if err := cl.Create(context.Background(), apiServer); err != nil { + return 1, fmt.Errorf("failed to create APIServer object: %w", err) + } + + // Write kubeconfig to a temp file for subprocesses. + kubeconfigPath, err = writeKubeconfig(testEnv.KubeConfig) + if err != nil { + return 1, fmt.Errorf("failed to write kubeconfig: %w", err) + } + + defer func() { err = errors.Join(err, os.Remove(kubeconfigPath)) }() + + return m.Run(), nil +} + +// reexecCmd returns a command that re-executes the test binary with the given +// mode, passing flags as command arguments. +func reexecCmd(t *testing.T, mode execMode, flags []string) *exec.Cmd { + t.Helper() + + // The test binary path. When run via `go test`, os.Args[0] is the + // compiled test binary. + cmd := exec.CommandContext(t.Context(), os.Args[0]) + cmd.Args = append([]string{os.Args[0]}, flags...) + cmd.Env = append( + // Start with a minimal environment to avoid polluting the subprocess. + filterEnv(os.Environ(), "HOME", "PATH", "KUBEBUILDER_ASSETS", "TMPDIR"), + reexecModeEnvVar+"="+string(mode), + "KUBECONFIG="+kubeconfigPath, + ) + + return cmd +} + +// --- Re-exec binary modes --- + +// runInitConfig is the subprocess entry point for testing InitOperatorConfig. +// It calls InitOperatorConfig with the flags from os.Args and prints the +// resulting configuration as JSON to stdout. +func runInitConfig() { + ctx := context.Background() + scheme := runtime.NewScheme() + utilruntime.Must(clientgoscheme.AddToScheme(scheme)) + utilruntime.Must(configv1.Install(scheme)) + + cfg, err := clientcmd.BuildConfigFromFlags("", os.Getenv("KUBECONFIG")) + if err != nil { + fmt.Fprintf(os.Stderr, "failed to build rest config: %v\n", err) + os.Exit(1) + } + + extraFlags := flag.NewFlagSet("", flag.ContinueOnError) + extraTestString := extraFlags.String(testExtraFlagName, testExtraFlagDefault, "test-only flag merged via extraFlags") + + _, operatorConfig, mgrOpts, _, err := commoncmdoptions.InitOperatorConfig(ctx, cfg, scheme, "test-manager", "test-namespace", extraFlags) + if err != nil { + fmt.Fprintf(os.Stderr, "InitOperatorConfig error: %v\n", err) + os.Exit(1) + } + + result := configOutput{ + CAPINamespace: ptr.Deref(operatorConfig.CAPINamespace, ""), + MAPINamespace: ptr.Deref(operatorConfig.MAPINamespace, ""), + OperatorNamespace: ptr.Deref(operatorConfig.OperatorNamespace, ""), + HealthAddr: mgrOpts.HealthProbeBindAddress, + LeaderElect: mgrOpts.LeaderElection, + LeaderElectionID: mgrOpts.LeaderElectionID, + LeaderElectionNS: mgrOpts.LeaderElectionNamespace, + ExtraTestString: ptr.Deref(extraTestString, ""), + } + + // Apply TLSOptions to a tls.Config to inspect what was configured. + tlsCfg := &tls.Config{} + for _, opt := range operatorConfig.TLSOptions { + opt(tlsCfg) + } + + result.TLSMinVersion = tlsCfg.MinVersion + for _, id := range tlsCfg.CipherSuites { + result.TLSCipherSuites = append(result.TLSCipherSuites, tls.CipherSuiteName(id)) + } + + if mgrOpts.LeaseDuration != nil { + result.LeaseDurationSecs = int(mgrOpts.LeaseDuration.Seconds()) + } + + if mgrOpts.RenewDeadline != nil { + result.RenewDeadlineSecs = int(mgrOpts.RenewDeadline.Seconds()) + } + + if mgrOpts.RetryPeriod != nil { + result.RetryPeriodSecs = int(mgrOpts.RetryPeriod.Seconds()) + } + + if err := json.NewEncoder(os.Stdout).Encode(result); err != nil { + fmt.Fprintf(os.Stderr, "failed to encode output: %v\n", err) + os.Exit(1) + } +} + +// --- Tests --- + +func TestInitOperatorConfig(t *testing.T) { + tests := []struct { + name string + flags []string + expectErr bool + verify func(t *testing.T, result configOutput) + }{ + { + name: "default flags", + flags: nil, + verify: func(t *testing.T, result configOutput) { + assertEqual(t, "CAPINamespace", result.CAPINamespace, controllers.DefaultCAPINamespace) + assertEqual(t, "MAPINamespace", result.MAPINamespace, controllers.DefaultMAPINamespace) + assertEqual(t, "OperatorNamespace", result.OperatorNamespace, controllers.DefaultOperatorNamespace) + assertEqual(t, "HealthAddr", result.HealthAddr, ":9440") + assertEqual(t, "LeaderElect", result.LeaderElect, true) + assertEqual(t, "LeaderElectionID", result.LeaderElectionID, "test-manager-leader") + assertEqual(t, "LeaderElectionNS", result.LeaderElectionNS, "test-namespace") + assertEqual(t, "LeaseDurationSecs", result.LeaseDurationSecs, int(commoncmdoptions.LeaseDuration.Seconds())) + assertEqual(t, "RenewDeadlineSecs", result.RenewDeadlineSecs, int(commoncmdoptions.RenewDeadline.Seconds())) + assertEqual(t, "RetryPeriodSecs", result.RetryPeriodSecs, int(commoncmdoptions.RetryPeriod.Seconds())) + assertEqual(t, "ExtraTestString", result.ExtraTestString, testExtraFlagDefault) + }, + }, + { + name: "custom namespaces", + flags: []string{ + "--capi-namespace=custom-capi", + "--mapi-namespace=custom-mapi", + "--operator-namespace=custom-operator", + "--" + testExtraFlagName + "=" + testExtraFlagCustom, + }, + verify: func(t *testing.T, result configOutput) { + assertEqual(t, "CAPINamespace", result.CAPINamespace, "custom-capi") + assertEqual(t, "MAPINamespace", result.MAPINamespace, "custom-mapi") + assertEqual(t, "OperatorNamespace", result.OperatorNamespace, "custom-operator") + assertEqual(t, "ExtraTestString", result.ExtraTestString, testExtraFlagCustom) + }, + }, + { + name: "custom health address", + flags: []string{"--health-addr=:0"}, + verify: func(t *testing.T, result configOutput) { + assertEqual(t, "HealthAddr", result.HealthAddr, ":0") + }, + }, + { + name: "leader election disabled", + flags: []string{"--leader-elect=false"}, + verify: func(t *testing.T, result configOutput) { + assertEqual(t, "LeaderElect", result.LeaderElect, false) + }, + }, + { + name: "TLS uses cluster profile when no CLI flags set", + flags: nil, + verify: func(t *testing.T, result configOutput) { + // Should use the cluster profile's min version. + assertEqual(t, "TLSMinVersion", result.TLSMinVersion, tls.VersionTLS12) + + // Cipher suites should be populated from the cluster profile. + if len(result.TLSCipherSuites) == 0 { + t.Error("TLSCipherSuites should not be empty when using cluster profile") + } + }, + }, + { + name: "TLS flags overridden by CLI", + flags: []string{"--tls-min-version=VersionTLS11", "--tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}, + verify: func(t *testing.T, result configOutput) { + // Both manager values should come from the CLI. + assertEqual(t, "TLSMinVersion", result.TLSMinVersion, uint16(tls.VersionTLS11)) + + wantCiphers := []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"} + if !slices.Equal(result.TLSCipherSuites, wantCiphers) { + t.Errorf("TLSCipherSuites: got %v, want %v", result.TLSCipherSuites, wantCiphers) + } + }, + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Logf("executing initConfig with flags: %v", tc.flags) + cmd := reexecCmd(t, execModeInitConfig, tc.flags) + + stdout, err := cmd.Output() + + var stderr string + + exitErr := &exec.ExitError{} + if errors.As(err, &exitErr) { + stderr = string(exitErr.Stderr) + } + + if tc.expectErr { + if err == nil { + t.Fatal("expected error but got none") + } + + return + } + + if err != nil { + t.Fatalf("unexpected error: %v\nstderr: %s", err, stderr) + } + + var result configOutput + if jsonErr := json.Unmarshal(stdout, &result); jsonErr != nil { + t.Fatalf("failed to parse JSON output: %v\nstdout: %s", jsonErr, string(stdout)) + } + + tc.verify(t, result) + }) + } +} diff --git a/pkg/commoncmdoptions/helpers_test.go b/pkg/commoncmdoptions/helpers_test.go new file mode 100644 index 0000000000..0a46b64247 --- /dev/null +++ b/pkg/commoncmdoptions/helpers_test.go @@ -0,0 +1,93 @@ +/* +Copyright 2026 Red Hat, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package commoncmdoptions_test + +import ( + "errors" + "fmt" + "os" + "path/filepath" + "testing" +) + +// Set the absolute path of the test binary (os.Args[0]). This is needed when +// the working directory might differ between parent and child processes. +func init() { + if filepath.IsAbs(os.Args[0]) { + return + } + + abs, err := filepath.Abs(os.Args[0]) + if err == nil { + os.Args[0] = abs + } +} + +func writeKubeconfig(kubeconfigBytes []byte) (string, error) { + tmpFile, err := os.CreateTemp("", "commoncmdoptions-test-kubeconfig-*.yaml") + if err != nil { + return "", fmt.Errorf("creating temp file: %w", err) + } + + if _, err := tmpFile.Write(kubeconfigBytes); err != nil { + err = errors.Join(err, + tmpFile.Close(), + os.Remove(tmpFile.Name()), + ) + + return "", fmt.Errorf("writing kubeconfig: %w", err) + } + + if err := tmpFile.Close(); err != nil { + err = errors.Join(err, + os.Remove(tmpFile.Name()), + ) + + return "", fmt.Errorf("closing kubeconfig: %w", err) + } + + return tmpFile.Name(), nil +} + +// filterEnv returns a subset of env containing only the named variables. +func filterEnv(env []string, keep ...string) []string { + keepSet := make(map[string]bool, len(keep)) + for _, k := range keep { + keepSet[k] = true + } + + var filtered []string + + for _, e := range env { + for k := range keepSet { + if len(e) > len(k) && e[:len(k)+1] == k+"=" { + filtered = append(filtered, e) + break + } + } + } + + return filtered +} + +func assertEqual[T comparable](t *testing.T, field string, got, want T) { + t.Helper() + + if got != want { + t.Errorf("%s: got %v, want %v", field, got, want) + } +} diff --git a/pkg/commoncmdoptions/tls.go b/pkg/commoncmdoptions/tls.go new file mode 100644 index 0000000000..bf60b6d59a --- /dev/null +++ b/pkg/commoncmdoptions/tls.go @@ -0,0 +1,83 @@ +/* +Copyright 2026 Red Hat, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package commoncmdoptions + +import ( + "context" + "fmt" + + "github.com/go-logr/logr" + configv1 "github.com/openshift/api/config/v1" + utiltls "github.com/openshift/controller-runtime-common/pkg/tls" + libgocrypto "github.com/openshift/library-go/pkg/crypto" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/rest" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/manager" +) + +// resolveTLSProfile fetches the cluster's TLS security profile from the APIServer +// configuration and returns: +// - the resolved TLS profile spec +// - a function to generate a SecurityProfileWatcher and add it to a manager +// +// The generator function takes manager and a cancel function. The cancel +// function should cancel the manager's context to trigger a restart. +func resolveTLSProfile(ctx context.Context, cfg *rest.Config, scheme *runtime.Scheme, log logr.Logger) (configv1.TLSProfileSpec, func(manager.Manager, context.CancelFunc) error, error) { + cl, err := client.New(cfg, client.Options{Scheme: scheme}) + if err != nil { + return configv1.TLSProfileSpec{}, nil, fmt.Errorf("unable to create initial client: %w", err) + } + + apiServer := &configv1.APIServer{} + if err = cl.Get(ctx, client.ObjectKey{Name: utiltls.APIServerName}, apiServer); err != nil { + return configv1.TLSProfileSpec{}, nil, fmt.Errorf("fetching APIServer: %w", err) + } + + tlsProfileSpec, err := TLSProfileSpecFromClusterConfig(apiServer.Spec.TLSAdherence, apiServer.Spec.TLSSecurityProfile) + if err != nil { + return configv1.TLSProfileSpec{}, nil, fmt.Errorf("resolving TLS profile: %w", err) + } + + setupSecurityProfileWatcher := func(mgr manager.Manager, cancel context.CancelFunc) error { + return (&utiltls.SecurityProfileWatcher{ + Client: mgr.GetClient(), + InitialTLSProfileSpec: tlsProfileSpec, + InitialTLSAdherencePolicy: apiServer.Spec.TLSAdherence, + OnProfileChange: func(_ context.Context, _, _ configv1.TLSProfileSpec) { + log.Info("TLS profile changed, restarting") + cancel() + }, + OnAdherencePolicyChange: func(_ context.Context, _, _ configv1.TLSAdherencePolicy) { + log.Info("TLS adherence policy changed, restarting") + cancel() + }, + }).SetupWithManager(mgr) + } + + return tlsProfileSpec, setupSecurityProfileWatcher, nil +} + +// TLSProfileSpecFromClusterConfig resolves the TLS profile spec from the cluster's TLS +// security profile and adherence policy. +func TLSProfileSpecFromClusterConfig(tlsAdherence configv1.TLSAdherencePolicy, tlsSecurityProfile *configv1.TLSSecurityProfile) (configv1.TLSProfileSpec, error) { + if !libgocrypto.ShouldHonorClusterTLSProfile(tlsAdherence) { + tlsSecurityProfile = nil + } + + return utiltls.GetTLSProfileSpec(tlsSecurityProfile) //nolint:wrapcheck +} diff --git a/pkg/controllers/installer/helpers_test.go b/pkg/controllers/installer/helpers_test.go index a9bbe2e85a..00f0c8623c 100644 --- a/pkg/controllers/installer/helpers_test.go +++ b/pkg/controllers/installer/helpers_test.go @@ -17,8 +17,10 @@ limitations under the License. package installer import ( + "cmp" "context" "fmt" + "slices" "strings" . "github.com/onsi/ginkgo/v2" @@ -240,6 +242,12 @@ func setupProviderProfiles() { } } +func latestRevision(revisions []operatorv1alpha1.ClusterAPIInstallerRevision) operatorv1alpha1.ClusterAPIInstallerRevision { + return slices.MaxFunc(revisions, func(a, b operatorv1alpha1.ClusterAPIInstallerRevision) int { + return cmp.Compare(a.Revision, b.Revision) + }) +} + // addRevision appends a new revision to ClusterAPI.Status.Revisions. // It uses revisiongenerator to compute the content ID, then writes via status update. func addRevision(ctx context.Context, providerNames ...string) operatorv1alpha1.ClusterAPIInstallerRevision { @@ -258,7 +266,12 @@ func addRevision(ctx context.Context, providerNames ...string) operatorv1alpha1. rendered, err := revisiongenerator.NewRenderedRevision(profiles) Expect(err).NotTo(HaveOccurred()) - revisionIndex := int64(len(clusterAPI.Status.Revisions) + 1) + var revisionIndex int64 + if len(clusterAPI.Status.Revisions) == 0 { + revisionIndex = 1 + } else { + revisionIndex = latestRevision(clusterAPI.Status.Revisions).Revision + 1 + } installerRev, err := rendered.ForInstall("4.18.0-test", revisionIndex) Expect(err).NotTo(HaveOccurred()) diff --git a/pkg/controllers/installer/installer_controller_test.go b/pkg/controllers/installer/installer_controller_test.go index f847214e1c..21cbf4f079 100644 --- a/pkg/controllers/installer/installer_controller_test.go +++ b/pkg/controllers/installer/installer_controller_test.go @@ -221,10 +221,12 @@ var _ = Describe("InstallerController", Serial, func() { ContentID: "bogus-content-id", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ { - Type: operatorv1alpha1.InstallerComponentTypeImage, - Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "registry.example.com/nonexistent@sha256:0000000000000000000000000000000000000000000000000000000000000000", - Profile: "default", + ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, + Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "registry.example.com/nonexistent@sha256:0000000000000000000000000000000000000000000000000000000000000000", + Profile: "default", + }, }, }, }, @@ -299,10 +301,12 @@ var _ = Describe("InstallerController", Serial, func() { Revision: int64(len(clusterAPI.Status.Revisions) + 1), ContentID: "placeholder", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{{ - Type: operatorv1alpha1.InstallerComponentTypeImage, - Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: operatorv1alpha1.ImageDigestFormat(profile.ImageRef), - Profile: profile.Profile, + ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, + Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: operatorv1alpha1.ImageDigestFormat(profile.ImageRef), + Profile: profile.Profile, + }, }, }}, } @@ -365,10 +369,12 @@ var _ = Describe("InstallerController", Serial, func() { ContentID: "invalid-content-id", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ { - Type: operatorv1alpha1.InstallerComponentTypeImage, - Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "registry.example.com/nonexistent@sha256:0000000000000000000000000000000000000000000000000000000000000000", - Profile: "default", + ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, + Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "registry.example.com/nonexistent@sha256:0000000000000000000000000000000000000000000000000000000000000000", + Profile: "default", + }, }, }, }, @@ -536,8 +542,10 @@ var _ = Describe("InstallerController", Serial, func() { // Add an empty revision. The old revision remains in the // revision list being torn down, so its objects should still // appear in relatedObjects for must-gather. + var emptyRevision operatorv1alpha1.ClusterAPIInstallerRevision + By("adding an empty revision", func() { - emptyRevision := addEmptyRevision(ctx) + emptyRevision = addEmptyRevision(ctx) waitForRevision(ctx, emptyRevision.Name) }) @@ -550,9 +558,9 @@ var _ = Describe("InstallerController", Serial, func() { clusterAPI := &operatorv1alpha1.ClusterAPI{} Expect(cl.Get(ctx, client.ObjectKey{Name: clusterAPIName}, clusterAPI)).To(Succeed()) - clusterAPI.Status.Revisions = nil - clusterAPI.Status.DesiredRevision = "" - clusterAPI.Status.CurrentRevision = "" + clusterAPI.Status.Revisions = []operatorv1alpha1.ClusterAPIInstallerRevision{emptyRevision} + clusterAPI.Status.DesiredRevision = emptyRevision.Name + clusterAPI.Status.CurrentRevision = emptyRevision.Name Expect(cl.Status().Update(ctx, clusterAPI)).To(Succeed()) }) diff --git a/pkg/controllers/revision/helpers_test.go b/pkg/controllers/revision/helpers_test.go index 74a0bae892..fc8c3e6e3d 100644 --- a/pkg/controllers/revision/helpers_test.go +++ b/pkg/controllers/revision/helpers_test.go @@ -18,6 +18,7 @@ package revision import ( "context" + "crypto/tls" "slices" . "github.com/onsi/ginkgo/v2" @@ -43,7 +44,7 @@ type managerWrapper struct { done chan struct{} } -func newManagerWrapper(providerImgs []providerimages.ProviderImageManifests) *managerWrapper { +func newManagerWrapper(providerImgs []providerimages.ProviderImageManifests, tlsOptions ...func(config *tls.Config)) *managerWrapper { // Don't use the BeforeEach context because it will be cancelled before the test starts. ctx := context.Background() @@ -58,11 +59,21 @@ func newManagerWrapper(providerImgs []providerimages.ProviderImageManifests) *ma }) Expect(err).NotTo(HaveOccurred()) + if len(tlsOptions) == 0 { + tlsOptions = []func(config *tls.Config){ + func(config *tls.Config) { + // Arbitrarily chosen insecure default tls configuration for tests + config.CipherSuites = []uint16{tls.TLS_RSA_WITH_RC4_128_SHA} + config.MinVersion = tls.VersionTLS10 + }, + } + } + err = (&RevisionController{ Client: mgr.GetClient(), ProviderProfiles: imgs, ReleaseVersion: "4.18.0", - }).SetupWithManager(mgr) + }).SetupWithManager(mgr, tlsOptions) Expect(err).NotTo(HaveOccurred()) mgrCtx, mgrCancel := context.WithCancel(ctx) diff --git a/pkg/controllers/revision/revision_controller.go b/pkg/controllers/revision/revision_controller.go index 2147564d6f..d276ff8b97 100644 --- a/pkg/controllers/revision/revision_controller.go +++ b/pkg/controllers/revision/revision_controller.go @@ -19,6 +19,7 @@ package revision import ( "cmp" "context" + "crypto/tls" "errors" "fmt" "slices" @@ -28,6 +29,7 @@ import ( configv1 "github.com/openshift/api/config/v1" operatorv1alpha1 "github.com/openshift/api/operator/v1alpha1" operatorv1alpha1ac "github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1" + libgocrypto "github.com/openshift/library-go/pkg/crypto" apierrors "k8s.io/apimachinery/pkg/api/errors" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/builder" @@ -63,6 +65,9 @@ type RevisionController struct { client.Client ProviderProfiles []providerimages.ProviderImageManifests ReleaseVersion string + + // manifestSubstitutions is derived from TLSProfileSpec during SetupWithManager. + manifestSubstitutions map[string]string } // Reconcile handles creating revisions in the ClusterAPI singleton status. @@ -142,7 +147,7 @@ func (r *RevisionController) generateDesiredRevision(ctx context.Context) (revis // Build ordered component list from provider metadata providerComponents := r.buildComponentList(infra.Status.PlatformStatus.Type) - revision, err := revisiongenerator.NewRenderedRevision(providerComponents) + revision, err := revisiongenerator.NewRenderedRevision(providerComponents, revisiongenerator.WithManifestSubstitutions(r.manifestSubstitutions)) if err != nil { return nil, opresult.ErrorP(fmt.Errorf("error creating rendered revision: %w", err)) } @@ -222,6 +227,7 @@ func (r *RevisionController) writeRevisions(ctx context.Context, log logr.Logger applyConfig := operatorv1alpha1ac.ClusterAPI(clusterAPI.Name). WithStatus(operatorv1alpha1ac.ClusterAPIStatus(). + WithObservedRevisionGeneration(clusterAPI.Generation). WithDesiredRevision(apiRevisions[0].Name). WithRevisions(revisionACPtrs...)) @@ -262,7 +268,17 @@ func (r *RevisionController) buildComponentList(platform configv1.PlatformType) } // SetupWithManager sets up the controller with the Manager. -func (r *RevisionController) SetupWithManager(mgr ctrl.Manager) error { +func (r *RevisionController) SetupWithManager(mgr ctrl.Manager, tlsOptions []func(config *tls.Config)) error { + tlsCfg := &tls.Config{} + for _, opt := range tlsOptions { + opt(tlsCfg) + } + + r.manifestSubstitutions = map[string]string{ + "TLS_MIN_VERSION": libgocrypto.TLSVersionToNameOrDie(tlsCfg.MinVersion), + "TLS_CIPHER_SUITES": strings.Join(util.SliceMap(tlsCfg.CipherSuites, tls.CipherSuiteName), ","), + } + isInfrastructureReady := func(obj client.Object) bool { if obj == nil { return false diff --git a/pkg/controllers/revision/revision_controller_test.go b/pkg/controllers/revision/revision_controller_test.go index 1894067a60..1f2fa8228f 100644 --- a/pkg/controllers/revision/revision_controller_test.go +++ b/pkg/controllers/revision/revision_controller_test.go @@ -18,6 +18,7 @@ package revision import ( "context" + "crypto/tls" "errors" "testing" @@ -156,6 +157,9 @@ var _ = Describe("RevisionController", Serial, func() { // DesiredRevision should point to the created revision Expect(updatedClusterAPI.Status.DesiredRevision).To(Equal(rev.Name)) + // ObservedRevisionGeneration should match the ClusterAPI generation + Expect(updatedClusterAPI.Status.ObservedRevisionGeneration).To(Equal(updatedClusterAPI.Generation)) + // Conditions should indicate success co := &configv1.ClusterOperator{} Expect(cl.Get(ctx, client.ObjectKey{Name: "cluster-api"}, co)).To(Succeed()) @@ -200,6 +204,7 @@ var _ = Describe("RevisionController", Serial, func() { Expect(cl.Get(ctx, client.ObjectKey{Name: "cluster"}, updatedClusterAPI)).To(Succeed()) Expect(updatedClusterAPI.Status.Revisions).To(Equal(originalRevisions)) Expect(updatedClusterAPI.Status.DesiredRevision).To(Equal(originalDesiredRevision)) + Expect(updatedClusterAPI.Status.ObservedRevisionGeneration).To(Equal(updatedClusterAPI.Generation)) }, defaultNodeTimeout) It("creates additional revision when contentID changes", func(ctx context.Context) { @@ -242,6 +247,9 @@ var _ = Describe("RevisionController", Serial, func() { // DesiredRevision should point to the new revision Expect(clusterAPI.Status.DesiredRevision).To(Equal(newRev.Name)) + + // ObservedRevisionGeneration should match the ClusterAPI generation + Expect(clusterAPI.Status.ObservedRevisionGeneration).To(Equal(clusterAPI.Generation)) }, defaultNodeTimeout) It("creates revision with empty components when no providers match the platform", func(ctx context.Context) { @@ -262,6 +270,7 @@ var _ = Describe("RevisionController", Serial, func() { // DesiredRevision should point to the new revision Expect(clusterAPI.Status.DesiredRevision).To(Equal(newRev.Name)) + Expect(clusterAPI.Status.ObservedRevisionGeneration).To(Equal(clusterAPI.Generation)) }, defaultNodeTimeout) It("trims old revisions when current matches latest", func(ctx context.Context) { @@ -291,6 +300,7 @@ var _ = Describe("RevisionController", Serial, func() { // Verify the remaining revision is the latest. Expect(clusterAPI.Status.Revisions[0].Name).To(Equal(latest.Name)) Expect(clusterAPI.Status.DesiredRevision).To(Equal(latest.Name)) + Expect(clusterAPI.Status.ObservedRevisionGeneration).To(Equal(clusterAPI.Generation)) }, defaultNodeTimeout) It("preserves all revisions when content changes and current is set", func(ctx context.Context) { @@ -316,6 +326,7 @@ var _ = Describe("RevisionController", Serial, func() { // CurrentRevision (rev1) != newest revision (rev2). Expect(clusterAPI.Status.DesiredRevision).NotTo(Equal(rev1Name)) Expect(clusterAPI.Status.CurrentRevision).To(Equal(rev1Name)) + Expect(clusterAPI.Status.ObservedRevisionGeneration).To(Equal(clusterAPI.Generation)) }, defaultNodeTimeout) It("sets Degraded=True with NonRetryableError when max revisions reached", func(ctx context.Context) { @@ -338,10 +349,12 @@ var _ = Describe("RevisionController", Serial, func() { ContentID: "content-id-" + string(rune('a'+i)), Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ { - Type: operatorv1alpha1.InstallerComponentTypeImage, - Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: operatorv1alpha1.ImageDigestFormat("quay.io/openshift/cluster-capi-operator@sha256:" + digest), - Profile: "default", + ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, + Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: operatorv1alpha1.ImageDigestFormat("quay.io/openshift/cluster-capi-operator@sha256:" + digest), + Profile: "default", + }, }, }, }, @@ -438,6 +451,7 @@ var _ = Describe("RevisionController waiting states", Serial, func() { updatedClusterAPI := &operatorv1alpha1.ClusterAPI{} Expect(cl.Get(ctx, client.ObjectKey{Name: "cluster"}, updatedClusterAPI)).To(Succeed()) Expect(updatedClusterAPI.Status.Revisions).To(HaveLen(1)) + Expect(updatedClusterAPI.Status.ObservedRevisionGeneration).To(Equal(updatedClusterAPI.Generation)) }, defaultNodeTimeout) }) @@ -479,10 +493,41 @@ var _ = Describe("RevisionController waiting states", Serial, func() { updatedClusterAPI := &operatorv1alpha1.ClusterAPI{} Expect(cl.Get(ctx, client.ObjectKey{Name: "cluster"}, updatedClusterAPI)).To(Succeed()) Expect(updatedClusterAPI.Status.Revisions).To(HaveLen(1)) + Expect(updatedClusterAPI.Status.ObservedRevisionGeneration).To(Equal(updatedClusterAPI.Generation)) }, defaultNodeTimeout) }) }) +var _ = Describe("RevisionController manifest substitutions", Serial, func() { + BeforeEach(func(ctx context.Context) { + createFixtures(ctx) + }, defaultNodeTimeout) + + It("includes substitutions in created revision", func(ctx context.Context) { + mgr := newManagerWrapper(defaultProviderImgs, func(config *tls.Config) { + config.CipherSuites = []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256} + config.MinVersion = tls.VersionTLS12 + }) + + DeferCleanup(func(ctx context.Context) { + mgr.stop() + }) + + waitForProgressingFalse(ctx) + + updatedClusterAPI := &operatorv1alpha1.ClusterAPI{} + Expect(cl.Get(ctx, client.ObjectKey{Name: "cluster"}, updatedClusterAPI)).To(Succeed()) + Expect(updatedClusterAPI.Status.Revisions).To(HaveLen(1)) + + rev := updatedClusterAPI.Status.Revisions[0] + Expect(rev.ManifestSubstitutions).To(HaveLen(2)) + Expect(rev.ManifestSubstitutions[0].Key).To(Equal("TLS_CIPHER_SUITES")) + Expect(*rev.ManifestSubstitutions[0].Value).To(Equal("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256")) + Expect(rev.ManifestSubstitutions[1].Key).To(Equal("TLS_MIN_VERSION")) + Expect(*rev.ManifestSubstitutions[1].Value).To(Equal("VersionTLS12")) + }, defaultNodeTimeout) +}) + var _ = Describe("RevisionController error handling", Serial, func() { var ( testErr = errors.New("simulated status update error") diff --git a/pkg/revisiongenerator/revision.go b/pkg/revisiongenerator/revision.go index 75cf5ba289..70704811ee 100644 --- a/pkg/revisiongenerator/revision.go +++ b/pkg/revisiongenerator/revision.go @@ -17,11 +17,13 @@ limitations under the License. package revisiongenerator import ( + "cmp" "crypto/sha256" "encoding/hex" "encoding/json" "errors" "fmt" + "maps" "slices" operatorv1alpha1 "github.com/openshift/api/operator/v1alpha1" @@ -88,8 +90,9 @@ type RenderedComponent interface { } type renderedRevision struct { - components []*renderedComponent - contentID string + components []*renderedComponent + contentID string + substitutions []operatorv1alpha1.ClusterAPIInstallerRevisionManifestSubstitution } var _ RenderedRevision = &renderedRevision{} @@ -118,7 +121,10 @@ func newRenderedRevision(profiles []providerimages.ProviderImageManifests, opts components[i] = component } - rev := &renderedRevision{components: components} + rev := &renderedRevision{ + components: components, + substitutions: substitutionsFromMap(cfg.substitutions), + } if err := validateRenderedRevision(rev); err != nil { return nil, err @@ -127,9 +133,30 @@ func newRenderedRevision(profiles []providerimages.ProviderImageManifests, opts return rev, nil } +// substitutionsFromMap converts a map to a sorted slice of API substitutions. +func substitutionsFromMap(m map[string]string) []operatorv1alpha1.ClusterAPIInstallerRevisionManifestSubstitution { + if len(m) == 0 { + return nil + } + + subs := make([]operatorv1alpha1.ClusterAPIInstallerRevisionManifestSubstitution, 0, len(m)) + for k, v := range m { + subs = append(subs, operatorv1alpha1.ClusterAPIInstallerRevisionManifestSubstitution{ + Key: k, + Value: &v, + }) + } + + slices.SortFunc(subs, func(a, b operatorv1alpha1.ClusterAPIInstallerRevisionManifestSubstitution) int { + return cmp.Compare(a.Key, b.Key) + }) + + return subs +} + // ContentID returns a unique identifier for the revision's content. -// Specifically it returns a SHA256 over all manifests, but callers MUST NOT -// assume this. +// Specifically it returns a SHA256 over all manifests and substitutions, +// but callers MUST NOT assume this. func (r *renderedRevision) ContentID() (string, error) { if r.contentID == "" { h := sha256.New() @@ -143,6 +170,17 @@ func (r *renderedRevision) ContentID() (string, error) { h.Write([]byte(contentID)) } + // Include substitutions in the hash so that different substitutions + // always produce a different content ID and therefore trigger a new + // revision, even if they were not used. This is not strictly necessary, + // but it should reduce operator confusion if old but unused + // substitutions continued to be listed in the current revision. + if data, err := json.Marshal(r.substitutions); err == nil { + h.Write(data) + } else { + return "", fmt.Errorf("error marshalling substitutions: %w", err) + } + r.contentID = hex.EncodeToString(h.Sum(nil)) } @@ -201,10 +239,13 @@ func (r *installerRevision) ToAPIRevision() (operatorv1alpha1.ClusterAPIInstalle apiComponents := make([]operatorv1alpha1.ClusterAPIInstallerComponent, len(r.components)) for i, component := range r.components { apiComponents[i] = operatorv1alpha1.ClusterAPIInstallerComponent{ - Type: operatorv1alpha1.InstallerComponentTypeImage, - Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: operatorv1alpha1.ImageDigestFormat(component.imageRef), - Profile: component.profile, + Name: component.name, + ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, + Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: operatorv1alpha1.ImageDigestFormat(component.imageRef), + Profile: component.profile, + }, }, } } @@ -215,10 +256,11 @@ func (r *installerRevision) ToAPIRevision() (operatorv1alpha1.ClusterAPIInstalle } return operatorv1alpha1.ClusterAPIInstallerRevision{ - Name: r.revisionName, - Revision: r.revisionIndex, - ContentID: contentID, - Components: apiComponents, + Name: r.revisionName, + Revision: r.revisionIndex, + ContentID: contentID, + ManifestSubstitutions: slices.Clone(r.substitutions), + Components: apiComponents, }, nil } @@ -246,6 +288,7 @@ func buildRevisionName(releaseVersion, contentID string, index int64) operatorv1 type revisionRenderConfig struct { objectCollectors []RevisionObjectCollector + substitutions map[string]string } type revisionRenderOption func(*revisionRenderConfig) @@ -261,6 +304,19 @@ func WithObjectCollectors(collectors ...RevisionObjectCollector) revisionRenderO } } +// WithManifestSubstitutions adds envsubst-style substitutions that will be +// applied to manifests during rendering and recorded on the revision. When +// called multiple times, later values merge with and override earlier ones. +func WithManifestSubstitutions(subs map[string]string) revisionRenderOption { + return func(opts *revisionRenderConfig) { + if opts.substitutions == nil { + opts.substitutions = make(map[string]string, len(subs)) + } + + maps.Copy(opts.substitutions, subs) + } +} + // NewInstallerRevisionFromAPI creates an InstallerRevision by matching the // components in an API revision against the provided provider profiles and // rendering the matched manifests. The revision name and index are taken @@ -294,6 +350,18 @@ func NewInstallerRevisionFromAPI( } } + // Prepend substitutions from the API revision so they are applied during + // rendering and included in the content ID for validation. Later options + // merge with and override these values. + apiSubs := make(map[string]string, len(apiRev.ManifestSubstitutions)) + for _, s := range apiRev.ManifestSubstitutions { + if s.Value != nil { + apiSubs[s.Key] = *s.Value + } + } + + opts = append([]revisionRenderOption{WithManifestSubstitutions(apiSubs)}, opts...) + rendered, err := newRenderedRevision(matched, opts...) if err != nil { return nil, err @@ -335,7 +403,7 @@ func newRenderedComponent(providerProfile *providerimages.ProviderImageManifests return nil, fmt.Errorf("error reading manifests: %w", err) } - yaml, err = transformYaml(providerProfile, yaml) + yaml, err = transformYaml(providerProfile, yaml, cfg.substitutions) if err != nil { return nil, fmt.Errorf("error transforming manifest yaml: %w", err) } diff --git a/pkg/revisiongenerator/revision_test.go b/pkg/revisiongenerator/revision_test.go index fddd50b499..ef17dd5f9c 100644 --- a/pkg/revisiongenerator/revision_test.go +++ b/pkg/revisiongenerator/revision_test.go @@ -227,6 +227,59 @@ func TestContentID(t *testing.T) { id := must(rev.ContentID())(g) g.Expect(id).NotTo(BeEmpty()) }) + + t.Run("different substitutions produce different contentID", func(t *testing.T) { + g := NewWithT(t) + + prof := test.NewProviderImageManifests(t, "p1"). + WithImageRef("img1"). + WithManifests(`apiVersion: v1 +kind: ConfigMap +metadata: + name: cm +data: + v: "${VAR1}"`). + Build() + profiles := []providerimages.ProviderImageManifests{prof} + + rev1 := must(NewRenderedRevision(profiles, WithManifestSubstitutions(map[string]string{"VAR1": "value1"})))(g) + rev2 := must(NewRenderedRevision(profiles, WithManifestSubstitutions(map[string]string{"VAR1": "value2"})))(g) + + id1 := must(rev1.ContentID())(g) + id2 := must(rev2.ContentID())(g) + + g.Expect(id1).NotTo(Equal(id2)) + }) + + t.Run("same substitutions produce same contentID", func(t *testing.T) { + g := NewWithT(t) + + profiles := []providerimages.ProviderImageManifests{profile(t, "p1", "img1", "default", configMapA)} + + subs := map[string]string{"VAR1": "value1"} + + rev1 := must(NewRenderedRevision(profiles, WithManifestSubstitutions(subs)))(g) + rev2 := must(NewRenderedRevision(profiles, WithManifestSubstitutions(subs)))(g) + + id1 := must(rev1.ContentID())(g) + id2 := must(rev2.ContentID())(g) + + g.Expect(id1).To(Equal(id2)) + }) + + t.Run("substitutions affect contentID even without matching vars", func(t *testing.T) { + g := NewWithT(t) + + profiles := []providerimages.ProviderImageManifests{profile(t, "p1", "img1", "default", configMapA)} + + rev1 := must(NewRenderedRevision(profiles))(g) + rev2 := must(NewRenderedRevision(profiles, WithManifestSubstitutions(map[string]string{"UNUSED_VAR": "unused_value"})))(g) + + id1 := must(rev1.ContentID())(g) + id2 := must(rev2.ContentID())(g) + + g.Expect(id1).NotTo(Equal(id2)) + }) } func TestForInstall(t *testing.T) { @@ -288,6 +341,7 @@ func TestToAPIRevision(t *testing.T) { g.Expect(apiRev.Revision).To(Equal(int64(1))) g.Expect(apiRev.ContentID).NotTo(BeEmpty()) g.Expect(apiRev.Components).To(HaveLen(1)) + g.Expect(apiRev.Components[0].Name).To(Equal("core")) g.Expect(apiRev.Components[0].Type).To(Equal(operatorv1alpha1.InstallerComponentTypeImage)) g.Expect(string(apiRev.Components[0].Image.Ref)).To(Equal("quay.io/openshift/core@sha256:abcd")) g.Expect(apiRev.Components[0].Image.Profile).To(Equal("default")) @@ -304,12 +358,27 @@ func TestToAPIRevision(t *testing.T) { apiRev := must(forInstall(g, rev, "4.18.0", 1).ToAPIRevision())(g) g.Expect(apiRev.Components).To(HaveLen(2)) + g.Expect(apiRev.Components[0].Name).To(Equal("core")) g.Expect(string(apiRev.Components[0].Image.Ref)).To(Equal("img-core")) g.Expect(apiRev.Components[0].Image.Profile).To(Equal("default")) + g.Expect(apiRev.Components[1].Name).To(Equal("infra")) g.Expect(string(apiRev.Components[1].Image.Ref)).To(Equal("img-infra")) g.Expect(apiRev.Components[1].Image.Profile).To(Equal("aws")) }) + t.Run("component with empty name", func(t *testing.T) { + g := NewWithT(t) + + unnamed := profile(t, "placeholder", "img1", "default", configMapA) + unnamed.Name = "" + + rev := must(NewRenderedRevision([]providerimages.ProviderImageManifests{unnamed}))(g) + apiRev := must(forInstall(g, rev, "4.18.0", 1).ToAPIRevision())(g) + + g.Expect(apiRev.Components).To(HaveLen(1)) + g.Expect(apiRev.Components[0].Name).To(BeEmpty()) + }) + t.Run("name format", func(t *testing.T) { g := NewWithT(t) @@ -348,6 +417,28 @@ func TestToAPIRevision(t *testing.T) { g.Expect(apiRev.Components).To(HaveLen(0)) g.Expect(apiRev.ContentID).NotTo(BeEmpty()) }) + + t.Run("substitutions included in API revision", func(t *testing.T) { + g := NewWithT(t) + + subs := map[string]string{ + "TLS_CIPHER_SUITES": "TLS_AES_128_GCM_SHA256", + "TLS_MIN_VERSION": "VersionTLS12", + } + + rev := must(NewRenderedRevision( + []providerimages.ProviderImageManifests{profile(t, "core", "img1", "default", configMapA)}, + WithManifestSubstitutions(subs), + ))(g) + + apiRev := must(forInstall(g, rev, "4.18.0", 1).ToAPIRevision())(g) + + g.Expect(apiRev.ManifestSubstitutions).To(HaveLen(2)) + g.Expect(apiRev.ManifestSubstitutions[0].Key).To(Equal("TLS_CIPHER_SUITES")) + g.Expect(*apiRev.ManifestSubstitutions[0].Value).To(Equal("TLS_AES_128_GCM_SHA256")) + g.Expect(apiRev.ManifestSubstitutions[1].Key).To(Equal("TLS_MIN_VERSION")) + g.Expect(*apiRev.ManifestSubstitutions[1].Value).To(Equal("VersionTLS12")) + }) } func TestNewRenderedRevision(t *testing.T) { @@ -401,6 +492,42 @@ data: g.Expect(id1).To(Equal(id2)) }) + + t.Run("user substitutions applied during construction", func(t *testing.T) { + g := NewWithT(t) + + // Manifest with a user-provided envsubst variable + provWithVar := test.NewProviderImageManifests(t, "p1"). + WithImageRef("img1"). + WithManifests(`apiVersion: v1 +kind: ConfigMap +metadata: + name: cm +data: + v: "${MY_VAR}"`). + Build() + provExpanded := test.NewProviderImageManifests(t, "p1"). + WithImageRef("img1"). + WithManifests(`apiVersion: v1 +kind: ConfigMap +metadata: + name: cm +data: + v: "hello"`). + Build() + + subs := map[string]string{"MY_VAR": "hello"} + + // Both use the same substitutions, so the hash of substitutions is identical. + // The manifest content after rendering is also identical. + rev1 := must(NewRenderedRevision([]providerimages.ProviderImageManifests{provWithVar}, WithManifestSubstitutions(subs)))(g) + rev2 := must(NewRenderedRevision([]providerimages.ProviderImageManifests{provExpanded}, WithManifestSubstitutions(subs)))(g) + + id1 := must(rev1.ContentID())(g) + id2 := must(rev2.ContentID())(g) + + g.Expect(id1).To(Equal(id2)) + }) } func TestComponents(t *testing.T) { @@ -511,12 +638,16 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ ContentID: contentIDForProfiles(g, profiles[0], profiles[1]), Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", - }}, - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/aws@sha256:bbbb", Profile: "aws", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", + }}, + }, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/aws@sha256:bbbb", Profile: "aws", + }}, + }, }, } @@ -537,9 +668,11 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { Revision: 3, ContentID: contentIDForProfiles(g, profiles[0]), Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", + }}, + }, }, } @@ -556,12 +689,16 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ ContentID: contentIDForProfiles(g, profiles[2], profiles[0]), Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/azure@sha256:cccc", Profile: "azure", - }}, - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/azure@sha256:cccc", Profile: "azure", + }}, + }, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", + }}, + }, }, } @@ -580,9 +717,11 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ ContentID: contentIDForProfiles(g, profiles[2]), Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/azure@sha256:cccc", Profile: "azure", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/azure@sha256:cccc", Profile: "azure", + }}, + }, }, } @@ -598,9 +737,11 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/nonexistent@sha256:ffff", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/nonexistent@sha256:ffff", Profile: "default", + }}, + }, }, } @@ -615,9 +756,11 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "wrong-profile", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "wrong-profile", + }}, + }, }, } @@ -646,12 +789,16 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ ContentID: expectedContentID, Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", - }}, - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/aws@sha256:bbbb", Profile: "aws", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", + }}, + }, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/aws@sha256:bbbb", Profile: "aws", + }}, + }, }, } @@ -665,9 +812,11 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { apiRev := operatorv1alpha1.ClusterAPIInstallerRevision{ ContentID: "does-not-match-any-rendered-content", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", + }}, + }, }, } @@ -675,6 +824,40 @@ func TestNewInstallerRevisionFromAPI(t *testing.T) { g.Expect(err).To(HaveOccurred()) g.Expect(err.Error()).To(ContainSubstring("content ID mismatch")) }) + + t.Run("substitutions from API revision applied during rendering", func(t *testing.T) { + g := NewWithT(t) + + // Create a profile with a variable that needs substitution + prof := test.NewProviderImageManifests(t, "core"). + WithImageRef("quay.io/openshift/core@sha256:aaaa"). + WithProfile("default"). + WithManifests(`apiVersion: v1 +kind: ConfigMap +metadata: + name: cm +data: + tlsVersion: "${TLS_MIN_VERSION}"`). + Build() + + subs := map[string]string{"TLS_MIN_VERSION": "VersionTLS12"} + + // Create a revision with substitutions and convert to API revision + rev := must(NewRenderedRevision( + []providerimages.ProviderImageManifests{prof}, + WithManifestSubstitutions(subs), + ))(g) + + apiRev := must(forInstall(g, rev, "4.18.0", 1).ToAPIRevision())(g) + + // Round-trip: reconstruct from API revision with same profiles + reconstructed := must(NewInstallerRevisionFromAPI(apiRev, []providerimages.ProviderImageManifests{prof}))(g) + + // Content ID validation passes, confirming substitutions were applied correctly + reconstructedContentID := must(reconstructed.ContentID())(g) + g.Expect(reconstructedContentID).To(Equal(apiRev.ContentID)) + g.Expect(reconstructed.Components()).To(HaveLen(1)) + }) } func TestRevisionsToApplyConfig(t *testing.T) { @@ -687,13 +870,13 @@ func TestRevisionsToApplyConfig(t *testing.T) { Revision: 1, ContentID: "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - { + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ Ref: "quay.io/openshift/core@sha256:aaaa", Profile: "default", }, - }, + }}, }, }, } @@ -727,9 +910,11 @@ func TestRevisionsToApplyConfig(t *testing.T) { Revision: 1, ContentID: "id1", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "img-a", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "img-a", Profile: "default", + }}, + }, }, }, { @@ -737,12 +922,16 @@ func TestRevisionsToApplyConfig(t *testing.T) { Revision: 2, ContentID: "id2", Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "img-b", Profile: "aws", - }}, - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "img-c", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "img-b", Profile: "aws", + }}, + }, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "img-c", Profile: "default", + }}, + }, }, }, } @@ -768,6 +957,41 @@ func TestRevisionsToApplyConfig(t *testing.T) { g.Expect(acs).To(BeEmpty()) }) + t.Run("manifestSubstitutions preserved", func(t *testing.T) { + g := NewWithT(t) + + v1 := "VersionTLS12" + v2 := "TLS_AES_128_GCM_SHA256" + + revs := []operatorv1alpha1.ClusterAPIInstallerRevision{ + { + Name: "4.18.0-abcd1234-1", + Revision: 1, + ContentID: "id1", + ManifestSubstitutions: []operatorv1alpha1.ClusterAPIInstallerRevisionManifestSubstitution{ + {Key: "TLS_MIN_VERSION", Value: &v1}, + {Key: "TLS_CIPHER_SUITES", Value: &v2}, + }, + Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "img-a", Profile: "default", + }}, + }, + }, + }, + } + + acs, err := RevisionsToApplyConfig(revs) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(acs).To(HaveLen(1)) + g.Expect(acs[0].ManifestSubstitutions).To(HaveLen(2)) + g.Expect(*acs[0].ManifestSubstitutions[0].Key).To(Equal("TLS_MIN_VERSION")) + g.Expect(*acs[0].ManifestSubstitutions[0].Value).To(Equal("VersionTLS12")) + g.Expect(*acs[0].ManifestSubstitutions[1].Key).To(Equal("TLS_CIPHER_SUITES")) + g.Expect(*acs[0].ManifestSubstitutions[1].Value).To(Equal("TLS_AES_128_GCM_SHA256")) + }) + t.Run("unmanagedCustomResourceDefinitions preserved", func(t *testing.T) { g := NewWithT(t) @@ -778,9 +1002,11 @@ func TestRevisionsToApplyConfig(t *testing.T) { ContentID: "id1", UnmanagedCustomResourceDefinitions: []string{"widgets.example.com", "gadgets.example.com"}, Components: []operatorv1alpha1.ClusterAPIInstallerComponent{ - {Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ - Ref: "img-a", Profile: "default", - }}, + {ClusterAPIInstallerComponentSource: operatorv1alpha1.ClusterAPIInstallerComponentSource{ + Type: operatorv1alpha1.InstallerComponentTypeImage, Image: operatorv1alpha1.ClusterAPIInstallerComponentImage{ + Ref: "img-a", Profile: "default", + }}, + }, }, }, } diff --git a/pkg/revisiongenerator/transform.go b/pkg/revisiongenerator/transform.go index 1d279033a3..6e93a606cc 100644 --- a/pkg/revisiongenerator/transform.go +++ b/pkg/revisiongenerator/transform.go @@ -48,9 +48,15 @@ func envSubstSubstitutions(key string) string { // longer be able to reconcile the old revision. This should be done with care. // transformYaml applies transformations to an object's YAML before it is unmarshalled. -func transformYaml(providerProfile *providerimages.ProviderImageManifests, yaml string) (string, error) { - // Expand envsubst variables - yaml, err := envsubst.Eval(yaml, envSubstSubstitutions) +func transformYaml(providerProfile *providerimages.ProviderImageManifests, yaml string, substitutions map[string]string) (string, error) { + // Expand envsubst variables, checking user-provided substitutions first. + yaml, err := envsubst.Eval(yaml, func(key string) string { + if v, ok := substitutions[key]; ok { + return v + } + + return envSubstSubstitutions(key) + }) if err != nil { return "", fmt.Errorf("failed to substitute variables: %w", err) } diff --git a/pkg/revisiongenerator/transform_test.go b/pkg/revisiongenerator/transform_test.go index dfbee405be..14410d523a 100644 --- a/pkg/revisiongenerator/transform_test.go +++ b/pkg/revisiongenerator/transform_test.go @@ -27,10 +27,11 @@ import ( func TestTransformYaml(t *testing.T) { tests := []struct { - name string - yaml string - profile providerimages.ProviderImageManifests - expected string + name string + yaml string + profile providerimages.ProviderImageManifests + substitutions map[string]string + expected string }{ { name: "known envsubst variable replaced", @@ -116,13 +117,52 @@ func TestTransformYaml(t *testing.T) { }, expected: "", }, + { + name: "user substitution applied", + yaml: "version: ${TLS_MIN_VERSION}", + profile: providerimages.ProviderImageManifests{ + ImageRef: "example.com/img@sha256:abc", + }, + substitutions: map[string]string{"TLS_MIN_VERSION": "VersionTLS12"}, + expected: "version: VersionTLS12", + }, + { + name: "user substitution overrides hardcoded", + yaml: "bootstrap: ${EXP_BOOTSTRAP_FORMAT_IGNITION}", + profile: providerimages.ProviderImageManifests{ + ImageRef: "example.com/img@sha256:abc", + }, + substitutions: map[string]string{"EXP_BOOTSTRAP_FORMAT_IGNITION": "false"}, + expected: "bootstrap: false", + }, + { + name: "unknown var with no user substitution still empty", + yaml: "value: ${UNKNOWN_VAR}", + profile: providerimages.ProviderImageManifests{ + ImageRef: "example.com/img@sha256:abc", + }, + substitutions: map[string]string{"OTHER_VAR": "something"}, + expected: "value: ", + }, + { + name: "multiple substitutions applied", + yaml: "version: ${TLS_MIN_VERSION}\nciphers: ${TLS_CIPHER_SUITES}", + profile: providerimages.ProviderImageManifests{ + ImageRef: "example.com/img@sha256:abc", + }, + substitutions: map[string]string{ + "TLS_MIN_VERSION": "VersionTLS12", + "TLS_CIPHER_SUITES": "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384", + }, + expected: "version: VersionTLS12\nciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384", + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { g := NewWithT(t) - result, err := transformYaml(&tt.profile, tt.yaml) + result, err := transformYaml(&tt.profile, tt.yaml, tt.substitutions) g.Expect(err).NotTo(HaveOccurred()) g.Expect(result).To(Equal(tt.expected)) }) diff --git a/pkg/test/envtest.go b/pkg/test/envtest.go index 3dc3acc0e4..c864fbdd3b 100644 --- a/pkg/test/envtest.go +++ b/pkg/test/envtest.go @@ -94,6 +94,7 @@ func StartEnvTest(testEnv *envtest.Environment) (*rest.Config, client.WithWatch, path.Join(openshiftAPIPath, "machine", "v1beta1", "zz_generated.crd-manifests", "0000_10_machine-api_01_machines-CustomNoUpgrade.crd.yaml"), path.Join(openshiftAPIPath, "config", "v1", "zz_generated.crd-manifests", "0000_00_cluster-version-operator_01_clusteroperators.crd.yaml"), path.Join(openshiftAPIPath, "config", "v1", "zz_generated.crd-manifests", "0000_00_cluster-version-operator_01_clusterversions-TechPreviewNoUpgrade.crd.yaml"), + path.Join(openshiftAPIPath, "config", "v1", "zz_generated.crd-manifests", "0000_10_config-operator_01_apiservers-Default.crd.yaml"), path.Join(openshiftAPIPath, "config", "v1", "zz_generated.crd-manifests", "0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml"), path.Join(openshiftAPIPath, "apiextensions", "v1alpha1", "zz_generated.crd-manifests", "0000_20_crd-compatibility-checker_01_compatibilityrequirements.crd.yaml"), path.Join(openshiftAPIPath, "operator", "v1alpha1", "zz_generated.crd-manifests", "0000_30_cluster-api_01_clusterapis.crd.yaml"), diff --git a/vendor/github.com/openshift/api/.golangci.yaml b/vendor/github.com/openshift/api/.golangci.yaml index 608fb0ed2e..53c9b4009e 100644 --- a/vendor/github.com/openshift/api/.golangci.yaml +++ b/vendor/github.com/openshift/api/.golangci.yaml @@ -111,6 +111,12 @@ linters: # Silence norefs lint for `Ref` field in ClusterAPI as it refers to an OCI image reference, not a kube object reference. path: operator/v1alpha1/types_clusterapi.go text: "noreferences: naming convention \"no-references\": field ClusterAPIInstallerComponentImage.Ref: field names should not contain reference-related words" + - linters: + - kubeapilinter + # PacemakerCluster intentionally marks Conditions as required with XValidation rules + # to enforce specific condition types are always present. + path: etcd/v1/types_pacemakercluster.go + text: "conditions: Conditions field in (PacemakerClusterStatus|PacemakerClusterNodeStatus|PacemakerClusterFencingAgentStatus|PacemakerClusterResourceStatus) is missing the following markers: optional" - linters: - kubeapilinter path: features|payload-command/*.go diff --git a/vendor/github.com/openshift/api/config/v1/types.go b/vendor/github.com/openshift/api/config/v1/types.go index 3e17ca0ccb..e7106ef7ab 100644 --- a/vendor/github.com/openshift/api/config/v1/types.go +++ b/vendor/github.com/openshift/api/config/v1/types.go @@ -284,7 +284,12 @@ type ClientConnectionOverrides struct { } // GenericControllerConfig provides information to configure a controller +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 type GenericControllerConfig struct { + metav1.TypeMeta `json:",inline"` + // servingInfo is the HTTP serving information for the controller's endpoints ServingInfo HTTPServingInfo `json:"servingInfo"` diff --git a/vendor/github.com/openshift/api/config/v1/types_apiserver.go b/vendor/github.com/openshift/api/config/v1/types_apiserver.go index 31d8881858..b8a4399dbc 100644 --- a/vendor/github.com/openshift/api/config/v1/types_apiserver.go +++ b/vendor/github.com/openshift/api/config/v1/types_apiserver.go @@ -34,6 +34,7 @@ type APIServer struct { Status APIServerStatus `json:"status"` } +// +openshift:validation:FeatureGateAwareXValidation:featureGate=TLSAdherence,rule="has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true",message="tlsAdherence may not be removed once set" type APIServerSpec struct { // servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates // will be used for serving secure traffic. @@ -62,6 +63,39 @@ type APIServerSpec struct { // The current default is the Intermediate profile. // +optional TLSSecurityProfile *TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"` + // tlsAdherence controls if components in the cluster adhere to the TLS security profile + // configured on this APIServer resource. + // + // Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents". + // + // When set to "LegacyAdheringComponentsOnly", components that already honor the + // cluster-wide TLS profile continue to do so. Components that do not already honor + // it continue to use their individual TLS configurations. + // + // When set to "StrictAllComponents", all components must honor the configured TLS + // profile unless they have a component-specific TLS configuration that overrides + // it. This mode is recommended for security-conscious deployments and is required + // for certain compliance frameworks. + // + // Note: Some components such as Kubelet and IngressController have their own + // dedicated TLS configuration mechanisms via KubeletConfig and IngressController + // CRs respectively. When these component-specific TLS configurations are set, + // they take precedence over the cluster-wide tlsSecurityProfile. When not set, + // these components fall back to the cluster-wide default. + // + // Components that encounter an unknown value for tlsAdherence should treat it + // as "StrictAllComponents" and log a warning to ensure forward compatibility + // while defaulting to the more secure behavior. + // + // This field is optional. + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default is LegacyAdheringComponentsOnly. + // + // Once set, this field may be changed to a different value, but may not be removed. + // +openshift:enable:FeatureGate=TLSAdherence + // +optional + TLSAdherence TLSAdherencePolicy `json:"tlsAdherence,omitempty"` // audit specifies the settings for audit configuration to be applied to all OpenShift-provided // API servers in the cluster. // +optional @@ -237,6 +271,35 @@ const ( type APIServerStatus struct { } +// TLSAdherencePolicy defines which components adhere to the TLS security profile. +// Implementors should use the ShouldHonorClusterTLSProfile helper function from library-go +// rather than checking these values directly. +// +kubebuilder:validation:Enum=LegacyAdheringComponentsOnly;StrictAllComponents +type TLSAdherencePolicy string + +const ( + // TLSAdherencePolicyNoOpinion represents an empty/unset value for tlsAdherence. + // This value cannot be explicitly set and is only present when the field is omitted. + // When the field is omitted, the cluster defaults to LegacyAdheringComponentsOnly + // behavior. Components should treat this the same as LegacyAdheringComponentsOnly. + TLSAdherencePolicyNoOpinion TLSAdherencePolicy = "" + + // TLSAdherencePolicyLegacyAdheringComponentsOnly maintains backward-compatible behavior. + // Components that already honor the cluster-wide TLS profile (such as kube-apiserver, + // openshift-apiserver, oauth-apiserver, and others) continue to do so. Components that do + // not already honor it continue to use their individual TLS configurations (e.g., + // IngressController.spec.tlsSecurityProfile, KubeletConfig.spec.tlsSecurityProfile, + // or component defaults). No additional components are required to start honoring the + // cluster-wide profile in this mode. + TLSAdherencePolicyLegacyAdheringComponentsOnly TLSAdherencePolicy = "LegacyAdheringComponentsOnly" + + // TLSAdherencePolicyStrictAllComponents means all components must honor the configured TLS + // profile unless they have a component-specific TLS configuration that overrides it. + // This mode is recommended for security-conscious deployments and is required + // for certain compliance frameworks. + TLSAdherencePolicyStrictAllComponents TLSAdherencePolicy = "StrictAllComponents" +) + // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). diff --git a/vendor/github.com/openshift/api/config/v1/types_authentication.go b/vendor/github.com/openshift/api/config/v1/types_authentication.go index 64d0f399b0..75e57c3709 100644 --- a/vendor/github.com/openshift/api/config/v1/types_authentication.go +++ b/vendor/github.com/openshift/api/config/v1/types_authentication.go @@ -618,6 +618,7 @@ type OIDCClientReference struct { // +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC,rule="has(self.claim)",message="claim is required" // +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUIDAndExtraClaimMappings,rule="has(self.claim)",message="claim is required" // +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.claim) ? !has(self.expression) : has(self.expression)",message="precisely one of claim or expression must be set" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.expression) && size(self.expression) > 0 ? !has(self.prefixPolicy) || self.prefixPolicy != 'Prefix' : true",message="prefixPolicy must not be set to 'Prefix' when expression is set" type UsernameClaimMapping struct { // claim is an optional field that configures the JWT token claim whose value is assigned to the cluster identity field associated with this mapping. // claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled. @@ -650,11 +651,9 @@ type UsernameClaimMapping struct { // Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). // // When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - // // The prefix field must be set when prefixPolicy is 'Prefix'. - // + // Must not be set to 'Prefix' when expression is set. // When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - // // When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. // Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. // @@ -710,12 +709,14 @@ type UsernamePrefix struct { // PrefixedClaimMapping configures a claim mapping // that allows for an optional prefix. +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.expression) && size(self.expression) > 0 ? (!has(self.prefix) || size(self.prefix) == 0) : true",message="prefix must not be set to a non-empty value when expression is set" type PrefixedClaimMapping struct { TokenClaimMapping `json:",inline"` // prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. // - // When omitted (""), no prefix is applied to the cluster identity attribute. + // When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + // Must not be set to a non-empty value when expression is set. // // Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". // diff --git a/vendor/github.com/openshift/api/config/v1/types_cluster_version.go b/vendor/github.com/openshift/api/config/v1/types_cluster_version.go index 5f36f693de..f8d45114a8 100644 --- a/vendor/github.com/openshift/api/config/v1/types_cluster_version.go +++ b/vendor/github.com/openshift/api/config/v1/types_cluster_version.go @@ -283,6 +283,16 @@ type UpdateHistory struct { // ClusterID is string RFC4122 uuid. type ClusterID string +// UpdateMode defines how an update should be processed. +// +enum +// +kubebuilder:validation:Enum=Preflight +type UpdateMode string + +const ( + // UpdateModePreflight allows an update to be checked for compatibility without committing to updating the cluster. + UpdateModePreflight UpdateMode = "Preflight" +) + // ClusterVersionArchitecture enumerates valid cluster architectures. // +kubebuilder:validation:Enum="Multi";"" type ClusterVersionArchitecture string @@ -760,6 +770,22 @@ type Update struct { // +listMapKey=name // +optional AcceptRisks []AcceptRisk `json:"acceptRisks,omitempty"` + + // mode determines how an update should be processed. + // The only valid value is "Preflight". + // When omitted, the cluster performs a normal update by applying the specified version or image to the cluster. + // This is the standard update behavior. + // When set to "Preflight", the cluster runs compatibility checks against the target release without + // performing an actual update. Compatibility results, including any detected risks, are reported + // in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update + // recommendation service. + // This allows administrators to assess update readiness and address issues before committing to the update. + // Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be + // verified across multiple minor versions. + // When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates. + // +openshift:enable:FeatureGate=ClusterUpdatePreflight + // +optional + Mode UpdateMode `json:"mode,omitempty"` } // AcceptRisk represents a risk that is considered acceptable. diff --git a/vendor/github.com/openshift/api/config/v1/types_dns.go b/vendor/github.com/openshift/api/config/v1/types_dns.go index 06eb75ccf7..efbdc3ae54 100644 --- a/vendor/github.com/openshift/api/config/v1/types_dns.go +++ b/vendor/github.com/openshift/api/config/v1/types_dns.go @@ -134,7 +134,14 @@ type AWSDNSSpec struct { // privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing // operations on the cluster's private hosted zone specified in the cluster DNS config. // When left empty, no role should be assumed. - // +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$` + // + // The ARN must follow the format: arn::iam:::role/, where: + // is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + // is a 12-digit numeric identifier for the AWS account, + // is the IAM role name. + // + // +openshift:validation:FeatureGateAwareXValidation:featureGate="",rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')`,message=`privateZoneIAMRole must be a valid AWS IAM role ARN in the format: arn::iam:::role/` + // +openshift:validation:FeatureGateAwareXValidation:featureGate=AWSEuropeanSovereignCloudInstall,rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')`,message=`privateZoneIAMRole must be a valid AWS IAM role ARN in the format: arn::iam:::role/` // +optional PrivateZoneIAMRole string `json:"privateZoneIAMRole"` } diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go index 369ba1e7a0..c579be3a11 100644 --- a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go +++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go @@ -102,11 +102,11 @@ type InfrastructureStatus struct { // and the operators should not configure the operand for highly-available operation // The 'External' mode indicates that the control plane is hosted externally to the cluster and that // its components are not visible within the cluster. + // The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + // that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. // +kubebuilder:default=HighlyAvailable - // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=HighlyAvailable;SingleReplica;External - // +openshift:validation:FeatureGateAwareEnum:featureGate=HighlyAvailableArbiter,enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;External - // +openshift:validation:FeatureGateAwareEnum:featureGate=DualReplica,enum=HighlyAvailable;SingleReplica;DualReplica;External - // +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=HighlyAvailableArbiter;DualReplica,enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;DualReplica;External + // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;External + // +openshift:validation:FeatureGateAwareEnum:featureGate=DualReplica,enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;DualReplica;External // +optional ControlPlaneTopology TopologyMode `json:"controlPlaneTopology"` @@ -787,7 +787,6 @@ type GCPPlatformStatus struct { // // +default={"dnsType": "PlatformDefault"} // +kubebuilder:default={"dnsType": "PlatformDefault"} - // +openshift:enable:FeatureGate=GCPClusterHostedDNSInstall // +optional // +nullable CloudLoadBalancerConfig *CloudLoadBalancerConfig `json:"cloudLoadBalancerConfig,omitempty"` diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml index c89d45ddcd..0deb9ba086 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml @@ -218,6 +218,23 @@ spec: When image is set, architecture cannot be specified. If both version and image are set, the version extracted from the referenced image must match the specified version. type: string + mode: + description: |- + mode determines how an update should be processed. + The only valid value is "Preflight". + When omitted, the cluster performs a normal update by applying the specified version or image to the cluster. + This is the standard update behavior. + When set to "Preflight", the cluster runs compatibility checks against the target release without + performing an actual update. Compatibility results, including any detected risks, are reported + in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update + recommendation service. + This allows administrators to assess update readiness and address issues before committing to the update. + Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be + verified across multiple minor versions. + When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates. + enum: + - Preflight + type: string version: description: |- version is a semantic version identifying the update version. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml index f24b2a16a1..70a09d3ff0 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml @@ -218,6 +218,23 @@ spec: When image is set, architecture cannot be specified. If both version and image are set, the version extracted from the referenced image must match the specified version. type: string + mode: + description: |- + mode determines how an update should be processed. + The only valid value is "Preflight". + When omitted, the cluster performs a normal update by applying the specified version or image to the cluster. + This is the standard update behavior. + When set to "Preflight", the cluster runs compatibility checks against the target release without + performing an actual update. Compatibility results, including any detected risks, are reported + in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update + recommendation service. + This allows administrators to assess update readiness and address issues before committing to the update. + Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be + verified across multiple minor versions. + When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates. + enum: + - Preflight + type: string version: description: |- version is a semantic version identifying the update version. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index 2e45da09e5..d2ba7fc325 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -292,6 +292,42 @@ spec: type: array x-kubernetes-list-type: atomic type: object + tlsAdherence: + description: |- + tlsAdherence controls if components in the cluster adhere to the TLS security profile + configured on this APIServer resource. + + Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents". + + When set to "LegacyAdheringComponentsOnly", components that already honor the + cluster-wide TLS profile continue to do so. Components that do not already honor + it continue to use their individual TLS configurations. + + When set to "StrictAllComponents", all components must honor the configured TLS + profile unless they have a component-specific TLS configuration that overrides + it. This mode is recommended for security-conscious deployments and is required + for certain compliance frameworks. + + Note: Some components such as Kubelet and IngressController have their own + dedicated TLS configuration mechanisms via KubeletConfig and IngressController + CRs respectively. When these component-specific TLS configurations are set, + they take precedence over the cluster-wide tlsSecurityProfile. When not set, + these components fall back to the cluster-wide default. + + Components that encounter an unknown value for tlsAdherence should treat it + as "StrictAllComponents" and log a warning to ensure forward compatibility + while defaulting to the more secure behavior. + + This field is optional. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + The current default is LegacyAdheringComponentsOnly. + + Once set, this field may be changed to a different value, but may not be removed. + enum: + - LegacyAdheringComponentsOnly + - StrictAllComponents + type: string tlsSecurityProfile: description: |- tlsSecurityProfile specifies settings for TLS connections for externally exposed servers. @@ -427,6 +463,9 @@ spec: type: string type: object type: object + x-kubernetes-validations: + - message: tlsAdherence may not be removed once set + rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true' status: description: status holds observed values from the cluster. They may not be overridden. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index 23c4381442..cabbd04bb7 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -292,6 +292,42 @@ spec: type: array x-kubernetes-list-type: atomic type: object + tlsAdherence: + description: |- + tlsAdherence controls if components in the cluster adhere to the TLS security profile + configured on this APIServer resource. + + Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents". + + When set to "LegacyAdheringComponentsOnly", components that already honor the + cluster-wide TLS profile continue to do so. Components that do not already honor + it continue to use their individual TLS configurations. + + When set to "StrictAllComponents", all components must honor the configured TLS + profile unless they have a component-specific TLS configuration that overrides + it. This mode is recommended for security-conscious deployments and is required + for certain compliance frameworks. + + Note: Some components such as Kubelet and IngressController have their own + dedicated TLS configuration mechanisms via KubeletConfig and IngressController + CRs respectively. When these component-specific TLS configurations are set, + they take precedence over the cluster-wide tlsSecurityProfile. When not set, + these components fall back to the cluster-wide default. + + Components that encounter an unknown value for tlsAdherence should treat it + as "StrictAllComponents" and log a warning to ensure forward compatibility + while defaulting to the more secure behavior. + + This field is optional. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + The current default is LegacyAdheringComponentsOnly. + + Once set, this field may be changed to a different value, but may not be removed. + enum: + - LegacyAdheringComponentsOnly + - StrictAllComponents + type: string tlsSecurityProfile: description: |- tlsSecurityProfile specifies settings for TLS connections for externally exposed servers. @@ -427,6 +463,9 @@ spec: type: string type: object type: object + x-kubernetes-validations: + - message: tlsAdherence may not be removed once set + rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true' status: description: status holds observed values from the cluster. They may not be overridden. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 1d75d68e5a..b21c31dd43 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -224,6 +224,42 @@ spec: type: array x-kubernetes-list-type: atomic type: object + tlsAdherence: + description: |- + tlsAdherence controls if components in the cluster adhere to the TLS security profile + configured on this APIServer resource. + + Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents". + + When set to "LegacyAdheringComponentsOnly", components that already honor the + cluster-wide TLS profile continue to do so. Components that do not already honor + it continue to use their individual TLS configurations. + + When set to "StrictAllComponents", all components must honor the configured TLS + profile unless they have a component-specific TLS configuration that overrides + it. This mode is recommended for security-conscious deployments and is required + for certain compliance frameworks. + + Note: Some components such as Kubelet and IngressController have their own + dedicated TLS configuration mechanisms via KubeletConfig and IngressController + CRs respectively. When these component-specific TLS configurations are set, + they take precedence over the cluster-wide tlsSecurityProfile. When not set, + these components fall back to the cluster-wide default. + + Components that encounter an unknown value for tlsAdherence should treat it + as "StrictAllComponents" and log a warning to ensure forward compatibility + while defaulting to the more secure behavior. + + This field is optional. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + The current default is LegacyAdheringComponentsOnly. + + Once set, this field may be changed to a different value, but may not be removed. + enum: + - LegacyAdheringComponentsOnly + - StrictAllComponents + type: string tlsSecurityProfile: description: |- tlsSecurityProfile specifies settings for TLS connections for externally exposed servers. @@ -359,6 +395,9 @@ spec: type: string type: object type: object + x-kubernetes-validations: + - message: tlsAdherence may not be removed once set + rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true' status: description: status holds observed values from the cluster. They may not be overridden. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml index b4b8eb306f..cd737e2727 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml @@ -212,12 +212,18 @@ spec: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. - When omitted (""), no prefix is applied to the cluster identity attribute. + When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + Must not be set to a non-empty value when expression is set. Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". type: string type: object x-kubernetes-validations: + - message: prefix must not be set to a non-empty value when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? (!has(self.prefix) || size(self.prefix) == 0) : + true' - message: expression must not be set if claim is specified and is not an empty string rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression) @@ -316,11 +322,9 @@ spec: Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - The prefix field must be set when prefixPolicy is 'Prefix'. - + Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. @@ -341,6 +345,11 @@ spec: - message: precisely one of claim or expression must be set rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)' + - message: prefixPolicy must not be set to 'Prefix' when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? !has(self.prefixPolicy) || self.prefixPolicy != + ''Prefix'' : true' - message: prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise rule: 'has(self.prefixPolicy) && self.prefixPolicy == diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml index d1e44f6ced..5e6be8db9f 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml @@ -199,7 +199,8 @@ spec: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. - When omitted (""), no prefix is applied to the cluster identity attribute. + When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + Must not be set to a non-empty value when expression is set. Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". type: string @@ -288,11 +289,9 @@ spec: Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - The prefix field must be set when prefixPolicy is 'Prefix'. - + Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml index c46017aa3d..bf116984ff 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml @@ -212,12 +212,18 @@ spec: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. - When omitted (""), no prefix is applied to the cluster identity attribute. + When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + Must not be set to a non-empty value when expression is set. Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". type: string type: object x-kubernetes-validations: + - message: prefix must not be set to a non-empty value when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? (!has(self.prefix) || size(self.prefix) == 0) : + true' - message: expression must not be set if claim is specified and is not an empty string rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression) @@ -316,11 +322,9 @@ spec: Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - The prefix field must be set when prefixPolicy is 'Prefix'. - + Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. @@ -341,6 +345,11 @@ spec: - message: precisely one of claim or expression must be set rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)' + - message: prefixPolicy must not be set to 'Prefix' when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? !has(self.prefixPolicy) || self.prefixPolicy != + ''Prefix'' : true' - message: prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise rule: 'has(self.prefixPolicy) && self.prefixPolicy == diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml index 5b5956b1fb..dcfe61e693 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml @@ -199,7 +199,8 @@ spec: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. - When omitted (""), no prefix is applied to the cluster identity attribute. + When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + Must not be set to a non-empty value when expression is set. Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". type: string @@ -288,11 +289,9 @@ spec: Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - The prefix field must be set when prefixPolicy is 'Prefix'. - + Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml index 9da4945a7f..de0dd293a8 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml @@ -212,12 +212,18 @@ spec: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. - When omitted (""), no prefix is applied to the cluster identity attribute. + When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + Must not be set to a non-empty value when expression is set. Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". type: string type: object x-kubernetes-validations: + - message: prefix must not be set to a non-empty value when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? (!has(self.prefix) || size(self.prefix) == 0) : + true' - message: expression must not be set if claim is specified and is not an empty string rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression) @@ -316,11 +322,9 @@ spec: Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - The prefix field must be set when prefixPolicy is 'Prefix'. - + Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. @@ -341,6 +345,11 @@ spec: - message: precisely one of claim or expression must be set rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)' + - message: prefixPolicy must not be set to 'Prefix' when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? !has(self.prefixPolicy) || self.prefixPolicy != + ''Prefix'' : true' - message: prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise rule: 'has(self.prefixPolicy) && self.prefixPolicy == diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml new file mode 100644 index 0000000000..05d56f63cf --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml @@ -0,0 +1,198 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/470 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/bootstrap-required: "true" + release.openshift.io/feature-set: CustomNoUpgrade + name: dnses.config.openshift.io +spec: + group: config.openshift.io + names: + kind: DNS + listKind: DNSList + plural: dnses + singular: dns + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + DNS holds cluster-wide information about DNS. The canonical name is `cluster` + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec holds user settable values for configuration + properties: + baseDomain: + description: |- + baseDomain is the base domain of the cluster. All managed DNS records will + be sub-domains of this base. + + For example, given the base domain `openshift.example.com`, an API server + DNS record may be created for `cluster-api.openshift.example.com`. + + Once set, this field cannot be changed. + type: string + platform: + description: |- + platform holds configuration specific to the underlying + infrastructure provider for DNS. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + properties: + aws: + description: aws contains DNS configuration specific to the Amazon + Web Services cloud provider. + properties: + privateZoneIAMRole: + description: |- + privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing + operations on the cluster's private hosted zone specified in the cluster DNS config. + When left empty, no role should be assumed. + + The ARN must follow the format: arn::iam:::role/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + is a 12-digit numeric identifier for the AWS account, + is the IAM role name. + type: string + x-kubernetes-validations: + - message: 'privateZoneIAMRole must be a valid AWS IAM role + ARN in the format: arn::iam:::role/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$') + type: object + type: + description: |- + type is the underlying infrastructure provider for the cluster. + Allowed values: "", "AWS". + + Individual components may not support all platforms, + and must handle unrecognized platforms with best-effort defaults. + enum: + - "" + - AWS + - Azure + - BareMetal + - GCP + - Libvirt + - OpenStack + - None + - VSphere + - oVirt + - IBMCloud + - KubeVirt + - EquinixMetal + - PowerVS + - AlibabaCloud + - Nutanix + - External + type: string + x-kubernetes-validations: + - message: allowed values are '' and 'AWS' + rule: self in ['','AWS'] + required: + - type + type: object + x-kubernetes-validations: + - message: aws configuration is required when platform is AWS, and + forbidden otherwise + rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) : + !has(self.aws)' + privateZone: + description: |- + privateZone is the location where all the DNS records that are only available internally + to the cluster exist. + + If this field is nil, no private records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + publicZone: + description: |- + publicZone is the location where all the DNS records that are publicly accessible to + the internet exist. + + If this field is nil, no public records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + type: object + status: + description: status holds observed values from the cluster. They may not + be overridden. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-Default.crd.yaml new file mode 100644 index 0000000000..93954dcc36 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-Default.crd.yaml @@ -0,0 +1,198 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/470 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/bootstrap-required: "true" + release.openshift.io/feature-set: Default + name: dnses.config.openshift.io +spec: + group: config.openshift.io + names: + kind: DNS + listKind: DNSList + plural: dnses + singular: dns + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + DNS holds cluster-wide information about DNS. The canonical name is `cluster` + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec holds user settable values for configuration + properties: + baseDomain: + description: |- + baseDomain is the base domain of the cluster. All managed DNS records will + be sub-domains of this base. + + For example, given the base domain `openshift.example.com`, an API server + DNS record may be created for `cluster-api.openshift.example.com`. + + Once set, this field cannot be changed. + type: string + platform: + description: |- + platform holds configuration specific to the underlying + infrastructure provider for DNS. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + properties: + aws: + description: aws contains DNS configuration specific to the Amazon + Web Services cloud provider. + properties: + privateZoneIAMRole: + description: |- + privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing + operations on the cluster's private hosted zone specified in the cluster DNS config. + When left empty, no role should be assumed. + + The ARN must follow the format: arn::iam:::role/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + is a 12-digit numeric identifier for the AWS account, + is the IAM role name. + type: string + x-kubernetes-validations: + - message: 'privateZoneIAMRole must be a valid AWS IAM role + ARN in the format: arn::iam:::role/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$') + type: object + type: + description: |- + type is the underlying infrastructure provider for the cluster. + Allowed values: "", "AWS". + + Individual components may not support all platforms, + and must handle unrecognized platforms with best-effort defaults. + enum: + - "" + - AWS + - Azure + - BareMetal + - GCP + - Libvirt + - OpenStack + - None + - VSphere + - oVirt + - IBMCloud + - KubeVirt + - EquinixMetal + - PowerVS + - AlibabaCloud + - Nutanix + - External + type: string + x-kubernetes-validations: + - message: allowed values are '' and 'AWS' + rule: self in ['','AWS'] + required: + - type + type: object + x-kubernetes-validations: + - message: aws configuration is required when platform is AWS, and + forbidden otherwise + rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) : + !has(self.aws)' + privateZone: + description: |- + privateZone is the location where all the DNS records that are only available internally + to the cluster exist. + + If this field is nil, no private records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + publicZone: + description: |- + publicZone is the location where all the DNS records that are publicly accessible to + the internet exist. + + If this field is nil, no public records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + type: object + status: + description: status holds observed values from the cluster. They may not + be overridden. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml new file mode 100644 index 0000000000..f2d9157713 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml @@ -0,0 +1,198 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/470 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/bootstrap-required: "true" + release.openshift.io/feature-set: DevPreviewNoUpgrade + name: dnses.config.openshift.io +spec: + group: config.openshift.io + names: + kind: DNS + listKind: DNSList + plural: dnses + singular: dns + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + DNS holds cluster-wide information about DNS. The canonical name is `cluster` + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec holds user settable values for configuration + properties: + baseDomain: + description: |- + baseDomain is the base domain of the cluster. All managed DNS records will + be sub-domains of this base. + + For example, given the base domain `openshift.example.com`, an API server + DNS record may be created for `cluster-api.openshift.example.com`. + + Once set, this field cannot be changed. + type: string + platform: + description: |- + platform holds configuration specific to the underlying + infrastructure provider for DNS. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + properties: + aws: + description: aws contains DNS configuration specific to the Amazon + Web Services cloud provider. + properties: + privateZoneIAMRole: + description: |- + privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing + operations on the cluster's private hosted zone specified in the cluster DNS config. + When left empty, no role should be assumed. + + The ARN must follow the format: arn::iam:::role/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + is a 12-digit numeric identifier for the AWS account, + is the IAM role name. + type: string + x-kubernetes-validations: + - message: 'privateZoneIAMRole must be a valid AWS IAM role + ARN in the format: arn::iam:::role/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$') + type: object + type: + description: |- + type is the underlying infrastructure provider for the cluster. + Allowed values: "", "AWS". + + Individual components may not support all platforms, + and must handle unrecognized platforms with best-effort defaults. + enum: + - "" + - AWS + - Azure + - BareMetal + - GCP + - Libvirt + - OpenStack + - None + - VSphere + - oVirt + - IBMCloud + - KubeVirt + - EquinixMetal + - PowerVS + - AlibabaCloud + - Nutanix + - External + type: string + x-kubernetes-validations: + - message: allowed values are '' and 'AWS' + rule: self in ['','AWS'] + required: + - type + type: object + x-kubernetes-validations: + - message: aws configuration is required when platform is AWS, and + forbidden otherwise + rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) : + !has(self.aws)' + privateZone: + description: |- + privateZone is the location where all the DNS records that are only available internally + to the cluster exist. + + If this field is nil, no private records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + publicZone: + description: |- + publicZone is the location where all the DNS records that are publicly accessible to + the internet exist. + + If this field is nil, no public records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + type: object + status: + description: status holds observed values from the cluster. They may not + be overridden. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-OKD.crd.yaml similarity index 91% rename from vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml rename to vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-OKD.crd.yaml index 06fb0be0b2..0631512bca 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-OKD.crd.yaml @@ -7,6 +7,7 @@ metadata: include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" release.openshift.io/bootstrap-required: "true" + release.openshift.io/feature-set: OKD name: dnses.config.openshift.io spec: group: config.openshift.io @@ -71,8 +72,16 @@ spec: privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed. - pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$ + + The ARN must follow the format: arn::iam:::role/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + is a 12-digit numeric identifier for the AWS account, + is the IAM role name. type: string + x-kubernetes-validations: + - message: 'privateZoneIAMRole must be a valid AWS IAM role + ARN in the format: arn::iam:::role/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$') type: object type: description: |- diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml new file mode 100644 index 0000000000..ce4e9b77f0 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml @@ -0,0 +1,198 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/470 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/bootstrap-required: "true" + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: dnses.config.openshift.io +spec: + group: config.openshift.io + names: + kind: DNS + listKind: DNSList + plural: dnses + singular: dns + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + DNS holds cluster-wide information about DNS. The canonical name is `cluster` + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec holds user settable values for configuration + properties: + baseDomain: + description: |- + baseDomain is the base domain of the cluster. All managed DNS records will + be sub-domains of this base. + + For example, given the base domain `openshift.example.com`, an API server + DNS record may be created for `cluster-api.openshift.example.com`. + + Once set, this field cannot be changed. + type: string + platform: + description: |- + platform holds configuration specific to the underlying + infrastructure provider for DNS. + When omitted, this means the user has no opinion and the platform is left + to choose reasonable defaults. These defaults are subject to change over time. + properties: + aws: + description: aws contains DNS configuration specific to the Amazon + Web Services cloud provider. + properties: + privateZoneIAMRole: + description: |- + privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing + operations on the cluster's private hosted zone specified in the cluster DNS config. + When left empty, no role should be assumed. + + The ARN must follow the format: arn::iam:::role/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + is a 12-digit numeric identifier for the AWS account, + is the IAM role name. + type: string + x-kubernetes-validations: + - message: 'privateZoneIAMRole must be a valid AWS IAM role + ARN in the format: arn::iam:::role/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$') + type: object + type: + description: |- + type is the underlying infrastructure provider for the cluster. + Allowed values: "", "AWS". + + Individual components may not support all platforms, + and must handle unrecognized platforms with best-effort defaults. + enum: + - "" + - AWS + - Azure + - BareMetal + - GCP + - Libvirt + - OpenStack + - None + - VSphere + - oVirt + - IBMCloud + - KubeVirt + - EquinixMetal + - PowerVS + - AlibabaCloud + - Nutanix + - External + type: string + x-kubernetes-validations: + - message: allowed values are '' and 'AWS' + rule: self in ['','AWS'] + required: + - type + type: object + x-kubernetes-validations: + - message: aws configuration is required when platform is AWS, and + forbidden otherwise + rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) : + !has(self.aws)' + privateZone: + description: |- + privateZone is the location where all the DNS records that are only available internally + to the cluster exist. + + If this field is nil, no private records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + publicZone: + description: |- + publicZone is the location where all the DNS records that are publicly accessible to + the internet exist. + + If this field is nil, no public records should be created. + + Once set, this field cannot be changed. + properties: + id: + description: |- + id is the identifier that can be used to find the DNS hosted zone. + + on AWS zone can be fetched using `ID` as id in [1] + on Azure zone can be fetched using `ID` as a pre-determined name in [2], + on GCP zone can be fetched using `ID` as a pre-determined name in [3]. + + [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options + [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show + [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get + type: string + tags: + additionalProperties: + type: string + description: |- + tags can be used to query the DNS hosted zone. + + on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, + + [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options + type: object + type: object + type: object + status: + description: status holds observed values from the cluster. They may not + be overridden. + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml index 9086d4a572..69e9d1108a 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml @@ -1127,6 +1127,8 @@ spec: and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. + The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. enum: - HighlyAvailable - HighlyAvailableArbiter diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml index 803c48a1e2..8d94616b35 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml @@ -828,6 +828,17 @@ spec: - topology - zone type: object + x-kubernetes-validations: + - message: when zoneAffinity type is HostGroup, regionAffinity + type must be ComputeCluster + rule: 'has(self.zoneAffinity) && self.zoneAffinity.type + == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type + == ''ComputeCluster'' : true' + - message: when zoneAffinity type is ComputeCluster, regionAffinity + type must be Datacenter + rule: 'has(self.zoneAffinity) && self.zoneAffinity.type + == ''ComputeCluster'' ? has(self.regionAffinity) && + self.regionAffinity.type == ''Datacenter'' : true' type: array x-kubernetes-list-map-keys: - name @@ -1050,10 +1061,13 @@ spec: and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. + The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. enum: - HighlyAvailable - HighlyAvailableArbiter - SingleReplica + - DualReplica - External type: string cpuPartitioning: @@ -1259,6 +1273,109 @@ spec: description: armEndpoint specifies a URL to use for resource management in non-soverign clouds such as Azure Stack. type: string + cloudLoadBalancerConfig: + default: + dnsType: PlatformDefault + description: |- + cloudLoadBalancerConfig holds configuration related to DNS and cloud + load balancers. It allows configuration of in-cluster DNS as an alternative + to the platform default DNS implementation. + When using the ClusterHosted DNS type, Load Balancer IP addresses + must be provided for the API and internal API load balancers as well as the + ingress load balancer. + properties: + clusterHosted: + description: |- + clusterHosted holds the IP addresses of API, API-Int and Ingress Load + Balancers on Cloud Platforms. The DNS solution hosted within the cluster + use these IP addresses to provide resolution for API, API-Int and Ingress + services. + properties: + apiIntLoadBalancerIPs: + description: |- + apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service. + These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. + Entries in the apiIntLoadBalancerIPs must be unique. + A maximum of 16 IP addresses are permitted. + format: ip + items: + description: IP is an IP address (for example, "10.0.0.0" + or "fd00::"). + maxLength: 39 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value must be a valid IP address + rule: isIP(self) + maxItems: 16 + type: array + x-kubernetes-list-type: set + apiLoadBalancerIPs: + description: |- + apiLoadBalancerIPs holds Load Balancer IPs for the API service. + These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. + Could be empty for private clusters. + Entries in the apiLoadBalancerIPs must be unique. + A maximum of 16 IP addresses are permitted. + format: ip + items: + description: IP is an IP address (for example, "10.0.0.0" + or "fd00::"). + maxLength: 39 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value must be a valid IP address + rule: isIP(self) + maxItems: 16 + type: array + x-kubernetes-list-type: set + ingressLoadBalancerIPs: + description: |- + ingressLoadBalancerIPs holds IPs for Ingress Load Balancers. + These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. + Entries in the ingressLoadBalancerIPs must be unique. + A maximum of 16 IP addresses are permitted. + format: ip + items: + description: IP is an IP address (for example, "10.0.0.0" + or "fd00::"). + maxLength: 39 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value must be a valid IP address + rule: isIP(self) + maxItems: 16 + type: array + x-kubernetes-list-type: set + type: object + dnsType: + default: PlatformDefault + description: |- + dnsType indicates the type of DNS solution in use within the cluster. Its default value of + `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform. + It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode, + the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed. + The cluster's use of the cloud's Load Balancers is unaffected by this setting. + The value is immutable after it has been set at install time. + Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS. + Enabling this functionality allows the user to start their own DNS solution outside the cluster after + installation is complete. The customer would be responsible for configuring this custom DNS solution, + and it can be run in addition to the in-cluster DNS solution. + enum: + - ClusterHosted + - PlatformDefault + type: string + x-kubernetes-validations: + - message: dnsType is immutable + rule: oldSelf == '' || self == oldSelf + type: object + x-kubernetes-validations: + - message: clusterHosted is permitted only when dnsType is + ClusterHosted + rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' + ? !has(self.clusterHosted) : true' cloudName: description: |- cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml index de1a68c90a..7d1ecbc19b 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml @@ -1127,6 +1127,8 @@ spec: and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. + The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. enum: - HighlyAvailable - HighlyAvailableArbiter diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml index 245bc3ea63..b107d7e44c 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml @@ -828,6 +828,17 @@ spec: - topology - zone type: object + x-kubernetes-validations: + - message: when zoneAffinity type is HostGroup, regionAffinity + type must be ComputeCluster + rule: 'has(self.zoneAffinity) && self.zoneAffinity.type + == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type + == ''ComputeCluster'' : true' + - message: when zoneAffinity type is ComputeCluster, regionAffinity + type must be Datacenter + rule: 'has(self.zoneAffinity) && self.zoneAffinity.type + == ''ComputeCluster'' ? has(self.regionAffinity) && + self.regionAffinity.type == ''Datacenter'' : true' type: array x-kubernetes-list-map-keys: - name @@ -1050,10 +1061,13 @@ spec: and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. + The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. enum: - HighlyAvailable - HighlyAvailableArbiter - SingleReplica + - DualReplica - External type: string cpuPartitioning: @@ -1259,6 +1273,109 @@ spec: description: armEndpoint specifies a URL to use for resource management in non-soverign clouds such as Azure Stack. type: string + cloudLoadBalancerConfig: + default: + dnsType: PlatformDefault + description: |- + cloudLoadBalancerConfig holds configuration related to DNS and cloud + load balancers. It allows configuration of in-cluster DNS as an alternative + to the platform default DNS implementation. + When using the ClusterHosted DNS type, Load Balancer IP addresses + must be provided for the API and internal API load balancers as well as the + ingress load balancer. + properties: + clusterHosted: + description: |- + clusterHosted holds the IP addresses of API, API-Int and Ingress Load + Balancers on Cloud Platforms. The DNS solution hosted within the cluster + use these IP addresses to provide resolution for API, API-Int and Ingress + services. + properties: + apiIntLoadBalancerIPs: + description: |- + apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service. + These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. + Entries in the apiIntLoadBalancerIPs must be unique. + A maximum of 16 IP addresses are permitted. + format: ip + items: + description: IP is an IP address (for example, "10.0.0.0" + or "fd00::"). + maxLength: 39 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value must be a valid IP address + rule: isIP(self) + maxItems: 16 + type: array + x-kubernetes-list-type: set + apiLoadBalancerIPs: + description: |- + apiLoadBalancerIPs holds Load Balancer IPs for the API service. + These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. + Could be empty for private clusters. + Entries in the apiLoadBalancerIPs must be unique. + A maximum of 16 IP addresses are permitted. + format: ip + items: + description: IP is an IP address (for example, "10.0.0.0" + or "fd00::"). + maxLength: 39 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value must be a valid IP address + rule: isIP(self) + maxItems: 16 + type: array + x-kubernetes-list-type: set + ingressLoadBalancerIPs: + description: |- + ingressLoadBalancerIPs holds IPs for Ingress Load Balancers. + These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. + Entries in the ingressLoadBalancerIPs must be unique. + A maximum of 16 IP addresses are permitted. + format: ip + items: + description: IP is an IP address (for example, "10.0.0.0" + or "fd00::"). + maxLength: 39 + minLength: 1 + type: string + x-kubernetes-validations: + - message: value must be a valid IP address + rule: isIP(self) + maxItems: 16 + type: array + x-kubernetes-list-type: set + type: object + dnsType: + default: PlatformDefault + description: |- + dnsType indicates the type of DNS solution in use within the cluster. Its default value of + `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform. + It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode, + the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed. + The cluster's use of the cloud's Load Balancers is unaffected by this setting. + The value is immutable after it has been set at install time. + Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS. + Enabling this functionality allows the user to start their own DNS solution outside the cluster after + installation is complete. The customer would be responsible for configuring this custom DNS solution, + and it can be run in addition to the in-cluster DNS solution. + enum: + - ClusterHosted + - PlatformDefault + type: string + x-kubernetes-validations: + - message: dnsType is immutable + rule: oldSelf == '' || self == oldSelf + type: object + x-kubernetes-validations: + - message: clusterHosted is permitted only when dnsType is + ClusterHosted + rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' + ? !has(self.clusterHosted) : true' cloudName: description: |- cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml index c45b7d6e83..02f367409b 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml @@ -1127,6 +1127,8 @@ spec: and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. + The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. enum: - HighlyAvailable - HighlyAvailableArbiter diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go index 30b85b78e9..a604d2f634 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go @@ -2560,6 +2560,7 @@ func (in *GenericAPIServerConfig) DeepCopy() *GenericAPIServerConfig { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *GenericControllerConfig) DeepCopyInto(out *GenericControllerConfig) { *out = *in + out.TypeMeta = in.TypeMeta in.ServingInfo.DeepCopyInto(&out.ServingInfo) out.LeaderElection = in.LeaderElection out.Authentication = in.Authentication diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml index eb7c485e03..84c1443d44 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml @@ -8,6 +8,7 @@ apiservers.config.openshift.io: FeatureGates: - KMSEncryption - KMSEncryptionProvider + - TLSAdherence FilenameOperatorName: config-operator FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_10" @@ -144,6 +145,7 @@ clusterversions.config.openshift.io: Category: "" FeatureGates: - ClusterUpdateAcceptRisks + - ClusterUpdatePreflight - ImageStreamImportMode - SignatureStores FilenameOperatorName: cluster-version-operator @@ -204,7 +206,8 @@ dnses.config.openshift.io: CRDName: dnses.config.openshift.io Capability: "" Category: "" - FeatureGates: [] + FeatureGates: + - AWSEuropeanSovereignCloudInstall FilenameOperatorName: config-operator FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_10" @@ -370,9 +373,6 @@ infrastructures.config.openshift.io: - AzureDualStackInstall - DualReplica - DyanmicServiceEndpointIBMCloud - - GCPClusterHostedDNSInstall - - HighlyAvailableArbiter - - HighlyAvailableArbiter+DualReplica - NutanixMultiSubnets - OnPremDNSRecords - VSphereHostVMGroupZonal diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go index 621dbbebdf..4a5346dba8 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go @@ -137,7 +137,7 @@ func (GenericAPIServerConfig) SwaggerDoc() map[string]string { } var map_GenericControllerConfig = map[string]string{ - "": "GenericControllerConfig provides information to configure a controller", + "": "GenericControllerConfig provides information to configure a controller\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", "servingInfo": "servingInfo is the HTTP serving information for the controller's endpoints", "leaderElection": "leaderElection provides information to elect a leader. Only override this if you have a specific need", "authentication": "authentication allows configuration of authentication for the endpoints", @@ -319,6 +319,7 @@ var map_APIServerSpec = map[string]string{ "additionalCORSAllowedOrigins": "additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth server from JavaScript applications. The values are regular expressions that correspond to the Golang regular expression language.", "encryption": "encryption allows the configuration of encryption of resources at the datastore layer.", "tlsSecurityProfile": "tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.\n\nWhen omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is the Intermediate profile.", + "tlsAdherence": "tlsAdherence controls if components in the cluster adhere to the TLS security profile configured on this APIServer resource.\n\nValid values are \"LegacyAdheringComponentsOnly\" and \"StrictAllComponents\".\n\nWhen set to \"LegacyAdheringComponentsOnly\", components that already honor the cluster-wide TLS profile continue to do so. Components that do not already honor it continue to use their individual TLS configurations.\n\nWhen set to \"StrictAllComponents\", all components must honor the configured TLS profile unless they have a component-specific TLS configuration that overrides it. This mode is recommended for security-conscious deployments and is required for certain compliance frameworks.\n\nNote: Some components such as Kubelet and IngressController have their own dedicated TLS configuration mechanisms via KubeletConfig and IngressController CRs respectively. When these component-specific TLS configurations are set, they take precedence over the cluster-wide tlsSecurityProfile. When not set, these components fall back to the cluster-wide default.\n\nComponents that encounter an unknown value for tlsAdherence should treat it as \"StrictAllComponents\" and log a warning to ensure forward compatibility while defaulting to the more secure behavior.\n\nThis field is optional. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default is LegacyAdheringComponentsOnly.\n\nOnce set, this field may be changed to a different value, but may not be removed.", "audit": "audit specifies the settings for audit configuration to be applied to all OpenShift-provided API servers in the cluster.", } @@ -458,7 +459,7 @@ func (OIDCProvider) SwaggerDoc() map[string]string { var map_PrefixedClaimMapping = map[string]string{ "": "PrefixedClaimMapping configures a claim mapping that allows for an optional prefix.", - "prefix": "prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.\n\nWhen omitted (\"\"), no prefix is applied to the cluster identity attribute.\n\nExample: if `prefix` is set to \"myoidc:\" and the `claim` in JWT contains an array of strings \"a\", \"b\" and \"c\", the mapping will result in an array of string \"myoidc:a\", \"myoidc:b\" and \"myoidc:c\".", + "prefix": "prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.\n\nWhen omitted or set to an empty string (\"\"), no prefix is applied to the cluster identity attribute. Must not be set to a non-empty value when expression is set.\n\nExample: if `prefix` is set to \"myoidc:\" and the `claim` in JWT contains an array of strings \"a\", \"b\" and \"c\", the mapping will result in an array of string \"myoidc:a\", \"myoidc:b\" and \"myoidc:c\".", } func (PrefixedClaimMapping) SwaggerDoc() map[string]string { @@ -549,7 +550,7 @@ func (TokenUserValidationRule) SwaggerDoc() map[string]string { var map_UsernameClaimMapping = map[string]string{ "claim": "claim is an optional field that configures the JWT token claim whose value is assigned to the cluster identity field associated with this mapping. claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled. When the ExternalOIDCWithUpstreamParity feature gate is enabled, claim must not be set when expression is set.\n\nclaim must not be an empty string (\"\") and must not exceed 256 characters.", "expression": "expression is an optional CEL expression used to derive the username from JWT claims.\n\nCEL expressions have access to the token claims through a CEL variable, 'claims'.\n\nexpression must be at least 1 character and must not exceed 1024 characters in length. expression must not be set when claim is set.", - "prefixPolicy": "prefixPolicy is an optional field that configures how a prefix should be applied to the value of the JWT claim specified in the 'claim' field.\n\nAllowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).\n\nWhen set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.\n\nThe prefix field must be set when prefixPolicy is 'Prefix'.\n\nWhen set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.\n\nWhen omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.\n\nAs an example, consider the following scenario:\n\n `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,\n the JWT claims include \"username\":\"userA\" and \"email\":\"userA@myoidc.tld\",\n and `claim` is set to:\n - \"username\": the mapped value will be \"https://myoidc.tld#userA\"\n - \"email\": the mapped value will be \"userA@myoidc.tld\"", + "prefixPolicy": "prefixPolicy is an optional field that configures how a prefix should be applied to the value of the JWT claim specified in the 'claim' field.\n\nAllowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).\n\nWhen set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. The prefix field must be set when prefixPolicy is 'Prefix'. Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.\n\nAs an example, consider the following scenario:\n\n `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,\n the JWT claims include \"username\":\"userA\" and \"email\":\"userA@myoidc.tld\",\n and `claim` is set to:\n - \"username\": the mapped value will be \"https://myoidc.tld#userA\"\n - \"email\": the mapped value will be \"userA@myoidc.tld\"", "prefix": "prefix configures the prefix that should be prepended to the value of the JWT claim.\n\nprefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.", } @@ -917,6 +918,7 @@ var map_Update = map[string]string{ "image": "image is a container image location that contains the update. image should be used when the desired version does not exist in availableUpdates or history. When image is set, architecture cannot be specified. If both version and image are set, the version extracted from the referenced image must match the specified version.", "force": "force allows an administrator to update to an image that has failed verification or upgradeable checks that are designed to keep your cluster safe. Only use this if: * you are testing unsigned release images in short-lived test clusters or * you are working around a known bug in the cluster-version\n operator and you have verified the authenticity of the provided\n image yourself.\nThe provided image will run with full administrative access to the cluster. Do not use this flag with images that come from unknown or potentially malicious sources.", "acceptRisks": "acceptRisks is an optional set of names of conditional update risks that are considered acceptable. A conditional update is performed only if all of its risks are acceptable. This list may contain entries that apply to current, previous or future updates. The entries therefore may not map directly to a risk in .status.conditionalUpdateRisks. acceptRisks must not contain more than 1000 entries. Entries in this list must be unique.", + "mode": "mode determines how an update should be processed. The only valid value is \"Preflight\". When omitted, the cluster performs a normal update by applying the specified version or image to the cluster. This is the standard update behavior. When set to \"Preflight\", the cluster runs compatibility checks against the target release without performing an actual update. Compatibility results, including any detected risks, are reported in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update recommendation service. This allows administrators to assess update readiness and address issues before committing to the update. Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be verified across multiple minor versions. When mode is set to \"Preflight\", the same rules for version, image, and architecture apply as for normal updates.", } func (Update) SwaggerDoc() map[string]string { @@ -986,7 +988,7 @@ func (ConsoleStatus) SwaggerDoc() map[string]string { var map_AWSDNSSpec = map[string]string{ "": "AWSDNSSpec contains DNS configuration specific to the Amazon Web Services cloud provider.", - "privateZoneIAMRole": "privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed.", + "privateZoneIAMRole": "privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed.\n\nThe ARN must follow the format: arn::iam:::role/, where: is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), is a 12-digit numeric identifier for the AWS account, is the IAM role name.", } func (AWSDNSSpec) SwaggerDoc() map[string]string { @@ -1752,7 +1754,7 @@ var map_InfrastructureStatus = map[string]string{ "etcdDiscoveryDomain": "etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering etcd servers and clients. For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.", "apiServerURL": "apiServerURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerURL can be used by components like the web console to tell users where to find the Kubernetes API.", "apiServerInternalURI": "apiServerInternalURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components like kubelets, to contact the Kubernetes API server using the infrastructure provider rather than Kubernetes networking.", - "controlPlaneTopology": "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster.", + "controlPlaneTopology": "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.", "infrastructureTopology": "infrastructureTopology expresses the expectations for infrastructure services that do not run on control plane nodes, usually indicated by a node selector for a `role` value other than `master`. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation NOTE: External topology mode is not applicable for this field.", "cpuPartitioning": "cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. Valid values are \"None\" and \"AllNodes\". When omitted, the default value is \"None\". The default value of \"None\" indicates that no nodes will be setup with CPU partitioning. The \"AllNodes\" value indicates that all nodes have been setup with CPU partitioning, and can then be further configured via the PerformanceProfile API.", } diff --git a/vendor/github.com/openshift/api/config/v1alpha1/register.go b/vendor/github.com/openshift/api/config/v1alpha1/register.go index 383d19e7e6..1d84b71079 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/register.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/register.go @@ -36,10 +36,6 @@ func addKnownTypes(scheme *runtime.Scheme) error { &InsightsDataGatherList{}, &Backup{}, &BackupList{}, - &ImagePolicy{}, - &ImagePolicyList{}, - &ClusterImagePolicy{}, - &ClusterImagePolicyList{}, &CRIOCredentialProviderConfig{}, &CRIOCredentialProviderConfigList{}, &PKI{}, diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_image_policy.go b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_image_policy.go deleted file mode 100644 index e8d7603d7b..0000000000 --- a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_image_policy.go +++ /dev/null @@ -1,80 +0,0 @@ -package v1alpha1 - -import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - -// +genclient -// +genclient:nonNamespaced -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// ClusterImagePolicy holds cluster-wide configuration for image signature verification -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -// +kubebuilder:object:root=true -// +kubebuilder:resource:path=clusterimagepolicies,scope=Cluster -// +kubebuilder:subresource:status -// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/1457 -// +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01 -// +openshift:enable:FeatureGate=SigstoreImageVerification -// +openshift:compatibility-gen:level=4 -type ClusterImagePolicy struct { - metav1.TypeMeta `json:",inline"` - - // metadata is the standard object's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - metav1.ObjectMeta `json:"metadata,omitempty"` - - // spec contains the configuration for the cluster image policy. - // +required - Spec ClusterImagePolicySpec `json:"spec"` - // status contains the observed state of the resource. - // +optional - Status ClusterImagePolicyStatus `json:"status,omitempty"` -} - -// CLusterImagePolicySpec is the specification of the ClusterImagePolicy custom resource. -type ClusterImagePolicySpec struct { - // scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the "Docker Registry HTTP API V2". - // Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). - // More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository - // namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). - // Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. - // If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. - // In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories - // quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. - // If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. - // For additional details about the format, please refer to the document explaining the docker transport field, - // which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker - // +required - // +kubebuilder:validation:MaxItems=256 - // +listType=set - Scopes []ImageScope `json:"scopes"` - // policy contains configuration to allow scopes to be verified, and defines how - // images not matching the verification policy will be treated. - // +required - Policy ImageSigstoreVerificationPolicy `json:"policy"` -} - -// +k8s:deepcopy-gen=true -type ClusterImagePolicyStatus struct { - // conditions provide details on the status of this API Resource. - // +listType=map - // +listMapKey=type - // +optional - Conditions []metav1.Condition `json:"conditions,omitempty"` -} - -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// ClusterImagePolicyList is a list of ClusterImagePolicy resources -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -// +openshift:compatibility-gen:level=4 -type ClusterImagePolicyList struct { - metav1.TypeMeta `json:",inline"` - - // metadata is the standard list's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - metav1.ListMeta `json:"metadata"` - - Items []ClusterImagePolicy `json:"items"` -} diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go index e72f537f99..08eaca29f3 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go @@ -89,6 +89,19 @@ type ClusterMonitoringSpec struct { // The current default value is `DefaultConfig`. // +optional AlertmanagerConfig AlertmanagerConfig `json:"alertmanagerConfig,omitempty,omitzero"` + // prometheusConfig provides configuration options for the default platform Prometheus instance + // that runs in the `openshift-monitoring` namespace. This configuration applies only to the + // platform Prometheus instance; user-workload Prometheus instances are configured separately. + // + // This field allows you to customize how the platform Prometheus is deployed and operated, including: + // - Pod scheduling (node selectors, tolerations, topology spread constraints) + // - Resource allocation (CPU, memory requests/limits) + // - Retention policies (how long metrics are stored) + // - External integrations (remote write, additional alertmanagers) + // + // This field is optional. When omitted, the platform chooses reasonable defaults, which may change over time. + // +optional + PrometheusConfig PrometheusConfig `json:"prometheusConfig,omitempty,omitzero"` // metricsServerConfig is an optional field that can be used to configure the Kubernetes Metrics Server that runs in the openshift-monitoring namespace. // Specifically, it can configure how the Metrics Server instance is deployed, pod scheduling, its audit policy and log verbosity. // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. @@ -107,6 +120,101 @@ type ClusterMonitoringSpec struct { // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. // +optional PrometheusOperatorAdmissionWebhookConfig PrometheusOperatorAdmissionWebhookConfig `json:"prometheusOperatorAdmissionWebhookConfig,omitempty,omitzero"` + // openShiftStateMetricsConfig is an optional field that can be used to configure the openshift-state-metrics + // agent that runs in the openshift-monitoring namespace. The openshift-state-metrics agent generates metrics + // about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // +optional + OpenShiftStateMetricsConfig OpenShiftStateMetricsConfig `json:"openShiftStateMetricsConfig,omitempty,omitzero"` + // telemeterClientConfig is an optional field that can be used to configure the Telemeter Client + // component that runs in the openshift-monitoring namespace. The Telemeter Client collects + // selected monitoring metrics and forwards them to Red Hat for telemetry purposes. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // When set, at least one field must be specified within telemeterClientConfig. + // +optional + TelemeterClientConfig TelemeterClientConfig `json:"telemeterClientConfig,omitempty,omitzero"` + // thanosQuerierConfig is an optional field that can be used to configure the Thanos Querier + // component that runs in the openshift-monitoring namespace. The Thanos Querier provides + // a global query view by aggregating and deduplicating metrics from multiple Prometheus instances. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The current default deploys the Thanos Querier on linux nodes with 5m CPU and 12Mi memory + // requests, and no custom tolerations or topology spread constraints. + // When set, at least one field must be specified within thanosQuerierConfig. + // +optional + ThanosQuerierConfig ThanosQuerierConfig `json:"thanosQuerierConfig,omitempty,omitzero"` +} + +// OpenShiftStateMetricsConfig provides configuration options for the openshift-state-metrics agent +// that runs in the `openshift-monitoring` namespace. The openshift-state-metrics agent generates +// metrics about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments. +// +kubebuilder:validation:MinProperties=1 +type OpenShiftStateMetricsConfig struct { + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries. + // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=10 + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // resources defines the compute resource requests and limits for the openshift-state-metrics container. + // This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. + // When not specified, defaults are used by the platform. Requests cannot exceed limits. + // This field is optional. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 1m + // limit: null + // - name: memory + // request: 32Mi + // limit: null + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + // +optional + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MaxItems=5 + // +kubebuilder:validation:MinItems=1 + Resources []ContainerResource `json:"resources,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=atomic + // +optional + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how openshift-state-metrics Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Default is empty list. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=map + // +listMapKey=topologyKey + // +listMapKey=whenUnsatisfiable + // +optional + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` } // UserDefinedMonitoring config for user-defined projects. @@ -196,13 +304,13 @@ type AlertmanagerCustomConfig struct { // - name: memory // request: 40Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. // +optional // +listType=map // +listMapKey=name - // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MaxItems=5 // +kubebuilder:validation:MinItems=1 Resources []ContainerResource `json:"resources,omitempty"` // secrets defines a list of secrets that need to be mounted into the Alertmanager. @@ -258,14 +366,12 @@ type AlertmanagerCustomConfig struct { // +listMapKey=whenUnsatisfiable // +optional TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` - // volumeClaimTemplate Defines persistent storage for Alertmanager. Use this setting to - // configure the persistent volume claim, including storage class, volume - // size, and name. + // volumeClaimTemplate defines persistent storage for Alertmanager. Use this setting to + // configure the persistent volume claim, including storage class and volume size. // If omitted, the Pod uses ephemeral storage and alert data will not persist // across restarts. - // This field is optional. // +optional - VolumeClaimTemplate *v1.PersistentVolumeClaim `json:"volumeClaimTemplate,omitempty"` + VolumeClaimTemplate *v1.PersistentVolumeClaim `json:"volumeClaimTemplate,omitempty,omitzero"` } // AlertManagerDeployMode defines the deployment state of the platform Alertmanager instance. @@ -286,22 +392,29 @@ const ( AlertManagerDeployModeCustomConfig AlertManagerDeployMode = "CustomConfig" ) -// logLevel defines the verbosity of logs emitted by Alertmanager. +// LogLevel defines the verbosity of logs emitted by Alertmanager. // Valid values are Error, Warn, Info and Debug. // +kubebuilder:validation:Enum=Error;Warn;Info;Debug type LogLevel string const ( - // Error only errors will be logged. + // LogLevelError only errors will be logged. LogLevelError LogLevel = "Error" - // Warn, both warnings and errors will be logged. + // LogLevelWarn, both warnings and errors will be logged. LogLevelWarn LogLevel = "Warn" - // Info, general information, warnings, and errors will all be logged. + // LogLevelInfo, general information, warnings, and errors will all be logged. LogLevelInfo LogLevel = "Info" - // Debug, detailed debugging information will be logged. + // LogLevelDebug, detailed debugging information will be logged. LogLevelDebug LogLevel = "Debug" ) +// MaxItems on []ContainerResource fields is kept at 5 to stay within the +// Kubernetes CRD CEL validation cost budget (StaticEstimatedCRDCostLimit). +// The quantity() CEL function has a high fixed estimated cost per invocation, +// and the limit-vs-request comparison rule is costed per maxItems per location. +// With multiple structs in ClusterMonitoringSpec embedding []ContainerResource, +// maxItems > 5 causes the total estimated rule cost to exceed the budget. + // ContainerResource defines a single resource requirement for a container. // +kubebuilder:validation:XValidation:rule="has(self.request) || has(self.limit)",message="at least one of request or limit must be set" // +kubebuilder:validation:XValidation:rule="!(has(self.request) && has(self.limit)) || quantity(self.limit).compareTo(quantity(self.request)) >= 0",message="limit must be greater than or equal to request" @@ -318,11 +431,12 @@ type ContainerResource struct { // request is the minimum amount of the resource required (e.g. "2Mi", "1Gi"). // This field is optional. // When limit is specified, request cannot be greater than limit. + // The value must be greater than 0 when specified. // +optional // +kubebuilder:validation:XIntOrString // +kubebuilder:validation:MaxLength=20 // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:XValidation:rule="isQuantity(self) && quantity(self).isGreaterThan(quantity('0'))",message="request must be a positive, non-zero quantity" + // +kubebuilder:validation:XValidation:rule="quantity(self).isGreaterThan(quantity('0'))",message="request must be a positive, non-zero quantity" Request resource.Quantity `json:"request,omitempty"` // limit is the maximum amount of the resource allowed (e.g. "2Mi", "1Gi"). @@ -333,7 +447,7 @@ type ContainerResource struct { // +kubebuilder:validation:XIntOrString // +kubebuilder:validation:MaxLength=20 // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:XValidation:rule="isQuantity(self) && quantity(self).isGreaterThan(quantity('0'))",message="limit must be a positive, non-zero quantity" + // +kubebuilder:validation:XValidation:rule="quantity(self).isGreaterThan(quantity('0'))",message="limit must be a positive, non-zero quantity" Limit resource.Quantity `json:"limit,omitempty"` } @@ -401,13 +515,13 @@ type MetricsServerConfig struct { // - name: memory // request: 40Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. // +optional // +listType=map // +listMapKey=name - // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MaxItems=5 // +kubebuilder:validation:MinItems=1 Resources []ContainerResource `json:"resources,omitempty"` // topologySpreadConstraints defines rules for how Metrics Server Pods should be distributed @@ -472,13 +586,13 @@ type PrometheusOperatorConfig struct { // - name: memory // request: 40Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. // +optional // +listType=map // +listMapKey=name - // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MaxItems=5 // +kubebuilder:validation:MinItems=1 Resources []ContainerResource `json:"resources,omitempty"` // tolerations defines tolerations for the pods. @@ -536,13 +650,13 @@ type PrometheusOperatorAdmissionWebhookConfig struct { // - name: memory // request: 30Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. // +optional // +listType=map // +listMapKey=name - // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MaxItems=5 // +kubebuilder:validation:MinItems=1 Resources []ContainerResource `json:"resources,omitempty"` // topologySpreadConstraints defines rules for how admission webhook Pods should be distributed @@ -566,34 +680,1286 @@ type PrometheusOperatorAdmissionWebhookConfig struct { TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` } -// AuditProfile defines the audit log level for the Metrics Server. -// +kubebuilder:validation:Enum=None;Metadata;Request;RequestResponse -type AuditProfile string +// PrometheusConfig provides configuration options for the Prometheus instance. +// Use this configuration to control +// Prometheus deployment, pod scheduling, resource allocation, retention policies, and external integrations. +// +kubebuilder:validation:MinProperties=1 +type PrometheusConfig struct { + // additionalAlertmanagerConfigs configures additional Alertmanager instances that receive alerts from + // the Prometheus component. This is useful for organizations that need to: + // - Send alerts to external monitoring systems (like PagerDuty, Slack, or custom webhooks) + // - Route different types of alerts to different teams or systems + // - Integrate with existing enterprise alerting infrastructure + // - Maintain separate alert routing for compliance or organizational requirements + // When omitted, no additional Alertmanager instances are configured (default behavior). + // When provided, at least one configuration must be specified (minimum 1, maximum 10 items). + // Entries must have unique names (name is the list key). + // +optional + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=10 + // +listType=map + // +listMapKey=name + AdditionalAlertmanagerConfigs []AdditionalAlertmanagerConfig `json:"additionalAlertmanagerConfigs,omitempty"` + // enforcedBodySizeLimitBytes enforces a body size limit (in bytes) for Prometheus scraped metrics. + // If a scraped target's body response is larger than the limit, the scrape will fail. + // This helps protect Prometheus from targets that return excessively large responses. + // The value is specified in bytes (e.g., 4194304 for 4MB, 1073741824 for 1GB). + // When omitted, the Cluster Monitoring Operator automatically calculates an appropriate + // limit based on cluster capacity. Set an explicit value to override the automatic calculation. + // Minimum value is 10240 (10kB). + // Maximum value is 1073741824 (1GB). + // +kubebuilder:validation:Minimum=10240 + // +kubebuilder:validation:Maximum=1073741824 + // +optional + EnforcedBodySizeLimitBytes int64 `json:"enforcedBodySizeLimitBytes,omitempty"` + // externalLabels defines labels to be attached to time series and alerts + // when communicating with external systems such as federation, remote storage, + // and Alertmanager. These labels are not stored with metrics on disk; they are + // only added when data leaves Prometheus (e.g., during federation queries, + // remote write, or alert notifications). + // At least 1 label must be specified when set, with a maximum of 50 labels allowed. + // Each label key must be unique within this list. + // When omitted, no external labels are applied. + // +optional + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=50 + // +listType=map + // +listMapKey=key + ExternalLabels []Label `json:"externalLabels,omitempty"` + // logLevel defines the verbosity of logs emitted by Prometheus. + // This field allows users to control the amount and severity of logs generated, which can be useful + // for debugging issues or reducing noise in production environments. + // Allowed values are Error, Warn, Info, and Debug. + // When set to Error, only errors will be logged. + // When set to Warn, both warnings and errors will be logged. + // When set to Info, general information, warnings, and errors will all be logged. + // When set to Debug, detailed debugging information will be logged. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. + // The current default value is `Info`. + // +optional + LogLevel LogLevel `json:"logLevel,omitempty"` + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least one key-value pair (minimum of 1) + // and must not contain more than 10 entries. + // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=10 + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // queryLogFile specifies the file to which PromQL queries are logged. + // This setting can be either a filename, in which + // case the queries are saved to an `emptyDir` volume + // at `/var/log/prometheus`, or a full path to a location where + // an `emptyDir` volume will be mounted and the queries saved. + // Writing to `/dev/stderr`, `/dev/stdout` or `/dev/null` is supported, but + // writing to any other `/dev/` path is not supported. Relative paths are + // also not supported. + // By default, PromQL queries are not logged. + // Must be an absolute path starting with `/` or a simple filename without path separators. + // Must not contain consecutive slashes, end with a slash, or include '..' path traversal. + // Must contain only alphanumeric characters, '.', '_', '-', or '/'. + // Must be between 1 and 255 characters in length. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._/-]+$')",message="must contain only alphanumeric characters, '.', '_', '-', or '/'" + // +kubebuilder:validation:XValidation:rule="self.startsWith('/') || !self.contains('/')",message="must be an absolute path starting with '/' or a simple filename without '/'" + // +kubebuilder:validation:XValidation:rule="!self.startsWith('/dev/') || self in ['/dev/stdout', '/dev/stderr', '/dev/null']",message="only /dev/stdout, /dev/stderr, and /dev/null are allowed as /dev/ paths" + // +kubebuilder:validation:XValidation:rule="!self.contains('//') && !self.endsWith('/') && !self.contains('..')",message="must not contain '//', end with '/', or contain '..'" + QueryLogFile string `json:"queryLogFile,omitempty"` + // remoteWrite defines the remote write configuration, including URL, authentication, and relabeling settings. + // Remote write allows Prometheus to send metrics it collects to external long-term storage systems. + // When omitted, no remote write endpoints are configured. + // When provided, at least one configuration must be specified (minimum 1, maximum 10 items). + // Entries must have unique names (name is the list key). + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=10 + // +listType=map + // +listMapKey=name + // +optional + RemoteWrite []RemoteWriteSpec `json:"remoteWrite,omitempty"` + // resources defines the compute resource requests and limits for the Prometheus container. + // This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. + // When not specified, defaults are used by the platform. Requests cannot exceed limits. + // This field is optional. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 4m + // limit: null + // - name: memory + // request: 40Mi + // limit: null + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + // +optional + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MaxItems=5 + // +kubebuilder:validation:MinItems=1 + Resources []ContainerResource `json:"resources,omitempty"` + // retention configures how long Prometheus retains metrics data and how much storage it can use. + // When omitted, the platform chooses reasonable defaults (currently 15 days retention, no size limit). + // +optional + Retention Retention `json:"retention,omitempty,omitzero"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10 + // Minimum length for this list is 1 + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=atomic + // +optional + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how Prometheus Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Default is empty list. + // Maximum length for this list is 10. + // Minimum length for this list is 1 + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=map + // +listMapKey=topologyKey + // +listMapKey=whenUnsatisfiable + // +optional + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` + // collectionProfile defines the metrics collection profile that Prometheus uses to collect + // metrics from the platform components. Supported values are `Full` or + // `Minimal`. In the `Full` profile (default), Prometheus collects all + // metrics that are exposed by the platform components. In the `Minimal` + // profile, Prometheus only collects metrics necessary for the default + // platform alerts, recording rules, telemetry and console dashboards. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is `Full`. + // +optional + CollectionProfile CollectionProfile `json:"collectionProfile,omitempty"` + // volumeClaimTemplate defines persistent storage for Prometheus. Use this setting to + // configure the persistent volume claim, including storage class and volume size. + // If omitted, the Pod uses ephemeral storage and Prometheus data will not persist + // across restarts. + // +optional + VolumeClaimTemplate *v1.PersistentVolumeClaim `json:"volumeClaimTemplate,omitempty,omitzero"` +} + +// AlertmanagerScheme defines the URL scheme to use when communicating with Alertmanager instances. +// +kubebuilder:validation:Enum=HTTP;HTTPS +type AlertmanagerScheme string const ( - // AuditProfileNone disables audit logging - AuditProfileNone AuditProfile = "None" - // AuditProfileMetadata logs request metadata (requesting user, timestamp, resource, verb, etc.) but not request or response body - AuditProfileMetadata AuditProfile = "Metadata" - // AuditProfileRequest logs event metadata and request body but not response body - AuditProfileRequest AuditProfile = "Request" - // AuditProfileRequestResponse logs event metadata, request and response bodies - AuditProfileRequestResponse AuditProfile = "RequestResponse" + AlertmanagerSchemeHTTP AlertmanagerScheme = "HTTP" + AlertmanagerSchemeHTTPS AlertmanagerScheme = "HTTPS" ) -// VerbosityLevel defines the verbosity of log messages for Metrics Server. -// +kubebuilder:validation:Enum=Errors;Info;Trace;TraceAll -type VerbosityLevel string +// AdditionalAlertmanagerConfig represents configuration for additional Alertmanager instances. +// The `AdditionalAlertmanagerConfig` resource defines settings for how a +// component communicates with additional Alertmanager instances. +type AdditionalAlertmanagerConfig struct { + // name is a unique identifier for this Alertmanager configuration entry. + // The name must be a valid DNS subdomain (RFC 1123): lowercase alphanumeric characters, + // hyphens, or periods, and must start and end with an alphanumeric character. + // Minimum length is 1 character (empty string is invalid). + // Maximum length is 253 characters. + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character." + // +required + Name string `json:"name,omitempty"` + // authorization configures the authentication method for Alertmanager connections. + // Supports bearer token authentication. When omitted, no authentication is used. + // +optional + Authorization AuthorizationConfig `json:"authorization,omitempty,omitzero"` + // pathPrefix defines an optional URL path prefix to prepend to the Alertmanager API endpoints. + // For example, if your Alertmanager is behind a reverse proxy at "/alertmanager/", + // set this to "/alertmanager" so requests go to "/alertmanager/api/v1/alerts" instead of "/api/v1/alerts". + // This is commonly needed when Alertmanager is deployed behind ingress controllers or load balancers. + // When no prefix is needed, omit this field; do not set it to "/" as that would produce paths with double slashes (e.g. "//api/v1/alerts"). + // Must start with "/", must not end with "/", and must not be exactly "/". + // Must not contain query strings ("?") or fragments ("#"). + // +kubebuilder:validation:MaxLength=255 + // +kubebuilder:validation:MinLength=2 + // +kubebuilder:validation:XValidation:rule="self.startsWith('/')",message="pathPrefix must start with '/'" + // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="pathPrefix must not end with '/'" + // +kubebuilder:validation:XValidation:rule="self != '/'",message="pathPrefix must not be '/' (would produce double slashes in request path); omit for no prefix" + // +kubebuilder:validation:XValidation:rule="!self.contains('?') && !self.contains('#')",message="pathPrefix must not contain '?' or '#'" + // +optional + PathPrefix string `json:"pathPrefix,omitempty"` + // scheme defines the URL scheme to use when communicating with Alertmanager + // instances. + // Possible values are `HTTP` or `HTTPS`. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The current default value is `HTTP`. + // +optional + Scheme AlertmanagerScheme `json:"scheme,omitempty"` + // staticConfigs is a list of statically configured Alertmanager endpoints in the form + // of `:`. Each entry must be a valid hostname, IPv4 address, or IPv6 address + // (in brackets) followed by a colon and a valid port number (1-65535). + // Examples: "alertmanager.example.com:9093", "192.168.1.100:9093", "[::1]:9093" + // At least one endpoint must be specified (minimum 1, maximum 10 endpoints). + // Each entry must be unique and non-empty (empty string is invalid). + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:items:MinLength=1 + // +kubebuilder:validation:items:MaxLength=255 + // +kubebuilder:validation:items:XValidation:rule="isURL('http://' + self) && size(url('http://' + self).getHostname()) > 0 && size(url('http://' + self).getPort()) > 0 && int(url('http://' + self).getPort()) >= 1 && int(url('http://' + self).getPort()) <= 65535",message="must be a valid 'host:port' where host is a DNS name, IPv4, or IPv6 address (in brackets), and port is 1-65535" + // +listType=set + // +required + StaticConfigs []string `json:"staticConfigs,omitempty"` + // timeoutSeconds defines the timeout in seconds for requests to Alertmanager. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Currently the default is 10 seconds. + // Minimum value is 1 second. + // Maximum value is 600 seconds (10 minutes). + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=600 + // +optional + TimeoutSeconds int32 `json:"timeoutSeconds,omitempty"` + // tlsConfig defines the TLS settings to use for Alertmanager connections. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // +optional + TLSConfig TLSConfig `json:"tlsConfig,omitempty,omitzero"` +} + +// Label represents a key/value pair for external labels. +type Label struct { + // key is the name of the label. + // Prometheus supports UTF-8 label names, so any valid UTF-8 string is allowed. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MaxLength=128 + // +kubebuilder:validation:MinLength=1 + Key string `json:"key,omitempty"` + // value is the value of the label. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MaxLength=128 + // +kubebuilder:validation:MinLength=1 + Value string `json:"value,omitempty"` +} + +// RemoteWriteSpec represents configuration for remote write endpoints. +type RemoteWriteSpec struct { + // url is the URL of the remote write endpoint. + // Must be a valid URL with http or https scheme and a non-empty hostname. + // Query parameters, fragments, and user information (e.g. user:password@host) are not allowed. + // Empty string is invalid. Must be between 1 and 2048 characters in length. + // +required + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:XValidation:rule="isURL(self)",message="must be a valid URL" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getScheme() == 'http' || url(self).getScheme() == 'https'",message="must use http or https scheme" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || size(url(self).getHostname()) > 0",message="must have a non-empty hostname" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getQuery().size() == 0",message="query parameters are not allowed" + // +kubebuilder:validation:XValidation:rule="!self.matches('.*#.*')",message="fragments are not allowed" + // +kubebuilder:validation:XValidation:rule="!self.matches('.*@.*')",message="user information (e.g. user:password@host) is not allowed" + URL string `json:"url,omitempty"` + // name is a required identifier for this remote write configuration (name is the list key for the remoteWrite list). + // This name is used in metrics and logging to differentiate remote write queues. + // Must contain only alphanumeric characters, hyphens, and underscores. + // Must be between 1 and 63 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9_-]+$')",message="must contain only alphanumeric characters, hyphens, and underscores" + Name string `json:"name,omitempty"` + // authorization defines the authorization method for the remote write endpoint. + // When omitted, no authorization is performed. + // When set, type must be one of BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, or ServiceAccount; the corresponding nested config must be set (ServiceAccount has no config). + // +optional + AuthorizationConfig RemoteWriteAuthorization `json:"authorization,omitzero"` + // headers specifies the custom HTTP headers to be sent along with each remote write request. + // Sending custom headers makes the configuration of a proxy in between optional and helps the + // receiver recognize the given source better. + // Clients MAY allow users to send custom HTTP headers; they MUST NOT allow users to configure + // them in such a way as to send reserved headers. Headers set by Prometheus cannot be overwritten. + // When omitted, no custom headers are sent. + // Maximum of 50 headers can be specified. Each header name must be unique. + // Each header name must contain only alphanumeric characters, hyphens, and underscores, and must not be a reserved Prometheus header (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate). + // +optional + // +kubebuilder:validation:MinItems=0 + // +kubebuilder:validation:MaxItems=50 + // +kubebuilder:validation:items:XValidation:rule="self.name.matches('^[a-zA-Z0-9_-]+$')",message="header name must contain only alphanumeric characters, hyphens, and underscores" + // +kubebuilder:validation:items:XValidation:rule="!self.name.matches('(?i)^(host|authorization|content-encoding|content-type|x-prometheus-remote-write-version|user-agent|connection|keep-alive|proxy-authenticate|proxy-authorization|www-authenticate)$')",message="header name must not be a reserved Prometheus header (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate)" + // +listType=map + // +listMapKey=name + Headers []PrometheusRemoteWriteHeader `json:"headers,omitempty"` + // metadataConfig configures the sending of series metadata to remote storage. + // When omitted, no metadata is sent. + // When set to sendPolicy: Default, metadata is sent using platform-chosen defaults (e.g. send interval 30 seconds). + // When set to sendPolicy: Custom, metadata is sent using the settings in the custom field (e.g. custom.sendIntervalSeconds). + // +optional + MetadataConfig MetadataConfig `json:"metadataConfig,omitempty,omitzero"` + // proxyUrl defines an optional proxy URL. + // If the cluster-wide proxy is enabled, it replaces the proxyUrl setting. + // The cluster-wide proxy supports both HTTP and HTTPS proxies, with HTTPS taking precedence. + // When omitted, no proxy is used. + // Must be a valid URL with http or https scheme. + // Must be between 1 and 2048 characters in length. + // +optional + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:XValidation:rule="isURL(self) && (url(self).getScheme() == 'http' || url(self).getScheme() == 'https')",message="must be a valid URL with http or https scheme" + ProxyURL string `json:"proxyUrl,omitempty"` + // queueConfig allows tuning configuration for remote write queue parameters. + // When omitted, default queue configuration is used. + // +optional + QueueConfig QueueConfig `json:"queueConfig,omitempty,omitzero"` + // remoteTimeoutSeconds defines the timeout in seconds for requests to the remote write endpoint. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 second. + // Maximum value is 600 seconds (10 minutes). + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=600 + RemoteTimeoutSeconds int32 `json:"remoteTimeoutSeconds,omitempty"` + // exemplarsMode controls whether exemplars are sent via remote write. + // Valid values are "Send", "DoNotSend" and omitted. + // When set to "Send", Prometheus is configured to store a maximum of 100,000 exemplars in memory and send them with remote write. + // Note that this setting only applies to user-defined monitoring. It is not applicable to default in-cluster monitoring. + // When omitted or set to "DoNotSend", exemplars are not sent. + // +optional + ExemplarsMode ExemplarsMode `json:"exemplarsMode,omitempty"` + // tlsConfig defines TLS authentication settings for the remote write endpoint. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // +optional + TLSConfig TLSConfig `json:"tlsConfig,omitempty,omitzero"` + // writeRelabelConfigs is a list of relabeling rules to apply before sending data to the remote endpoint. + // When omitted, no relabeling is performed and all metrics are sent as-is. + // Minimum of 1 and maximum of 10 relabeling rules can be specified. + // Each rule must have a unique name. + // +optional + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=10 + // +listType=map + // +listMapKey=name + WriteRelabelConfigs []RelabelConfig `json:"writeRelabelConfigs,omitempty"` +} + +// PrometheusRemoteWriteHeader defines a custom HTTP header for remote write requests. +// The header name must not be one of the reserved headers set by Prometheus (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate). +// Header names must contain only case-insensitive alphanumeric characters, hyphens (-), and underscores (_); other characters (e.g. emoji) are rejected by validation. +// Validation is enforced on the Headers field in RemoteWriteSpec. +type PrometheusRemoteWriteHeader struct { + // name is the HTTP header name. Must not be a reserved header (see type documentation). + // Must contain only alphanumeric characters, hyphens, and underscores; invalid characters are rejected. Must be between 1 and 256 characters. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=256 + Name string `json:"name,omitempty"` + // value is the HTTP header value. Must be at most 4096 characters. + // +required + // +kubebuilder:validation:MinLength=0 + // +kubebuilder:validation:MaxLength=4096 + Value *string `json:"value,omitempty"` +} + +// BasicAuth defines basic authentication settings for the remote write endpoint URL. +type BasicAuth struct { + // username defines the secret reference containing the username for basic authentication. + // The secret must exist in the openshift-monitoring namespace. + // +required + Username SecretKeySelector `json:"username,omitzero,omitempty"` + // password defines the secret reference containing the password for basic authentication. + // The secret must exist in the openshift-monitoring namespace. + // +required + Password SecretKeySelector `json:"password,omitzero,omitempty"` +} + +// RemoteWriteAuthorizationType defines the authorization method for remote write endpoints. +// +kubebuilder:validation:Enum=BearerToken;BasicAuth;OAuth2;SigV4;SafeAuthorization;ServiceAccount +type RemoteWriteAuthorizationType string const ( - // VerbosityLevelErrors means only critical messages and errors are logged. - VerbosityLevelErrors VerbosityLevel = "Errors" - // VerbosityLevelInfo means basic informational messages are logged. - VerbosityLevelInfo VerbosityLevel = "Info" - // VerbosityLevelTrace means extended information useful for general debugging is logged. - VerbosityLevelTrace VerbosityLevel = "Trace" - // VerbosityLevelTraceAll means detailed information about metric scraping operations is logged. - VerbosityLevelTraceAll VerbosityLevel = "TraceAll" + // RemoteWriteAuthorizationTypeBearerToken indicates bearer token from a secret. + RemoteWriteAuthorizationTypeBearerToken RemoteWriteAuthorizationType = "BearerToken" + // RemoteWriteAuthorizationTypeBasicAuth indicates HTTP basic authentication. + RemoteWriteAuthorizationTypeBasicAuth RemoteWriteAuthorizationType = "BasicAuth" + // RemoteWriteAuthorizationTypeOAuth2 indicates OAuth2 client credentials. + RemoteWriteAuthorizationTypeOAuth2 RemoteWriteAuthorizationType = "OAuth2" + // RemoteWriteAuthorizationTypeSigV4 indicates AWS Signature Version 4. + RemoteWriteAuthorizationTypeSigV4 RemoteWriteAuthorizationType = "SigV4" + // RemoteWriteAuthorizationTypeSafeAuthorization indicates authorization from a secret (Prometheus SafeAuthorization pattern). + // The secret key contains the credentials (e.g. a Bearer token). Use the safeAuthorization field. + RemoteWriteAuthorizationTypeSafeAuthorization RemoteWriteAuthorizationType = "SafeAuthorization" + // RemoteWriteAuthorizationTypeServiceAccount indicates use of the pod's service account token for machine identity. + // No additional field is required; the operator configures the token path. + RemoteWriteAuthorizationTypeServiceAccount RemoteWriteAuthorizationType = "ServiceAccount" +) + +// RemoteWriteAuthorization defines the authorization method for a remote write endpoint. +// Exactly one of the nested configs must be set according to the type discriminator. +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'BearerToken' ? has(self.bearerToken) : !has(self.bearerToken)",message="bearerToken is required when type is BearerToken, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'BasicAuth' ? has(self.basicAuth) : !has(self.basicAuth)",message="basicAuth is required when type is BasicAuth, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'OAuth2' ? has(self.oauth2) : !has(self.oauth2)",message="oauth2 is required when type is OAuth2, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'SigV4' ? has(self.sigv4) : !has(self.sigv4)",message="sigv4 is required when type is SigV4, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'SafeAuthorization' ? has(self.safeAuthorization) : !has(self.safeAuthorization)",message="safeAuthorization is required when type is SafeAuthorization, and forbidden otherwise" +// +union +type RemoteWriteAuthorization struct { + // type specifies the authorization method to use. + // Allowed values are BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, ServiceAccount. + // + // When set to BearerToken, the bearer token is read from a Secret referenced by the bearerToken field. + // + // When set to BasicAuth, HTTP basic authentication is used; the basicAuth field (username and password from Secrets) must be set. + // + // When set to OAuth2, OAuth2 client credentials flow is used; the oauth2 field (clientId, clientSecret, tokenUrl) must be set. + // + // When set to SigV4, AWS Signature Version 4 is used for authentication; the sigv4 field must be set. + // + // When set to SafeAuthorization, credentials are read from a single Secret key (Prometheus SafeAuthorization pattern). The secret key typically contains a Bearer token. Use the safeAuthorization field. + // + // When set to ServiceAccount, the pod's service account token is used for machine identity. No additional field is required; the operator configures the token path. + // +unionDiscriminator + // +required + Type RemoteWriteAuthorizationType `json:"type,omitempty"` + // safeAuthorization defines the secret reference containing the credentials for authentication (e.g. Bearer token). + // Required when type is "SafeAuthorization", and forbidden otherwise. Maps to Prometheus SafeAuthorization. The secret must exist in the openshift-monitoring namespace. + // +unionMember + // +optional + SafeAuthorization *v1.SecretKeySelector `json:"safeAuthorization,omitempty"` + // bearerToken defines the secret reference containing the bearer token. + // Required when type is "BearerToken", and forbidden otherwise. + // +unionMember + // +optional + BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` + // basicAuth defines HTTP basic authentication credentials. + // Required when type is "BasicAuth", and forbidden otherwise. + // +unionMember + // +optional + BasicAuth BasicAuth `json:"basicAuth,omitempty,omitzero"` + // oauth2 defines OAuth2 client credentials authentication. + // Required when type is "OAuth2", and forbidden otherwise. + // +unionMember + // +optional + OAuth2 OAuth2 `json:"oauth2,omitempty,omitzero"` + // sigv4 defines AWS Signature Version 4 authentication. + // Required when type is "SigV4", and forbidden otherwise. + // +unionMember + // +optional + Sigv4 Sigv4 `json:"sigv4,omitempty,omitzero"` +} + +// MetadataConfigSendPolicy defines whether to send metadata with platform defaults or with custom settings. +// +kubebuilder:validation:Enum=Default;Custom +type MetadataConfigSendPolicy string + +const ( + // MetadataConfigSendPolicyDefault indicates metadata is sent using platform-chosen defaults (e.g. send interval 30 seconds). + MetadataConfigSendPolicyDefault MetadataConfigSendPolicy = "Default" + // MetadataConfigSendPolicyCustom indicates metadata is sent using the settings in the custom field. + MetadataConfigSendPolicyCustom MetadataConfigSendPolicy = "Custom" +) + +// MetadataConfig defines whether and how to send series metadata to remote write storage. +// +kubebuilder:validation:XValidation:rule="self.sendPolicy == 'Default' ? self.custom.sendIntervalSeconds == 0 : true",message="custom is forbidden when sendPolicy is Default" +type MetadataConfig struct { + // sendPolicy specifies whether to send metadata and how it is configured. + // Default: send metadata using platform-chosen defaults (e.g. send interval 30 seconds). + // Custom: send metadata using the settings in the custom field. + // +required + SendPolicy MetadataConfigSendPolicy `json:"sendPolicy,omitempty"` + // custom defines custom metadata send settings. Required when sendPolicy is Custom (must have at least one property), and forbidden when sendPolicy is Default. + // +optional + Custom MetadataConfigCustom `json:"custom,omitempty,omitzero"` +} + +// MetadataConfigCustom defines custom settings for sending series metadata when sendPolicy is Custom. +// At least one property must be set when sendPolicy is Custom (e.g. sendIntervalSeconds). +// +kubebuilder:validation:MinProperties=1 +type MetadataConfigCustom struct { + // sendIntervalSeconds is the interval in seconds at which metadata is sent. + // When omitted, the platform chooses a reasonable default (e.g. 30 seconds). + // Minimum value is 1 second. Maximum value is 86400 seconds (24 hours). + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=86400 + SendIntervalSeconds int32 `json:"sendIntervalSeconds,omitempty"` +} + +// OAuth2 defines OAuth2 authentication settings for the remote write endpoint. +type OAuth2 struct { + // clientId defines the secret reference containing the OAuth2 client ID. + // The secret must exist in the openshift-monitoring namespace. + // +required + ClientID SecretKeySelector `json:"clientId,omitzero,omitempty"` + // clientSecret defines the secret reference containing the OAuth2 client secret. + // The secret must exist in the openshift-monitoring namespace. + // +required + ClientSecret SecretKeySelector `json:"clientSecret,omitzero,omitempty"` + // tokenUrl is the URL to fetch the token from. + // Must be a valid URL with http or https scheme. + // Must be between 1 and 2048 characters in length. + // +required + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:XValidation:rule="isURL(self)",message="must be a valid URL" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getScheme() == 'http' || url(self).getScheme() == 'https'",message="must use http or https scheme" + TokenURL string `json:"tokenUrl,omitempty"` + // scopes is a list of OAuth2 scopes to request. + // When omitted, no scopes are requested. + // Maximum of 20 scopes can be specified. + // Each scope must be between 1 and 256 characters. + // +optional + // +kubebuilder:validation:MinItems=0 + // +kubebuilder:validation:MaxItems=20 + // +kubebuilder:validation:items:MinLength=1 + // +kubebuilder:validation:items:MaxLength=256 + // +listType=atomic + Scopes []string `json:"scopes,omitempty"` + // endpointParams defines additional parameters to append to the token URL. + // When omitted, no additional parameters are sent. + // Maximum of 20 parameters can be specified. Entries must have unique names (name is the list key). + // +optional + // +kubebuilder:validation:MinItems=0 + // +kubebuilder:validation:MaxItems=20 + // +listType=map + // +listMapKey=name + EndpointParams []OAuth2EndpointParam `json:"endpointParams,omitempty"` +} + +// OAuth2EndpointParam defines a name/value parameter for the OAuth2 token URL. +type OAuth2EndpointParam struct { + // name is the parameter name. Must be between 1 and 256 characters. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=256 + Name string `json:"name,omitempty"` + // value is the optional parameter value. When omitted, the query parameter is applied as ?name (no value). + // When set (including to the empty string), it is applied as ?name=value. Empty string may be used when the + // external system expects a parameter with an empty value (e.g. ?parameter=""). + // Must be between 0 and 2048 characters when present (aligned with common URL length recommendations). + // +optional + // +kubebuilder:validation:MinLength=0 + // +kubebuilder:validation:MaxLength=2048 + Value *string `json:"value,omitempty"` +} + +// QueueConfig allows tuning configuration for remote write queue parameters. +// Configure this when you need to control throughput, backpressure, or retry behavior—for example to avoid overloading the remote endpoint, to reduce memory usage, or to tune for high-cardinality workloads. Consider capacity, maxShards, and batchSendDeadlineSeconds for throughput; minBackoffMilliseconds and maxBackoffMilliseconds for retries; and rateLimitedAction when the remote returns HTTP 429. +// +kubebuilder:validation:MinProperties=1 +type QueueConfig struct { + // capacity is the number of samples to buffer per shard before we start dropping them. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 10000. + // Minimum value is 1. + // Maximum value is 1000000. + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=1000000 + Capacity int32 `json:"capacity,omitempty"` + // maxShards is the maximum number of shards, i.e. amount of concurrency. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 200. + // Minimum value is 1. + // Maximum value is 10000. + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=10000 + MaxShards int32 `json:"maxShards,omitempty"` + // minShards is the minimum number of shards, i.e. amount of concurrency. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 1. + // Minimum value is 1. + // Maximum value is 10000. + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=10000 + MinShards int32 `json:"minShards,omitempty"` + // maxSamplesPerSend is the maximum number of samples per send. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 1000. + // Minimum value is 1. + // Maximum value is 100000. + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=100000 + MaxSamplesPerSend int32 `json:"maxSamplesPerSend,omitempty"` + // batchSendDeadlineSeconds is the maximum time in seconds a sample will wait in buffer before being sent. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 second. + // Maximum value is 3600 seconds (1 hour). + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=3600 + BatchSendDeadlineSeconds int32 `json:"batchSendDeadlineSeconds,omitempty"` + // minBackoffMilliseconds is the minimum retry delay in milliseconds. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 millisecond. + // Maximum value is 3600000 milliseconds (1 hour). + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=3600000 + MinBackoffMilliseconds int32 `json:"minBackoffMilliseconds,omitempty"` + // maxBackoffMilliseconds is the maximum retry delay in milliseconds. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 millisecond. + // Maximum value is 3600000 milliseconds (1 hour). + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=3600000 + MaxBackoffMilliseconds int32 `json:"maxBackoffMilliseconds,omitempty"` + // rateLimitedAction controls what to do when the remote write endpoint returns HTTP 429 (Too Many Requests). + // When omitted, no retries are performed on rate limit responses. + // When set to "Retry", Prometheus will retry such requests using the backoff settings above. + // Valid value when set is "Retry". + // +optional + RateLimitedAction RateLimitedAction `json:"rateLimitedAction,omitempty"` +} + +// Sigv4 defines AWS Signature Version 4 authentication settings. +// At least one of region, accessKey/secretKey, profile, or roleArn must be set so the platform can perform authentication. +// +kubebuilder:validation:MinProperties=1 +type Sigv4 struct { + // region is the AWS region. + // When omitted, the region is derived from the environment or instance metadata. + // Must be between 1 and 128 characters. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + Region string `json:"region,omitempty"` + // accessKey defines the secret reference containing the AWS access key ID. + // The secret must exist in the openshift-monitoring namespace. + // When omitted, the access key is derived from the environment or instance metadata. + // +optional + AccessKey SecretKeySelector `json:"accessKey,omitempty,omitzero"` + // secretKey defines the secret reference containing the AWS secret access key. + // The secret must exist in the openshift-monitoring namespace. + // When omitted, the secret key is derived from the environment or instance metadata. + // +optional + SecretKey SecretKeySelector `json:"secretKey,omitempty,omitzero"` + // profile is the named AWS profile used to authenticate. + // When omitted, the default profile is used. + // Must be between 1 and 128 characters. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + Profile string `json:"profile,omitempty"` + // roleArn is the AWS Role ARN, an alternative to using AWS API keys. + // When omitted, API keys are used for authentication. + // Must be a valid AWS ARN format (e.g., "arn:aws:iam::123456789012:role/MyRole"). + // Must be between 1 and 512 characters. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=512 + // +kubebuilder:validation:XValidation:rule=`self.startsWith('arn:aws') && self.matches('^arn:aws(-[a-z]+)?:iam::[0-9]{12}:role/.+$')`,message="must be a valid AWS IAM role ARN (e.g., arn:aws:iam::123456789012:role/MyRole)" + RoleArn string `json:"roleArn,omitempty"` +} + +// RelabelConfig represents a relabeling rule. +type RelabelConfig struct { + // name is a unique identifier for this relabel configuration. + // Must contain only alphanumeric characters, hyphens, and underscores. + // Must be between 1 and 63 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9_-]+$')",message="must contain only alphanumeric characters, hyphens, and underscores" + Name string `json:"name,omitempty"` + + // sourceLabels specifies which label names to extract from each series for this relabeling rule. + // The values of these labels are joined together using the configured separator, + // and the resulting string is then matched against the regular expression. + // If a referenced label does not exist on a series, Prometheus substitutes an empty string. + // When omitted, the rule operates without extracting source labels (useful for actions like labelmap). + // Minimum of 1 and maximum of 10 source labels can be specified, each between 1 and 128 characters. + // Each entry must be unique. + // Label names beginning with "__" (two underscores) are reserved for internal Prometheus use and are not allowed. + // Label names SHOULD start with a letter (a-z, A-Z) or underscore (_), followed by zero or more letters, digits (0-9), or underscores for best compatibility. + // While Prometheus supports UTF-8 characters in label names (since v3.0.0), using the recommended character set + // ensures better compatibility with the wider ecosystem (tooling, third-party instrumentation, etc.). + // +optional + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:items:MinLength=1 + // +kubebuilder:validation:items:MaxLength=128 + // +kubebuilder:validation:items:XValidation:rule="!self.startsWith('__')",message="label names beginning with '__' (two underscores) are reserved for internal Prometheus use and are not allowed" + // +listType=set + SourceLabels []string `json:"sourceLabels,omitempty"` + + // separator is the character sequence used to join source label values. + // Common examples: ";", ",", "::", "|||". + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is ";". + // Must be between 1 and 5 characters in length when specified. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=5 + Separator string `json:"separator,omitempty"` + + // regex is the regular expression to match against the concatenated source label values. + // Must be a valid RE2 regular expression (https://github.com/google/re2/wiki/Syntax). + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is "(.*)" to match everything. + // Must be between 1 and 1000 characters in length when specified. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=1000 + Regex string `json:"regex,omitempty"` + + // action defines the action to perform on the matched labels and its configuration. + // Exactly one action-specific configuration must be specified based on the action type. + // +required + Action RelabelActionConfig `json:"action,omitzero"` +} + +// RelabelActionConfig represents the action to perform and its configuration. +// Exactly one action-specific configuration must be specified based on the action type. +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Replace' ? has(self.replace) : !has(self.replace)",message="replace is required when type is Replace, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'HashMod' ? has(self.hashMod) : !has(self.hashMod)",message="hashMod is required when type is HashMod, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Lowercase' ? has(self.lowercase) : !has(self.lowercase)",message="lowercase is required when type is Lowercase, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Uppercase' ? has(self.uppercase) : !has(self.uppercase)",message="uppercase is required when type is Uppercase, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'KeepEqual' ? has(self.keepEqual) : !has(self.keepEqual)",message="keepEqual is required when type is KeepEqual, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'DropEqual' ? has(self.dropEqual) : !has(self.dropEqual)",message="dropEqual is required when type is DropEqual, and forbidden otherwise" +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'LabelMap' ? has(self.labelMap) : !has(self.labelMap)",message="labelMap is required when type is LabelMap, and forbidden otherwise" +// +union +type RelabelActionConfig struct { + // type specifies the action to perform on the matched labels. + // Allowed values are Replace, Lowercase, Uppercase, Keep, Drop, KeepEqual, DropEqual, HashMod, LabelMap, LabelDrop, LabelKeep. + // + // When set to Replace, regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. If regex does not match, no replacement takes place. + // + // When set to Lowercase, the concatenated source_labels are mapped to their lower case. Requires Prometheus >= v2.36.0. + // + // When set to Uppercase, the concatenated source_labels are mapped to their upper case. Requires Prometheus >= v2.36.0. + // + // When set to Keep, targets for which regex does not match the concatenated source_labels are dropped. + // + // When set to Drop, targets for which regex matches the concatenated source_labels are dropped. + // + // When set to KeepEqual, targets for which the concatenated source_labels do not match target_label are dropped. Requires Prometheus >= v2.41.0. + // + // When set to DropEqual, targets for which the concatenated source_labels do match target_label are dropped. Requires Prometheus >= v2.41.0. + // + // When set to HashMod, target_label is set to the modulus of a hash of the concatenated source_labels. + // + // When set to LabelMap, regex is matched against all source label names (not just source_labels); matching label values are copied to new names given by replacement with ${1}, ${2}, ... substituted. + // + // When set to LabelDrop, regex is matched against all label names; any label that matches is removed. + // + // When set to LabelKeep, regex is matched against all label names; any label that does not match is removed. + // +required + // +unionDiscriminator + Type RelabelAction `json:"type,omitempty"` + + // replace configures the Replace action. + // Required when type is Replace, and forbidden otherwise. + // +unionMember + // +optional + Replace ReplaceActionConfig `json:"replace,omitempty,omitzero"` + + // hashMod configures the HashMod action. + // Required when type is HashMod, and forbidden otherwise. + // +unionMember + // +optional + HashMod HashModActionConfig `json:"hashMod,omitempty,omitzero"` + + // labelMap configures the LabelMap action. + // Required when type is LabelMap, and forbidden otherwise. + // +unionMember + // +optional + LabelMap LabelMapActionConfig `json:"labelMap,omitempty,omitzero"` + + // lowercase configures the Lowercase action. + // Required when type is Lowercase, and forbidden otherwise. + // Requires Prometheus >= v2.36.0. + // +unionMember + // +optional + Lowercase LowercaseActionConfig `json:"lowercase,omitempty,omitzero"` + + // uppercase configures the Uppercase action. + // Required when type is Uppercase, and forbidden otherwise. + // Requires Prometheus >= v2.36.0. + // +unionMember + // +optional + Uppercase UppercaseActionConfig `json:"uppercase,omitempty,omitzero"` + + // keepEqual configures the KeepEqual action. + // Required when type is KeepEqual, and forbidden otherwise. + // Requires Prometheus >= v2.41.0. + // +unionMember + // +optional + KeepEqual KeepEqualActionConfig `json:"keepEqual,omitempty,omitzero"` + + // dropEqual configures the DropEqual action. + // Required when type is DropEqual, and forbidden otherwise. + // Requires Prometheus >= v2.41.0. + // +unionMember + // +optional + DropEqual DropEqualActionConfig `json:"dropEqual,omitempty,omitzero"` +} + +// ReplaceActionConfig configures the Replace action. +// Regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. No replacement if regex does not match. +type ReplaceActionConfig struct { + // targetLabel is the label name where the replacement result is written. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + TargetLabel string `json:"targetLabel,omitempty"` + + // replacement is the value written to target_label when regex matches; match group references (${1}, ${2}, ...) are substituted. + // Required when using the Replace action so the intended behavior is explicit and the platform does not need to apply defaults. + // Use "$1" for the first capture group, "$2" for the second, etc. Use an empty string ("") to explicitly clear the target label value. + // Must be between 0 and 255 characters in length. + // +required + // +kubebuilder:validation:MinLength=0 + // +kubebuilder:validation:MaxLength=255 + Replacement *string `json:"replacement,omitempty"` +} + +// HashModActionConfig configures the HashMod action. +// target_label is set to the modulus of a hash of the concatenated source_labels (target = hash % modulus). +type HashModActionConfig struct { + // targetLabel is the label name where the hash modulus result is written. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + TargetLabel string `json:"targetLabel,omitempty"` + + // modulus is the divisor applied to the hash of the concatenated source label values (target = hash % modulus). + // Required when using the HashMod action so the intended behavior is explicit. + // Must be between 1 and 1000000. + // +required + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=1000000 + Modulus int64 `json:"modulus,omitempty"` +} + +// LowercaseActionConfig configures the Lowercase action. +// Maps the concatenated source_labels to their lower case and writes to target_label. +// Requires Prometheus >= v2.36.0. +type LowercaseActionConfig struct { + // targetLabel is the label name where the lower-cased value is written. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + TargetLabel string `json:"targetLabel,omitempty"` +} + +// UppercaseActionConfig configures the Uppercase action. +// Maps the concatenated source_labels to their upper case and writes to target_label. +// Requires Prometheus >= v2.36.0. +type UppercaseActionConfig struct { + // targetLabel is the label name where the upper-cased value is written. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + TargetLabel string `json:"targetLabel,omitempty"` +} + +// KeepEqualActionConfig configures the KeepEqual action. +// Drops targets for which the concatenated source_labels do not match the value of target_label. +// Requires Prometheus >= v2.41.0. +type KeepEqualActionConfig struct { + // targetLabel is the label name whose value is compared to the concatenated source_labels; targets that do not match are dropped. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + TargetLabel string `json:"targetLabel,omitempty"` +} + +// DropEqualActionConfig configures the DropEqual action. +// Drops targets for which the concatenated source_labels do match the value of target_label. +// Requires Prometheus >= v2.41.0. +type DropEqualActionConfig struct { + // targetLabel is the label name whose value is compared to the concatenated source_labels; targets that match are dropped. + // Must be between 1 and 128 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=128 + TargetLabel string `json:"targetLabel,omitempty"` +} + +// LabelMapActionConfig configures the LabelMap action. +// Regex is matched against all source label names (not just source_labels). Matching label values are copied to new label names given by replacement, with match group references (${1}, ${2}, ...) substituted. +type LabelMapActionConfig struct { + // replacement is the template for new label names; match group references (${1}, ${2}, ...) are substituted from the matched label name. + // Required when using the LabelMap action so the intended behavior is explicit and the platform does not need to apply defaults. + // Use "$1" for the first capture group, "$2" for the second, etc. + // Must be between 1 and 255 characters in length. Empty string is invalid as it would produce invalid label names. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + Replacement string `json:"replacement,omitempty"` +} + +// TLSConfig represents TLS configuration for Alertmanager connections. +// At least one TLS configuration option must be specified. +// For mutual TLS (mTLS), both cert and key must be specified together, or both omitted. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="(has(self.cert) && has(self.key)) || (!has(self.cert) && !has(self.key))",message="cert and key must both be specified together for mutual TLS, or both be omitted" +type TLSConfig struct { + // ca is an optional CA certificate to use for TLS connections. + // When omitted, the system's default CA bundle is used. + // +optional + CA SecretKeySelector `json:"ca,omitempty,omitzero"` + // cert is an optional client certificate to use for mutual TLS connections. + // When omitted, no client certificate is presented. + // +optional + Cert SecretKeySelector `json:"cert,omitempty,omitzero"` + // key is an optional client key to use for mutual TLS connections. + // When omitted, no client key is used. + // +optional + Key SecretKeySelector `json:"key,omitempty,omitzero"` + // serverName is an optional server name to use for TLS connections. + // When specified, must be a valid DNS subdomain as per RFC 1123. + // When omitted, the server name is derived from the URL. + // Must be between 1 and 253 characters in length. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="must be a valid DNS subdomain (lowercase alphanumeric characters, '-' or '.', start and end with alphanumeric)" + ServerName string `json:"serverName,omitempty"` + // certificateVerification determines the policy for TLS certificate verification. + // Allowed values are "Verify" (performs certificate verification, secure) and "SkipVerify" (skips verification, insecure). + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is "Verify". + // +optional + CertificateVerification CertificateVerificationType `json:"certificateVerification,omitempty"` +} + +// CertificateVerificationType defines the TLS certificate verification policy. +// +kubebuilder:validation:Enum=Verify;SkipVerify +type CertificateVerificationType string + +const ( + // CertificateVerificationVerify performs certificate verification (secure, recommended). + CertificateVerificationVerify CertificateVerificationType = "Verify" + // CertificateVerificationSkipVerify skips certificate verification (insecure, use with caution). + CertificateVerificationSkipVerify CertificateVerificationType = "SkipVerify" +) + +// AuthorizationType defines the type of authentication to use. +// +kubebuilder:validation:Enum=BearerToken +type AuthorizationType string + +const ( + // AuthorizationTypeBearerToken indicates bearer token authentication. + AuthorizationTypeBearerToken AuthorizationType = "BearerToken" +) + +// AuthorizationConfig defines the authentication method for Alertmanager connections. +// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'BearerToken' ? has(self.bearerToken) : !has(self.bearerToken)",message="bearerToken is required when type is BearerToken" +// +union +type AuthorizationConfig struct { + // type specifies the authentication type to use. + // Valid value is "BearerToken" (bearer token authentication). + // When set to BearerToken, the bearerToken field must be specified. + // +unionDiscriminator + // +required + Type AuthorizationType `json:"type,omitempty"` + // bearerToken defines the secret reference containing the bearer token. + // Required when type is "BearerToken", and forbidden otherwise. + // The secret must exist in the openshift-monitoring namespace. + // +optional + BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` +} + +// SecretKeySelector selects a key of a Secret in the `openshift-monitoring` namespace. +// +structType=atomic +type SecretKeySelector struct { + // name is the name of the secret in the `openshift-monitoring` namespace to select from. + // Must be a valid Kubernetes secret name (lowercase alphanumeric, '-' or '.', start/end with alphanumeric). + // Must be between 1 and 253 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="must be a valid secret name (lowercase alphanumeric characters, '-' or '.', start and end with alphanumeric)" + Name string `json:"name,omitempty"` + // key is the key of the secret to select from. + // Must consist of alphanumeric characters, '-', '_', or '.'. + // Must be between 1 and 253 characters in length. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+$')",message="must contain only alphanumeric characters, '-', '_', or '.'" + Key string `json:"key,omitempty"` +} + +// Retention configures how long Prometheus retains metrics data and how much storage it can use. +// +kubebuilder:validation:MinProperties=1 +type Retention struct { + // durationInDays specifies how many days Prometheus will retain metrics data. + // Prometheus automatically deletes data older than this duration. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 15. + // Minimum value is 1 day. + // Maximum value is 365 days (1 year). + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=365 + // +optional + DurationInDays int32 `json:"durationInDays,omitempty"` + // sizeInGiB specifies the maximum storage size in gibibytes (GiB) that Prometheus + // can use for data blocks and the write-ahead log (WAL). + // When the limit is reached, Prometheus will delete oldest data first. + // When omitted, no size limit is enforced and Prometheus uses available PersistentVolume capacity. + // Minimum value is 1 GiB. + // Maximum value is 16384 GiB (16 TiB). + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=16384 + // +optional + SizeInGiB int32 `json:"sizeInGiB,omitempty"` +} + +// RelabelAction defines the action to perform in a relabeling rule. +// +kubebuilder:validation:Enum=Replace;Keep;Drop;HashMod;LabelMap;LabelDrop;LabelKeep;Lowercase;Uppercase;KeepEqual;DropEqual +type RelabelAction string + +const ( + // RelabelActionReplace: match regex against concatenated source_labels; set target_label to replacement with ${1}, ${2}, ... substituted. No replacement if regex does not match. + RelabelActionReplace RelabelAction = "Replace" + // RelabelActionLowercase: map the concatenated source_labels to their lower case. + RelabelActionLowercase RelabelAction = "Lowercase" + // RelabelActionUppercase: map the concatenated source_labels to their upper case. + RelabelActionUppercase RelabelAction = "Uppercase" + // RelabelActionKeep: drop targets for which regex does not match the concatenated source_labels. + RelabelActionKeep RelabelAction = "Keep" + // RelabelActionDrop: drop targets for which regex matches the concatenated source_labels. + RelabelActionDrop RelabelAction = "Drop" + // RelabelActionKeepEqual: drop targets for which the concatenated source_labels do not match target_label. + RelabelActionKeepEqual RelabelAction = "KeepEqual" + // RelabelActionDropEqual: drop targets for which the concatenated source_labels do match target_label. + RelabelActionDropEqual RelabelAction = "DropEqual" + // RelabelActionHashMod: set target_label to the modulus of a hash of the concatenated source_labels. + RelabelActionHashMod RelabelAction = "HashMod" + // RelabelActionLabelMap: match regex against all source label names; copy matching label values to new names given by replacement with ${1}, ${2}, ... substituted. + RelabelActionLabelMap RelabelAction = "LabelMap" + // RelabelActionLabelDrop: match regex against all label names; any label that matches is removed. + RelabelActionLabelDrop RelabelAction = "LabelDrop" + // RelabelActionLabelKeep: match regex against all label names; any label that does not match is removed. + RelabelActionLabelKeep RelabelAction = "LabelKeep" +) + +// CollectionProfile defines the metrics collection profile for Prometheus. +// +kubebuilder:validation:Enum=Full;Minimal +type CollectionProfile string + +const ( + // CollectionProfileFull means Prometheus collects all metrics that are exposed by the platform components. + CollectionProfileFull CollectionProfile = "Full" + // CollectionProfileMinimal means Prometheus only collects metrics necessary for the default + // platform alerts, recording rules, telemetry and console dashboards. + CollectionProfileMinimal CollectionProfile = "Minimal" +) + +// TelemeterClientConfig provides configuration options for the Telemeter Client component +// that runs in the `openshift-monitoring` namespace. The Telemeter Client collects selected +// monitoring metrics and forwards them to Red Hat for telemetry purposes. +// At least one field must be specified. +// +kubebuilder:validation:MinProperties=1 +type TelemeterClientConfig struct { + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries. + // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=10 + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // resources defines the compute resource requests and limits for the Telemeter Client container. + // This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. + // When not specified, defaults are used by the platform. Requests cannot exceed limits. + // This field is optional. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 1m + // limit: null + // - name: memory + // request: 40Mi + // limit: null + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + // +optional + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MaxItems=5 + // +kubebuilder:validation:MinItems=1 + Resources []ContainerResource `json:"resources,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=atomic + // +optional + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how Telemeter Client Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Default is empty list. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=map + // +listMapKey=topologyKey + // +listMapKey=whenUnsatisfiable + // +optional + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` +} + +// ThanosQuerierConfig provides configuration options for the Thanos Querier component +// that runs in the `openshift-monitoring` namespace. +// At least one field must be specified; an empty thanosQuerierConfig object is not allowed. +// +kubebuilder:validation:MinProperties=1 +type ThanosQuerierConfig struct { + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries. + // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=10 + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // resources defines the compute resource requests and limits for the Thanos Querier container. + // resources is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Requests cannot exceed limits. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 5m + // - name: memory + // request: 12Mi + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + // +optional + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MaxItems=5 + // +kubebuilder:validation:MinItems=1 + Resources []ContainerResource `json:"resources,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=atomic + // +optional + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how Thanos Querier Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + // +kubebuilder:validation:MaxItems=10 + // +kubebuilder:validation:MinItems=1 + // +listType=map + // +listMapKey=topologyKey + // +listMapKey=whenUnsatisfiable + // +optional + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` +} + +// AuditProfile defines the audit log level for the Metrics Server. +// +kubebuilder:validation:Enum=None;Metadata;Request;RequestResponse +type AuditProfile string + +const ( + // AuditProfileNone disables audit logging + AuditProfileNone AuditProfile = "None" + // AuditProfileMetadata logs request metadata (requesting user, timestamp, resource, verb, etc.) but not request or response body + AuditProfileMetadata AuditProfile = "Metadata" + // AuditProfileRequest logs event metadata and request body but not response body + AuditProfileRequest AuditProfile = "Request" + // AuditProfileRequestResponse logs event metadata, request and response bodies + AuditProfileRequestResponse AuditProfile = "RequestResponse" +) + +// VerbosityLevel defines the verbosity of log messages for Metrics Server. +// +kubebuilder:validation:Enum=Errors;Info;Trace;TraceAll +type VerbosityLevel string + +const ( + // VerbosityLevelErrors means only critical messages and errors are logged. + VerbosityLevelErrors VerbosityLevel = "Errors" + // VerbosityLevelInfo means basic informational messages are logged. + VerbosityLevelInfo VerbosityLevel = "Info" + // VerbosityLevelTrace means extended information useful for general debugging is logged. + VerbosityLevelTrace VerbosityLevel = "Trace" + // VerbosityLevelTraceAll means detailed information about metric scraping operations is logged. + VerbosityLevelTraceAll VerbosityLevel = "TraceAll" +) + +// ExemplarsMode defines whether exemplars are sent via remote write. +// +kubebuilder:validation:Enum=Send;DoNotSend +type ExemplarsMode string + +const ( + // ExemplarsModeSend means exemplars are sent via remote write. + ExemplarsModeSend ExemplarsMode = "Send" + // ExemplarsModeDoNotSend means exemplars are not sent via remote write. + ExemplarsModeDoNotSend ExemplarsMode = "DoNotSend" +) + +// RateLimitedAction defines what to do when the remote write endpoint returns HTTP 429 (Too Many Requests). +// Omission of this field means do not retry. When set, the only valid value is Retry. +// +kubebuilder:validation:Enum=Retry +type RateLimitedAction string + +const ( + // RateLimitedActionRetry means requests will be retried on HTTP 429 responses. + RateLimitedActionRetry RateLimitedAction = "Retry" ) // Audit profile configurations diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_image_policy.go b/vendor/github.com/openshift/api/config/v1alpha1/types_image_policy.go deleted file mode 100644 index 977ca3dde3..0000000000 --- a/vendor/github.com/openshift/api/config/v1alpha1/types_image_policy.go +++ /dev/null @@ -1,289 +0,0 @@ -package v1alpha1 - -import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - -// +genclient -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// ImagePolicy holds namespace-wide configuration for image signature verification -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -// +kubebuilder:object:root=true -// +kubebuilder:resource:path=imagepolicies,scope=Namespaced -// +kubebuilder:subresource:status -// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/1457 -// +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01 -// +openshift:enable:FeatureGate=SigstoreImageVerification -// +openshift:compatibility-gen:level=4 -type ImagePolicy struct { - metav1.TypeMeta `json:",inline"` - - // metadata is the standard object's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - metav1.ObjectMeta `json:"metadata,omitempty"` - - // spec holds user settable values for configuration - // +required - Spec ImagePolicySpec `json:"spec"` - // status contains the observed state of the resource. - // +optional - Status ImagePolicyStatus `json:"status,omitempty"` -} - -// ImagePolicySpec is the specification of the ImagePolicy CRD. -type ImagePolicySpec struct { - // scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the "Docker Registry HTTP API V2". - // Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). - // More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository - // namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). - // Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. - // If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. - // In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories - // quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. - // If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. - // For additional details about the format, please refer to the document explaining the docker transport field, - // which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker - // +required - // +kubebuilder:validation:MaxItems=256 - // +listType=set - Scopes []ImageScope `json:"scopes"` - // policy contains configuration to allow scopes to be verified, and defines how - // images not matching the verification policy will be treated. - // +required - Policy ImageSigstoreVerificationPolicy `json:"policy"` -} - -// +kubebuilder:validation:XValidation:rule="size(self.split('/')[0].split('.')) == 1 ? self.split('/')[0].split('.')[0].split(':')[0] == 'localhost' : true",message="invalid image scope format, scope must contain a fully qualified domain name or 'localhost'" -// +kubebuilder:validation:XValidation:rule=`self.contains('*') ? self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$') : true`,message="invalid image scope with wildcard, a wildcard can only be at the start of the domain and is only supported for subdomain matching, not path matching" -// +kubebuilder:validation:XValidation:rule=`!self.contains('*') ? self.matches('^((((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+(?::[0-9]+)?)|(localhost(?::[0-9]+)?))(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?)(?::([\\w][\\w.-]{0,127}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}))?$') : true`,message="invalid repository namespace or image specification in the image scope" -// +kubebuilder:validation:MaxLength=512 -type ImageScope string - -// ImageSigstoreVerificationPolicy defines the verification policy for the items in the scopes list. -type ImageSigstoreVerificationPolicy struct { - // rootOfTrust specifies the root of trust for the policy. - // +required - RootOfTrust PolicyRootOfTrust `json:"rootOfTrust"` - // signedIdentity specifies what image identity the signature claims about the image. The required matchPolicy field specifies the approach used in the verification process to verify the identity in the signature and the actual image identity, the default matchPolicy is "MatchRepoDigestOrExact". - // +optional - SignedIdentity PolicyIdentity `json:"signedIdentity,omitempty"` -} - -// PolicyRootOfTrust defines the root of trust based on the selected policyType. -// +union -// +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'PublicKey' ? has(self.publicKey) : !has(self.publicKey)",message="publicKey is required when policyType is PublicKey, and forbidden otherwise" -// +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'FulcioCAWithRekor' ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)",message="fulcioCAWithRekor is required when policyType is FulcioCAWithRekor, and forbidden otherwise" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=SigstoreImageVerificationPKI,rule="has(self.policyType) && self.policyType == 'PKI' ? has(self.pki) : !has(self.pki)",message="pki is required when policyType is PKI, and forbidden otherwise" -type PolicyRootOfTrust struct { - // policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust. - // "PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification. - // "FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification. - // "PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate. - // +unionDiscriminator - // +required - PolicyType PolicyType `json:"policyType"` - // publicKey defines the root of trust based on a sigstore public key. - // +optional - PublicKey *ImagePolicyPublicKeyRootOfTrust `json:"publicKey,omitempty"` - // fulcioCAWithRekor defines the root of trust based on the Fulcio certificate and the Rekor public key. - // For more information about Fulcio and Rekor, please refer to the document at: - // https://github.com/sigstore/fulcio and https://github.com/sigstore/rekor - // +optional - FulcioCAWithRekor *ImagePolicyFulcioCAWithRekorRootOfTrust `json:"fulcioCAWithRekor,omitempty"` - // pki defines the root of trust based on Bring Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and corresponding intermediate certificates. - // +optional - // +openshift:enable:FeatureGate=SigstoreImageVerificationPKI - PKI *ImagePolicyPKIRootOfTrust `json:"pki,omitempty"` -} - -// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=PublicKey;FulcioCAWithRekor -// +openshift:validation:FeatureGateAwareEnum:featureGate=SigstoreImageVerificationPKI,enum=PublicKey;FulcioCAWithRekor;PKI -type PolicyType string - -const ( - PublicKeyRootOfTrust PolicyType = "PublicKey" - FulcioCAWithRekorRootOfTrust PolicyType = "FulcioCAWithRekor" - PKIRootOfTrust PolicyType = "PKI" -) - -// ImagePolicyPublicKeyRootOfTrust defines the root of trust based on a sigstore public key. -type ImagePolicyPublicKeyRootOfTrust struct { - // keyData contains inline base64-encoded data for the PEM format public key. - // KeyData must be at most 8192 characters. - // +required - // +kubebuilder:validation:MaxLength=8192 - KeyData []byte `json:"keyData"` - // rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. - // rekorKeyData must be at most 8192 characters. - // +optional - // +kubebuilder:validation:MaxLength=8192 - RekorKeyData []byte `json:"rekorKeyData,omitempty"` -} - -// ImagePolicyFulcioCAWithRekorRootOfTrust defines the root of trust based on the Fulcio certificate and the Rekor public key. -type ImagePolicyFulcioCAWithRekorRootOfTrust struct { - // fulcioCAData contains inline base64-encoded data for the PEM format fulcio CA. - // fulcioCAData must be at most 8192 characters. - // +required - // +kubebuilder:validation:MaxLength=8192 - FulcioCAData []byte `json:"fulcioCAData"` - // rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. - // rekorKeyData must be at most 8192 characters. - // +required - // +kubebuilder:validation:MaxLength=8192 - RekorKeyData []byte `json:"rekorKeyData"` - // fulcioSubject specifies OIDC issuer and the email of the Fulcio authentication configuration. - // +required - FulcioSubject PolicyFulcioSubject `json:"fulcioSubject"` -} - -// PolicyFulcioSubject defines the OIDC issuer and the email of the Fulcio authentication configuration. -type PolicyFulcioSubject struct { - // oidcIssuer contains the expected OIDC issuer. It will be verified that the Fulcio-issued certificate contains a (Fulcio-defined) certificate extension pointing at this OIDC issuer URL. When Fulcio issues certificates, it includes a value based on an URL inside the client-provided ID token. - // Example: "https://expected.OIDC.issuer/" - // +required - // +kubebuilder:validation:XValidation:rule="isURL(self)",message="oidcIssuer must be a valid URL" - OIDCIssuer string `json:"oidcIssuer"` - // signedEmail holds the email address the the Fulcio certificate is issued for. - // Example: "expected-signing-user@example.com" - // +required - // +kubebuilder:validation:XValidation:rule=`self.matches('^\\S+@\\S+$')`,message="invalid email address" - SignedEmail string `json:"signedEmail"` -} - -// ImagePolicyPKIRootOfTrust defines the root of trust based on Root CA(s) and corresponding intermediate certificates. -type ImagePolicyPKIRootOfTrust struct { - // caRootsData contains base64-encoded data of a certificate bundle PEM file, which contains one or more CA roots in the PEM format. The total length of the data must not exceed 8192 characters. - // +required - // +kubebuilder:validation:MaxLength=8192 - // +kubebuilder:validation:XValidation:rule="string(self).startsWith('-----BEGIN CERTIFICATE-----')",message="the caRootsData must start with base64 encoding of '-----BEGIN CERTIFICATE-----'." - // +kubebuilder:validation:XValidation:rule="string(self).endsWith('-----END CERTIFICATE-----\\n') || string(self).endsWith('-----END CERTIFICATE-----')",message="the caRootsData must end with base64 encoding of '-----END CERTIFICATE-----'." - // +kubebuilder:validation:XValidation:rule="string(self).findAll('-----BEGIN CERTIFICATE-----').size() == string(self).findAll('-----END CERTIFICATE-----').size()",message="caRootsData must be base64 encoding of valid PEM format data contain the same number of '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' markers." - CertificateAuthorityRootsData []byte `json:"caRootsData"` - // caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters. - // caIntermediatesData requires caRootsData to be set. - // +optional - // +kubebuilder:validation:XValidation:rule="string(self).startsWith('-----BEGIN CERTIFICATE-----')",message="the caIntermediatesData must start with base64 encoding of '-----BEGIN CERTIFICATE-----'." - // +kubebuilder:validation:XValidation:rule="string(self).endsWith('-----END CERTIFICATE-----\\n') || string(self).endsWith('-----END CERTIFICATE-----')",message="the caIntermediatesData must end with base64 encoding of '-----END CERTIFICATE-----'." - // +kubebuilder:validation:XValidation:rule="string(self).findAll('-----BEGIN CERTIFICATE-----').size() == string(self).findAll('-----END CERTIFICATE-----').size()",message="caIntermediatesData must be base64 encoding of valid PEM format data contain the same number of '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' markers." - // +kubebuilder:validation:MaxLength=8192 - CertificateAuthorityIntermediatesData []byte `json:"caIntermediatesData,omitempty"` - - // pkiCertificateSubject defines the requirements imposed on the subject to which the certificate was issued. - // +required - PKICertificateSubject PKICertificateSubject `json:"pkiCertificateSubject"` -} - -// PKICertificateSubject defines the requirements imposed on the subject to which the certificate was issued. -// +kubebuilder:validation:XValidation:rule="has(self.email) || has(self.hostname)", message="at least one of email or hostname must be set in pkiCertificateSubject" -// +openshift:enable:FeatureGate=SigstoreImageVerificationPKI -type PKICertificateSubject struct { - // email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate. - // The email should be a valid email address and at most 320 characters in length. - // +optional - // +kubebuilder:validation:MaxLength:=320 - // +kubebuilder:validation:XValidation:rule=`self.matches('^\\S+@\\S+$')`,message="invalid email address in pkiCertificateSubject" - Email string `json:"email,omitempty"` - // hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate. - // The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length. - // It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk. - // +optional - // +kubebuilder:validation:MaxLength:=253 - // +kubebuilder:validation:XValidation:rule="self.startsWith('*.') ? !format.dns1123Subdomain().validate(self.replace('*.', '', 1)).hasValue() : !format.dns1123Subdomain().validate(self).hasValue()",message="hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.'. It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk." - Hostname string `json:"hostname,omitempty"` -} - -// PolicyIdentity defines image identity the signature claims about the image. When omitted, the default matchPolicy is "MatchRepoDigestOrExact". -// +kubebuilder:validation:XValidation:rule="(has(self.matchPolicy) && self.matchPolicy == 'ExactRepository') ? has(self.exactRepository) : !has(self.exactRepository)",message="exactRepository is required when matchPolicy is ExactRepository, and forbidden otherwise" -// +kubebuilder:validation:XValidation:rule="(has(self.matchPolicy) && self.matchPolicy == 'RemapIdentity') ? has(self.remapIdentity) : !has(self.remapIdentity)",message="remapIdentity is required when matchPolicy is RemapIdentity, and forbidden otherwise" -// +union -type PolicyIdentity struct { - // matchPolicy sets the type of matching to be used. - // Valid values are "MatchRepoDigestOrExact", "MatchRepository", "ExactRepository", "RemapIdentity". When omitted, the default value is "MatchRepoDigestOrExact". - // If set matchPolicy to ExactRepository, then the exactRepository must be specified. - // If set matchPolicy to RemapIdentity, then the remapIdentity must be specified. - // "MatchRepoDigestOrExact" means that the identity in the signature must be in the same repository as the image identity if the image identity is referenced by a digest. Otherwise, the identity in the signature must be the same as the image identity. - // "MatchRepository" means that the identity in the signature must be in the same repository as the image identity. - // "ExactRepository" means that the identity in the signature must be in the same repository as a specific identity specified by "repository". - // "RemapIdentity" means that the signature must be in the same as the remapped image identity. Remapped image identity is obtained by replacing the "prefix" with the specified “signedPrefix” if the the image identity matches the specified remapPrefix. - // +unionDiscriminator - // +required - MatchPolicy IdentityMatchPolicy `json:"matchPolicy"` - // exactRepository is required if matchPolicy is set to "ExactRepository". - // +optional - PolicyMatchExactRepository *PolicyMatchExactRepository `json:"exactRepository,omitempty"` - // remapIdentity is required if matchPolicy is set to "RemapIdentity". - // +optional - PolicyMatchRemapIdentity *PolicyMatchRemapIdentity `json:"remapIdentity,omitempty"` -} - -// +kubebuilder:validation:MaxLength=512 -// +kubebuilder:validation:XValidation:rule=`self.matches('.*:([\\w][\\w.-]{0,127})$')? self.matches('^(localhost:[0-9]+)$'): true`,message="invalid repository or prefix in the signedIdentity, should not include the tag or digest" -// +kubebuilder:validation:XValidation:rule=`self.matches('^(((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+(?::[0-9]+)?)|(localhost(?::[0-9]+)?))(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')`,message="invalid repository or prefix in the signedIdentity" -type IdentityRepositoryPrefix string - -type PolicyMatchExactRepository struct { - // repository is the reference of the image identity to be matched. - // The value should be a repository name (by omitting the tag or digest) in a registry implementing the "Docker Registry HTTP API V2". For example, docker.io/library/busybox - // +required - Repository IdentityRepositoryPrefix `json:"repository"` -} - -type PolicyMatchRemapIdentity struct { - // prefix is the prefix of the image identity to be matched. - // If the image identity matches the specified prefix, that prefix is replaced by the specified “signedPrefix” (otherwise it is used as unchanged and no remapping takes place). - // This useful when verifying signatures for a mirror of some other repository namespace that preserves the vendor’s repository structure. - // The prefix and signedPrefix values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, - // or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. - // For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox. - // +required - Prefix IdentityRepositoryPrefix `json:"prefix"` - // signedPrefix is the prefix of the image identity to be matched in the signature. The format is the same as "prefix". The values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, - // or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. - // For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox. - // +required - SignedPrefix IdentityRepositoryPrefix `json:"signedPrefix"` -} - -// IdentityMatchPolicy defines the type of matching for "matchPolicy". -// +kubebuilder:validation:Enum=MatchRepoDigestOrExact;MatchRepository;ExactRepository;RemapIdentity -type IdentityMatchPolicy string - -const ( - IdentityMatchPolicyMatchRepoDigestOrExact IdentityMatchPolicy = "MatchRepoDigestOrExact" - IdentityMatchPolicyMatchRepository IdentityMatchPolicy = "MatchRepository" - IdentityMatchPolicyExactRepository IdentityMatchPolicy = "ExactRepository" - IdentityMatchPolicyRemapIdentity IdentityMatchPolicy = "RemapIdentity" -) - -// +k8s:deepcopy-gen=true -type ImagePolicyStatus struct { - // conditions provide details on the status of this API Resource. - // +listType=map - // +listMapKey=type - // +optional - Conditions []metav1.Condition `json:"conditions,omitempty"` -} - -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// ImagePolicyList is a list of ImagePolicy resources -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -// +openshift:compatibility-gen:level=4 -type ImagePolicyList struct { - metav1.TypeMeta `json:",inline"` - - // metadata is the standard list's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - metav1.ListMeta `json:"metadata"` - - Items []ImagePolicy `json:"items"` -} - -const ( - // ImagePolicyPending indicates that the customer resource contains a policy that cannot take effect. It is either overwritten by a global policy or the image scope is not valid. - ImagePolicyPending = "Pending" - // ImagePolicyApplied indicates that the policy has been applied - ImagePolicyApplied = "Applied" -) diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go index e28a94dbef..38694ad9eb 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go @@ -11,6 +11,29 @@ import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AdditionalAlertmanagerConfig) DeepCopyInto(out *AdditionalAlertmanagerConfig) { + *out = *in + out.Authorization = in.Authorization + if in.StaticConfigs != nil { + in, out := &in.StaticConfigs, &out.StaticConfigs + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.TLSConfig = in.TLSConfig + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalAlertmanagerConfig. +func (in *AdditionalAlertmanagerConfig) DeepCopy() *AdditionalAlertmanagerConfig { + if in == nil { + return nil + } + out := new(AdditionalAlertmanagerConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AlertmanagerConfig) DeepCopyInto(out *AlertmanagerConfig) { *out = *in @@ -98,6 +121,23 @@ func (in *Audit) DeepCopy() *Audit { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AuthorizationConfig) DeepCopyInto(out *AuthorizationConfig) { + *out = *in + out.BearerToken = in.BearerToken + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationConfig. +func (in *AuthorizationConfig) DeepCopy() *AuthorizationConfig { + if in == nil { + return nil + } + out := new(AuthorizationConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Backup) DeepCopyInto(out *Backup) { *out = *in @@ -192,6 +232,24 @@ func (in *BackupStatus) DeepCopy() *BackupStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BasicAuth) DeepCopyInto(out *BasicAuth) { + *out = *in + out.Username = in.Username + out.Password = in.Password + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicAuth. +func (in *BasicAuth) DeepCopy() *BasicAuth { + if in == nil { + return nil + } + out := new(BasicAuth) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *CRIOCredentialProviderConfig) DeepCopyInto(out *CRIOCredentialProviderConfig) { *out = *in @@ -318,112 +376,6 @@ func (in *CertificateConfig) DeepCopy() *CertificateConfig { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterImagePolicy) DeepCopyInto(out *ClusterImagePolicy) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - in.Status.DeepCopyInto(&out.Status) - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterImagePolicy. -func (in *ClusterImagePolicy) DeepCopy() *ClusterImagePolicy { - if in == nil { - return nil - } - out := new(ClusterImagePolicy) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ClusterImagePolicy) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterImagePolicyList) DeepCopyInto(out *ClusterImagePolicyList) { - *out = *in - out.TypeMeta = in.TypeMeta - in.ListMeta.DeepCopyInto(&out.ListMeta) - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]ClusterImagePolicy, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterImagePolicyList. -func (in *ClusterImagePolicyList) DeepCopy() *ClusterImagePolicyList { - if in == nil { - return nil - } - out := new(ClusterImagePolicyList) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ClusterImagePolicyList) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterImagePolicySpec) DeepCopyInto(out *ClusterImagePolicySpec) { - *out = *in - if in.Scopes != nil { - in, out := &in.Scopes, &out.Scopes - *out = make([]ImageScope, len(*in)) - copy(*out, *in) - } - in.Policy.DeepCopyInto(&out.Policy) - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterImagePolicySpec. -func (in *ClusterImagePolicySpec) DeepCopy() *ClusterImagePolicySpec { - if in == nil { - return nil - } - out := new(ClusterImagePolicySpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterImagePolicyStatus) DeepCopyInto(out *ClusterImagePolicyStatus) { - *out = *in - if in.Conditions != nil { - in, out := &in.Conditions, &out.Conditions - *out = make([]metav1.Condition, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterImagePolicyStatus. -func (in *ClusterImagePolicyStatus) DeepCopy() *ClusterImagePolicyStatus { - if in == nil { - return nil - } - out := new(ClusterImagePolicyStatus) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterMonitoring) DeepCopyInto(out *ClusterMonitoring) { *out = *in @@ -490,9 +442,13 @@ func (in *ClusterMonitoringSpec) DeepCopyInto(out *ClusterMonitoringSpec) { *out = *in out.UserDefined = in.UserDefined in.AlertmanagerConfig.DeepCopyInto(&out.AlertmanagerConfig) + in.PrometheusConfig.DeepCopyInto(&out.PrometheusConfig) in.MetricsServerConfig.DeepCopyInto(&out.MetricsServerConfig) in.PrometheusOperatorConfig.DeepCopyInto(&out.PrometheusOperatorConfig) in.PrometheusOperatorAdmissionWebhookConfig.DeepCopyInto(&out.PrometheusOperatorAdmissionWebhookConfig) + in.OpenShiftStateMetricsConfig.DeepCopyInto(&out.OpenShiftStateMetricsConfig) + in.TelemeterClientConfig.DeepCopyInto(&out.TelemeterClientConfig) + in.ThanosQuerierConfig.DeepCopyInto(&out.ThanosQuerierConfig) return } @@ -574,6 +530,22 @@ func (in *DefaultCertificateConfig) DeepCopy() *DefaultCertificateConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *DropEqualActionConfig) DeepCopyInto(out *DropEqualActionConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DropEqualActionConfig. +func (in *DropEqualActionConfig) DeepCopy() *DropEqualActionConfig { + if in == nil { + return nil + } + out := new(DropEqualActionConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ECDSAKeyConfig) DeepCopyInto(out *ECDSAKeyConfig) { *out = *in @@ -634,68 +606,57 @@ func (in *GatherConfig) DeepCopy() *GatherConfig { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicy) DeepCopyInto(out *ImagePolicy) { +func (in *HashModActionConfig) DeepCopyInto(out *HashModActionConfig) { *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - in.Status.DeepCopyInto(&out.Status) return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicy. -func (in *ImagePolicy) DeepCopy() *ImagePolicy { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HashModActionConfig. +func (in *HashModActionConfig) DeepCopy() *HashModActionConfig { if in == nil { return nil } - out := new(ImagePolicy) + out := new(HashModActionConfig) in.DeepCopyInto(out) return out } -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ImagePolicy) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicyFulcioCAWithRekorRootOfTrust) DeepCopyInto(out *ImagePolicyFulcioCAWithRekorRootOfTrust) { +func (in *InsightsDataGather) DeepCopyInto(out *InsightsDataGather) { *out = *in - if in.FulcioCAData != nil { - in, out := &in.FulcioCAData, &out.FulcioCAData - *out = make([]byte, len(*in)) - copy(*out, *in) - } - if in.RekorKeyData != nil { - in, out := &in.RekorKeyData, &out.RekorKeyData - *out = make([]byte, len(*in)) - copy(*out, *in) - } - out.FulcioSubject = in.FulcioSubject + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicyFulcioCAWithRekorRootOfTrust. -func (in *ImagePolicyFulcioCAWithRekorRootOfTrust) DeepCopy() *ImagePolicyFulcioCAWithRekorRootOfTrust { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGather. +func (in *InsightsDataGather) DeepCopy() *InsightsDataGather { if in == nil { return nil } - out := new(ImagePolicyFulcioCAWithRekorRootOfTrust) + out := new(InsightsDataGather) in.DeepCopyInto(out) return out } +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *InsightsDataGather) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicyList) DeepCopyInto(out *ImagePolicyList) { +func (in *InsightsDataGatherList) DeepCopyInto(out *InsightsDataGatherList) { *out = *in out.TypeMeta = in.TypeMeta in.ListMeta.DeepCopyInto(&out.ListMeta) if in.Items != nil { in, out := &in.Items, &out.Items - *out = make([]ImagePolicy, len(*in)) + *out = make([]InsightsDataGather, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } @@ -703,18 +664,18 @@ func (in *ImagePolicyList) DeepCopyInto(out *ImagePolicyList) { return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicyList. -func (in *ImagePolicyList) DeepCopy() *ImagePolicyList { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGatherList. +func (in *InsightsDataGatherList) DeepCopy() *InsightsDataGatherList { if in == nil { return nil } - out := new(ImagePolicyList) + out := new(InsightsDataGatherList) in.DeepCopyInto(out) return out } // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ImagePolicyList) DeepCopyObject() runtime.Object { +func (in *InsightsDataGatherList) DeepCopyObject() runtime.Object { if c := in.DeepCopy(); c != nil { return c } @@ -722,237 +683,252 @@ func (in *ImagePolicyList) DeepCopyObject() runtime.Object { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicyPKIRootOfTrust) DeepCopyInto(out *ImagePolicyPKIRootOfTrust) { +func (in *InsightsDataGatherSpec) DeepCopyInto(out *InsightsDataGatherSpec) { *out = *in - if in.CertificateAuthorityRootsData != nil { - in, out := &in.CertificateAuthorityRootsData, &out.CertificateAuthorityRootsData - *out = make([]byte, len(*in)) - copy(*out, *in) - } - if in.CertificateAuthorityIntermediatesData != nil { - in, out := &in.CertificateAuthorityIntermediatesData, &out.CertificateAuthorityIntermediatesData - *out = make([]byte, len(*in)) - copy(*out, *in) - } - out.PKICertificateSubject = in.PKICertificateSubject + in.GatherConfig.DeepCopyInto(&out.GatherConfig) return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicyPKIRootOfTrust. -func (in *ImagePolicyPKIRootOfTrust) DeepCopy() *ImagePolicyPKIRootOfTrust { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGatherSpec. +func (in *InsightsDataGatherSpec) DeepCopy() *InsightsDataGatherSpec { if in == nil { return nil } - out := new(ImagePolicyPKIRootOfTrust) + out := new(InsightsDataGatherSpec) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicyPublicKeyRootOfTrust) DeepCopyInto(out *ImagePolicyPublicKeyRootOfTrust) { +func (in *InsightsDataGatherStatus) DeepCopyInto(out *InsightsDataGatherStatus) { *out = *in - if in.KeyData != nil { - in, out := &in.KeyData, &out.KeyData - *out = make([]byte, len(*in)) - copy(*out, *in) - } - if in.RekorKeyData != nil { - in, out := &in.RekorKeyData, &out.RekorKeyData - *out = make([]byte, len(*in)) - copy(*out, *in) - } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicyPublicKeyRootOfTrust. -func (in *ImagePolicyPublicKeyRootOfTrust) DeepCopy() *ImagePolicyPublicKeyRootOfTrust { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGatherStatus. +func (in *InsightsDataGatherStatus) DeepCopy() *InsightsDataGatherStatus { if in == nil { return nil } - out := new(ImagePolicyPublicKeyRootOfTrust) + out := new(InsightsDataGatherStatus) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicySpec) DeepCopyInto(out *ImagePolicySpec) { +func (in *KeepEqualActionConfig) DeepCopyInto(out *KeepEqualActionConfig) { *out = *in - if in.Scopes != nil { - in, out := &in.Scopes, &out.Scopes - *out = make([]ImageScope, len(*in)) - copy(*out, *in) - } - in.Policy.DeepCopyInto(&out.Policy) return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicySpec. -func (in *ImagePolicySpec) DeepCopy() *ImagePolicySpec { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KeepEqualActionConfig. +func (in *KeepEqualActionConfig) DeepCopy() *KeepEqualActionConfig { if in == nil { return nil } - out := new(ImagePolicySpec) + out := new(KeepEqualActionConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImagePolicyStatus) DeepCopyInto(out *ImagePolicyStatus) { +func (in *KeyConfig) DeepCopyInto(out *KeyConfig) { *out = *in - if in.Conditions != nil { - in, out := &in.Conditions, &out.Conditions - *out = make([]metav1.Condition, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } + out.RSA = in.RSA + out.ECDSA = in.ECDSA return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImagePolicyStatus. -func (in *ImagePolicyStatus) DeepCopy() *ImagePolicyStatus { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KeyConfig. +func (in *KeyConfig) DeepCopy() *KeyConfig { if in == nil { return nil } - out := new(ImagePolicyStatus) + out := new(KeyConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ImageSigstoreVerificationPolicy) DeepCopyInto(out *ImageSigstoreVerificationPolicy) { +func (in *Label) DeepCopyInto(out *Label) { *out = *in - in.RootOfTrust.DeepCopyInto(&out.RootOfTrust) - in.SignedIdentity.DeepCopyInto(&out.SignedIdentity) return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageSigstoreVerificationPolicy. -func (in *ImageSigstoreVerificationPolicy) DeepCopy() *ImageSigstoreVerificationPolicy { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Label. +func (in *Label) DeepCopy() *Label { if in == nil { return nil } - out := new(ImageSigstoreVerificationPolicy) + out := new(Label) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *InsightsDataGather) DeepCopyInto(out *InsightsDataGather) { +func (in *LabelMapActionConfig) DeepCopyInto(out *LabelMapActionConfig) { *out = *in - out.TypeMeta = in.TypeMeta - in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - out.Status = in.Status return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGather. -func (in *InsightsDataGather) DeepCopy() *InsightsDataGather { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LabelMapActionConfig. +func (in *LabelMapActionConfig) DeepCopy() *LabelMapActionConfig { if in == nil { return nil } - out := new(InsightsDataGather) + out := new(LabelMapActionConfig) in.DeepCopyInto(out) return out } -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *InsightsDataGather) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *InsightsDataGatherList) DeepCopyInto(out *InsightsDataGatherList) { +func (in *LowercaseActionConfig) DeepCopyInto(out *LowercaseActionConfig) { *out = *in - out.TypeMeta = in.TypeMeta - in.ListMeta.DeepCopyInto(&out.ListMeta) - if in.Items != nil { - in, out := &in.Items, &out.Items - *out = make([]InsightsDataGather, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGatherList. -func (in *InsightsDataGatherList) DeepCopy() *InsightsDataGatherList { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LowercaseActionConfig. +func (in *LowercaseActionConfig) DeepCopy() *LowercaseActionConfig { if in == nil { return nil } - out := new(InsightsDataGatherList) + out := new(LowercaseActionConfig) in.DeepCopyInto(out) return out } -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *InsightsDataGatherList) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *InsightsDataGatherSpec) DeepCopyInto(out *InsightsDataGatherSpec) { +func (in *MetadataConfig) DeepCopyInto(out *MetadataConfig) { *out = *in - in.GatherConfig.DeepCopyInto(&out.GatherConfig) + out.Custom = in.Custom return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGatherSpec. -func (in *InsightsDataGatherSpec) DeepCopy() *InsightsDataGatherSpec { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetadataConfig. +func (in *MetadataConfig) DeepCopy() *MetadataConfig { if in == nil { return nil } - out := new(InsightsDataGatherSpec) + out := new(MetadataConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *InsightsDataGatherStatus) DeepCopyInto(out *InsightsDataGatherStatus) { +func (in *MetadataConfigCustom) DeepCopyInto(out *MetadataConfigCustom) { *out = *in return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InsightsDataGatherStatus. -func (in *InsightsDataGatherStatus) DeepCopy() *InsightsDataGatherStatus { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetadataConfigCustom. +func (in *MetadataConfigCustom) DeepCopy() *MetadataConfigCustom { if in == nil { return nil } - out := new(InsightsDataGatherStatus) + out := new(MetadataConfigCustom) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *KeyConfig) DeepCopyInto(out *KeyConfig) { +func (in *MetricsServerConfig) DeepCopyInto(out *MetricsServerConfig) { *out = *in - out.RSA = in.RSA - out.ECDSA = in.ECDSA + out.Audit = in.Audit + if in.NodeSelector != nil { + in, out := &in.NodeSelector, &out.NodeSelector + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.Tolerations != nil { + in, out := &in.Tolerations, &out.Tolerations + *out = make([]v1.Toleration, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.TopologySpreadConstraints != nil { + in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints + *out = make([]v1.TopologySpreadConstraint, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KeyConfig. -func (in *KeyConfig) DeepCopy() *KeyConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricsServerConfig. +func (in *MetricsServerConfig) DeepCopy() *MetricsServerConfig { if in == nil { return nil } - out := new(KeyConfig) + out := new(MetricsServerConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *MetricsServerConfig) DeepCopyInto(out *MetricsServerConfig) { +func (in *OAuth2) DeepCopyInto(out *OAuth2) { + *out = *in + out.ClientID = in.ClientID + out.ClientSecret = in.ClientSecret + if in.Scopes != nil { + in, out := &in.Scopes, &out.Scopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.EndpointParams != nil { + in, out := &in.EndpointParams, &out.EndpointParams + *out = make([]OAuth2EndpointParam, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OAuth2. +func (in *OAuth2) DeepCopy() *OAuth2 { + if in == nil { + return nil + } + out := new(OAuth2) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OAuth2EndpointParam) DeepCopyInto(out *OAuth2EndpointParam) { + *out = *in + if in.Value != nil { + in, out := &in.Value, &out.Value + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OAuth2EndpointParam. +func (in *OAuth2EndpointParam) DeepCopy() *OAuth2EndpointParam { + if in == nil { + return nil + } + out := new(OAuth2EndpointParam) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OpenShiftStateMetricsConfig) DeepCopyInto(out *OpenShiftStateMetricsConfig) { *out = *in - out.Audit = in.Audit if in.NodeSelector != nil { in, out := &in.NodeSelector, &out.NodeSelector *out = make(map[string]string, len(*in)) @@ -960,16 +936,16 @@ func (in *MetricsServerConfig) DeepCopyInto(out *MetricsServerConfig) { (*out)[key] = val } } - if in.Tolerations != nil { - in, out := &in.Tolerations, &out.Tolerations - *out = make([]v1.Toleration, len(*in)) + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } } - if in.Resources != nil { - in, out := &in.Resources, &out.Resources - *out = make([]ContainerResource, len(*in)) + if in.Tolerations != nil { + in, out := &in.Tolerations, &out.Tolerations + *out = make([]v1.Toleration, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } @@ -984,12 +960,12 @@ func (in *MetricsServerConfig) DeepCopyInto(out *MetricsServerConfig) { return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricsServerConfig. -func (in *MetricsServerConfig) DeepCopy() *MetricsServerConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenShiftStateMetricsConfig. +func (in *OpenShiftStateMetricsConfig) DeepCopy() *OpenShiftStateMetricsConfig { if in == nil { return nil } - out := new(MetricsServerConfig) + out := new(OpenShiftStateMetricsConfig) in.DeepCopyInto(out) return out } @@ -1038,22 +1014,6 @@ func (in *PKICertificateManagement) DeepCopy() *PKICertificateManagement { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PKICertificateSubject) DeepCopyInto(out *PKICertificateSubject) { - *out = *in - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PKICertificateSubject. -func (in *PKICertificateSubject) DeepCopy() *PKICertificateSubject { - if in == nil { - return nil - } - out := new(PKICertificateSubject) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *PKIList) DeepCopyInto(out *PKIList) { *out = *in @@ -1158,123 +1118,288 @@ func (in *PersistentVolumeConfig) DeepCopy() *PersistentVolumeConfig { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PolicyFulcioSubject) DeepCopyInto(out *PolicyFulcioSubject) { +func (in *PrometheusConfig) DeepCopyInto(out *PrometheusConfig) { *out = *in + if in.AdditionalAlertmanagerConfigs != nil { + in, out := &in.AdditionalAlertmanagerConfigs, &out.AdditionalAlertmanagerConfigs + *out = make([]AdditionalAlertmanagerConfig, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.ExternalLabels != nil { + in, out := &in.ExternalLabels, &out.ExternalLabels + *out = make([]Label, len(*in)) + copy(*out, *in) + } + if in.NodeSelector != nil { + in, out := &in.NodeSelector, &out.NodeSelector + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.RemoteWrite != nil { + in, out := &in.RemoteWrite, &out.RemoteWrite + *out = make([]RemoteWriteSpec, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + out.Retention = in.Retention + if in.Tolerations != nil { + in, out := &in.Tolerations, &out.Tolerations + *out = make([]v1.Toleration, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.TopologySpreadConstraints != nil { + in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints + *out = make([]v1.TopologySpreadConstraint, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.VolumeClaimTemplate != nil { + in, out := &in.VolumeClaimTemplate, &out.VolumeClaimTemplate + *out = new(v1.PersistentVolumeClaim) + (*in).DeepCopyInto(*out) + } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyFulcioSubject. -func (in *PolicyFulcioSubject) DeepCopy() *PolicyFulcioSubject { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusConfig. +func (in *PrometheusConfig) DeepCopy() *PrometheusConfig { if in == nil { return nil } - out := new(PolicyFulcioSubject) + out := new(PrometheusConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PolicyIdentity) DeepCopyInto(out *PolicyIdentity) { +func (in *PrometheusOperatorAdmissionWebhookConfig) DeepCopyInto(out *PrometheusOperatorAdmissionWebhookConfig) { *out = *in - if in.PolicyMatchExactRepository != nil { - in, out := &in.PolicyMatchExactRepository, &out.PolicyMatchExactRepository - *out = new(PolicyMatchExactRepository) - **out = **in + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } } - if in.PolicyMatchRemapIdentity != nil { - in, out := &in.PolicyMatchRemapIdentity, &out.PolicyMatchRemapIdentity - *out = new(PolicyMatchRemapIdentity) + if in.TopologySpreadConstraints != nil { + in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints + *out = make([]v1.TopologySpreadConstraint, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusOperatorAdmissionWebhookConfig. +func (in *PrometheusOperatorAdmissionWebhookConfig) DeepCopy() *PrometheusOperatorAdmissionWebhookConfig { + if in == nil { + return nil + } + out := new(PrometheusOperatorAdmissionWebhookConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PrometheusOperatorConfig) DeepCopyInto(out *PrometheusOperatorConfig) { + *out = *in + if in.NodeSelector != nil { + in, out := &in.NodeSelector, &out.NodeSelector + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Tolerations != nil { + in, out := &in.Tolerations, &out.Tolerations + *out = make([]v1.Toleration, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.TopologySpreadConstraints != nil { + in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints + *out = make([]v1.TopologySpreadConstraint, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusOperatorConfig. +func (in *PrometheusOperatorConfig) DeepCopy() *PrometheusOperatorConfig { + if in == nil { + return nil + } + out := new(PrometheusOperatorConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PrometheusRemoteWriteHeader) DeepCopyInto(out *PrometheusRemoteWriteHeader) { + *out = *in + if in.Value != nil { + in, out := &in.Value, &out.Value + *out = new(string) **out = **in } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyIdentity. -func (in *PolicyIdentity) DeepCopy() *PolicyIdentity { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusRemoteWriteHeader. +func (in *PrometheusRemoteWriteHeader) DeepCopy() *PrometheusRemoteWriteHeader { if in == nil { return nil } - out := new(PolicyIdentity) + out := new(PrometheusRemoteWriteHeader) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PolicyMatchExactRepository) DeepCopyInto(out *PolicyMatchExactRepository) { +func (in *QueueConfig) DeepCopyInto(out *QueueConfig) { *out = *in return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyMatchExactRepository. -func (in *PolicyMatchExactRepository) DeepCopy() *PolicyMatchExactRepository { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new QueueConfig. +func (in *QueueConfig) DeepCopy() *QueueConfig { if in == nil { return nil } - out := new(PolicyMatchExactRepository) + out := new(QueueConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PolicyMatchRemapIdentity) DeepCopyInto(out *PolicyMatchRemapIdentity) { +func (in *RSAKeyConfig) DeepCopyInto(out *RSAKeyConfig) { *out = *in return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyMatchRemapIdentity. -func (in *PolicyMatchRemapIdentity) DeepCopy() *PolicyMatchRemapIdentity { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RSAKeyConfig. +func (in *RSAKeyConfig) DeepCopy() *RSAKeyConfig { if in == nil { return nil } - out := new(PolicyMatchRemapIdentity) + out := new(RSAKeyConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PolicyRootOfTrust) DeepCopyInto(out *PolicyRootOfTrust) { +func (in *RelabelActionConfig) DeepCopyInto(out *RelabelActionConfig) { *out = *in - if in.PublicKey != nil { - in, out := &in.PublicKey, &out.PublicKey - *out = new(ImagePolicyPublicKeyRootOfTrust) - (*in).DeepCopyInto(*out) + in.Replace.DeepCopyInto(&out.Replace) + out.HashMod = in.HashMod + out.LabelMap = in.LabelMap + out.Lowercase = in.Lowercase + out.Uppercase = in.Uppercase + out.KeepEqual = in.KeepEqual + out.DropEqual = in.DropEqual + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RelabelActionConfig. +func (in *RelabelActionConfig) DeepCopy() *RelabelActionConfig { + if in == nil { + return nil } - if in.FulcioCAWithRekor != nil { - in, out := &in.FulcioCAWithRekor, &out.FulcioCAWithRekor - *out = new(ImagePolicyFulcioCAWithRekorRootOfTrust) - (*in).DeepCopyInto(*out) + out := new(RelabelActionConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *RelabelConfig) DeepCopyInto(out *RelabelConfig) { + *out = *in + if in.SourceLabels != nil { + in, out := &in.SourceLabels, &out.SourceLabels + *out = make([]string, len(*in)) + copy(*out, *in) } - if in.PKI != nil { - in, out := &in.PKI, &out.PKI - *out = new(ImagePolicyPKIRootOfTrust) + in.Action.DeepCopyInto(&out.Action) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RelabelConfig. +func (in *RelabelConfig) DeepCopy() *RelabelConfig { + if in == nil { + return nil + } + out := new(RelabelConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *RemoteWriteAuthorization) DeepCopyInto(out *RemoteWriteAuthorization) { + *out = *in + if in.SafeAuthorization != nil { + in, out := &in.SafeAuthorization, &out.SafeAuthorization + *out = new(v1.SecretKeySelector) (*in).DeepCopyInto(*out) } + out.BearerToken = in.BearerToken + out.BasicAuth = in.BasicAuth + in.OAuth2.DeepCopyInto(&out.OAuth2) + out.Sigv4 = in.Sigv4 return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRootOfTrust. -func (in *PolicyRootOfTrust) DeepCopy() *PolicyRootOfTrust { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteWriteAuthorization. +func (in *RemoteWriteAuthorization) DeepCopy() *RemoteWriteAuthorization { if in == nil { return nil } - out := new(PolicyRootOfTrust) + out := new(RemoteWriteAuthorization) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PrometheusOperatorAdmissionWebhookConfig) DeepCopyInto(out *PrometheusOperatorAdmissionWebhookConfig) { +func (in *RemoteWriteSpec) DeepCopyInto(out *RemoteWriteSpec) { *out = *in - if in.Resources != nil { - in, out := &in.Resources, &out.Resources - *out = make([]ContainerResource, len(*in)) + in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig) + if in.Headers != nil { + in, out := &in.Headers, &out.Headers + *out = make([]PrometheusRemoteWriteHeader, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } } - if in.TopologySpreadConstraints != nil { - in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints - *out = make([]v1.TopologySpreadConstraint, len(*in)) + out.MetadataConfig = in.MetadataConfig + out.QueueConfig = in.QueueConfig + out.TLSConfig = in.TLSConfig + if in.WriteRelabelConfigs != nil { + in, out := &in.WriteRelabelConfigs, &out.WriteRelabelConfigs + *out = make([]RelabelConfig, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } @@ -1282,72 +1407,49 @@ func (in *PrometheusOperatorAdmissionWebhookConfig) DeepCopyInto(out *Prometheus return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusOperatorAdmissionWebhookConfig. -func (in *PrometheusOperatorAdmissionWebhookConfig) DeepCopy() *PrometheusOperatorAdmissionWebhookConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteWriteSpec. +func (in *RemoteWriteSpec) DeepCopy() *RemoteWriteSpec { if in == nil { return nil } - out := new(PrometheusOperatorAdmissionWebhookConfig) + out := new(RemoteWriteSpec) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *PrometheusOperatorConfig) DeepCopyInto(out *PrometheusOperatorConfig) { +func (in *ReplaceActionConfig) DeepCopyInto(out *ReplaceActionConfig) { *out = *in - if in.NodeSelector != nil { - in, out := &in.NodeSelector, &out.NodeSelector - *out = make(map[string]string, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.Resources != nil { - in, out := &in.Resources, &out.Resources - *out = make([]ContainerResource, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.Tolerations != nil { - in, out := &in.Tolerations, &out.Tolerations - *out = make([]v1.Toleration, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } - if in.TopologySpreadConstraints != nil { - in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints - *out = make([]v1.TopologySpreadConstraint, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } + if in.Replacement != nil { + in, out := &in.Replacement, &out.Replacement + *out = new(string) + **out = **in } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusOperatorConfig. -func (in *PrometheusOperatorConfig) DeepCopy() *PrometheusOperatorConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReplaceActionConfig. +func (in *ReplaceActionConfig) DeepCopy() *ReplaceActionConfig { if in == nil { return nil } - out := new(PrometheusOperatorConfig) + out := new(ReplaceActionConfig) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *RSAKeyConfig) DeepCopyInto(out *RSAKeyConfig) { +func (in *Retention) DeepCopyInto(out *Retention) { *out = *in return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RSAKeyConfig. -func (in *RSAKeyConfig) DeepCopy() *RSAKeyConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Retention. +func (in *Retention) DeepCopy() *Retention { if in == nil { return nil } - out := new(RSAKeyConfig) + out := new(Retention) in.DeepCopyInto(out) return out } @@ -1410,6 +1512,40 @@ func (in *RetentionSizeConfig) DeepCopy() *RetentionSizeConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SecretKeySelector) DeepCopyInto(out *SecretKeySelector) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretKeySelector. +func (in *SecretKeySelector) DeepCopy() *SecretKeySelector { + if in == nil { + return nil + } + out := new(SecretKeySelector) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Sigv4) DeepCopyInto(out *Sigv4) { + *out = *in + out.AccessKey = in.AccessKey + out.SecretKey = in.SecretKey + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Sigv4. +func (in *Sigv4) DeepCopy() *Sigv4 { + if in == nil { + return nil + } + out := new(Sigv4) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Storage) DeepCopyInto(out *Storage) { *out = *in @@ -1431,6 +1567,129 @@ func (in *Storage) DeepCopy() *Storage { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TLSConfig) DeepCopyInto(out *TLSConfig) { + *out = *in + out.CA = in.CA + out.Cert = in.Cert + out.Key = in.Key + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig. +func (in *TLSConfig) DeepCopy() *TLSConfig { + if in == nil { + return nil + } + out := new(TLSConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TelemeterClientConfig) DeepCopyInto(out *TelemeterClientConfig) { + *out = *in + if in.NodeSelector != nil { + in, out := &in.NodeSelector, &out.NodeSelector + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Tolerations != nil { + in, out := &in.Tolerations, &out.Tolerations + *out = make([]v1.Toleration, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.TopologySpreadConstraints != nil { + in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints + *out = make([]v1.TopologySpreadConstraint, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TelemeterClientConfig. +func (in *TelemeterClientConfig) DeepCopy() *TelemeterClientConfig { + if in == nil { + return nil + } + out := new(TelemeterClientConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ThanosQuerierConfig) DeepCopyInto(out *ThanosQuerierConfig) { + *out = *in + if in.NodeSelector != nil { + in, out := &in.NodeSelector, &out.NodeSelector + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]ContainerResource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Tolerations != nil { + in, out := &in.Tolerations, &out.Tolerations + *out = make([]v1.Toleration, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.TopologySpreadConstraints != nil { + in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints + *out = make([]v1.TopologySpreadConstraint, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ThanosQuerierConfig. +func (in *ThanosQuerierConfig) DeepCopy() *ThanosQuerierConfig { + if in == nil { + return nil + } + out := new(ThanosQuerierConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *UppercaseActionConfig) DeepCopyInto(out *UppercaseActionConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UppercaseActionConfig. +func (in *UppercaseActionConfig) DeepCopy() *UppercaseActionConfig { + if in == nil { + return nil + } + out := new(UppercaseActionConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *UserDefinedMonitoring) DeepCopyInto(out *UserDefinedMonitoring) { *out = *in diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml index dc2d249a99..b2a1241937 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml @@ -44,30 +44,6 @@ criocredentialproviderconfigs.config.openshift.io: - CRIOCredentialProviderConfig Version: v1alpha1 -clusterimagepolicies.config.openshift.io: - Annotations: {} - ApprovedPRNumber: https://github.com/openshift/api/pull/1457 - CRDName: clusterimagepolicies.config.openshift.io - Capability: "" - Category: "" - FeatureGates: - - SigstoreImageVerification - - SigstoreImageVerificationPKI - FilenameOperatorName: config-operator - FilenameOperatorOrdering: "01" - FilenameRunLevel: "0000_10" - GroupName: config.openshift.io - HasStatus: true - KindName: ClusterImagePolicy - Labels: {} - PluralName: clusterimagepolicies - PrinterColumns: [] - Scope: Cluster - ShortNames: null - TopLevelFeatureGates: - - SigstoreImageVerification - Version: v1alpha1 - clustermonitorings.config.openshift.io: Annotations: description: Cluster Monitoring Operators configuration API @@ -92,30 +68,6 @@ clustermonitorings.config.openshift.io: - ClusterMonitoringConfig Version: v1alpha1 -imagepolicies.config.openshift.io: - Annotations: {} - ApprovedPRNumber: https://github.com/openshift/api/pull/1457 - CRDName: imagepolicies.config.openshift.io - Capability: "" - Category: "" - FeatureGates: - - SigstoreImageVerification - - SigstoreImageVerificationPKI - FilenameOperatorName: config-operator - FilenameOperatorOrdering: "01" - FilenameRunLevel: "0000_10" - GroupName: config.openshift.io - HasStatus: true - KindName: ImagePolicy - Labels: {} - PluralName: imagepolicies - PrinterColumns: [] - Scope: Namespaced - ShortNames: null - TopLevelFeatureGates: - - SigstoreImageVerification - Version: v1alpha1 - insightsdatagathers.config.openshift.io: Annotations: {} ApprovedPRNumber: https://github.com/openshift/api/pull/1245 diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go index e43dc7b236..a95db9b463 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go @@ -80,42 +80,19 @@ func (RetentionSizeConfig) SwaggerDoc() map[string]string { return map_RetentionSizeConfig } -var map_ClusterImagePolicy = map[string]string{ - "": "ClusterImagePolicy holds cluster-wide configuration for image signature verification\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "spec": "spec contains the configuration for the cluster image policy.", - "status": "status contains the observed state of the resource.", +var map_AdditionalAlertmanagerConfig = map[string]string{ + "": "AdditionalAlertmanagerConfig represents configuration for additional Alertmanager instances. The `AdditionalAlertmanagerConfig` resource defines settings for how a component communicates with additional Alertmanager instances.", + "name": "name is a unique identifier for this Alertmanager configuration entry. The name must be a valid DNS subdomain (RFC 1123): lowercase alphanumeric characters, hyphens, or periods, and must start and end with an alphanumeric character. Minimum length is 1 character (empty string is invalid). Maximum length is 253 characters.", + "authorization": "authorization configures the authentication method for Alertmanager connections. Supports bearer token authentication. When omitted, no authentication is used.", + "pathPrefix": "pathPrefix defines an optional URL path prefix to prepend to the Alertmanager API endpoints. For example, if your Alertmanager is behind a reverse proxy at \"/alertmanager/\", set this to \"/alertmanager\" so requests go to \"/alertmanager/api/v1/alerts\" instead of \"/api/v1/alerts\". This is commonly needed when Alertmanager is deployed behind ingress controllers or load balancers. When no prefix is needed, omit this field; do not set it to \"/\" as that would produce paths with double slashes (e.g. \"//api/v1/alerts\"). Must start with \"/\", must not end with \"/\", and must not be exactly \"/\". Must not contain query strings (\"?\") or fragments (\"#\").", + "scheme": "scheme defines the URL scheme to use when communicating with Alertmanager instances. Possible values are `HTTP` or `HTTPS`. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default value is `HTTP`.", + "staticConfigs": "staticConfigs is a list of statically configured Alertmanager endpoints in the form of `:`. Each entry must be a valid hostname, IPv4 address, or IPv6 address (in brackets) followed by a colon and a valid port number (1-65535). Examples: \"alertmanager.example.com:9093\", \"192.168.1.100:9093\", \"[::1]:9093\" At least one endpoint must be specified (minimum 1, maximum 10 endpoints). Each entry must be unique and non-empty (empty string is invalid).", + "timeoutSeconds": "timeoutSeconds defines the timeout in seconds for requests to Alertmanager. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Currently the default is 10 seconds. Minimum value is 1 second. Maximum value is 600 seconds (10 minutes).", + "tlsConfig": "tlsConfig defines the TLS settings to use for Alertmanager connections. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", } -func (ClusterImagePolicy) SwaggerDoc() map[string]string { - return map_ClusterImagePolicy -} - -var map_ClusterImagePolicyList = map[string]string{ - "": "ClusterImagePolicyList is a list of ClusterImagePolicy resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", -} - -func (ClusterImagePolicyList) SwaggerDoc() map[string]string { - return map_ClusterImagePolicyList -} - -var map_ClusterImagePolicySpec = map[string]string{ - "": "CLusterImagePolicySpec is the specification of the ClusterImagePolicy custom resource.", - "scopes": "scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the \"Docker Registry HTTP API V2\". Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. For additional details about the format, please refer to the document explaining the docker transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker", - "policy": "policy contains configuration to allow scopes to be verified, and defines how images not matching the verification policy will be treated.", -} - -func (ClusterImagePolicySpec) SwaggerDoc() map[string]string { - return map_ClusterImagePolicySpec -} - -var map_ClusterImagePolicyStatus = map[string]string{ - "conditions": "conditions provide details on the status of this API Resource.", -} - -func (ClusterImagePolicyStatus) SwaggerDoc() map[string]string { - return map_ClusterImagePolicyStatus +func (AdditionalAlertmanagerConfig) SwaggerDoc() map[string]string { + return map_AdditionalAlertmanagerConfig } var map_AlertmanagerConfig = map[string]string{ @@ -132,11 +109,11 @@ var map_AlertmanagerCustomConfig = map[string]string{ "": "AlertmanagerCustomConfig represents the configuration for a custom Alertmanager deployment. alertmanagerCustomConfig provides configuration options for the default Alertmanager instance that runs in the `openshift-monitoring` namespace. Use this configuration to control whether the default Alertmanager is deployed, how it logs, and how its pods are scheduled.", "logLevel": "logLevel defines the verbosity of logs emitted by Alertmanager. This field allows users to control the amount and severity of logs generated, which can be useful for debugging issues or reducing noise in production environments. Allowed values are Error, Warn, Info, and Debug. When set to Error, only errors will be logged. When set to Warn, both warnings and errors will be logged. When set to Info, general information, warnings, and errors will all be logged. When set to Debug, detailed debugging information will be logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Info`.", "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`.", - "resources": "resources defines the compute resource requests and limits for the Alertmanager container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + "resources": "resources defines the compute resource requests and limits for the Alertmanager container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", "secrets": "secrets defines a list of secrets that need to be mounted into the Alertmanager. The secrets must reside within the same namespace as the Alertmanager object. They will be added as volumes named secret- and mounted at /etc/alertmanager/secrets/ within the 'alertmanager' container of the Alertmanager Pods.\n\nThese secrets can be used to authenticate Alertmanager with endpoint receivers. For example, you can use secrets to: - Provide certificates for TLS authentication with receivers that require private CA certificates - Store credentials for Basic HTTP authentication with receivers that require password-based auth - Store any other authentication credentials needed by your alert receivers\n\nThis field is optional. Maximum length for this list is 10. Minimum length for this list is 1. Entries in this list must be unique.", "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", "topologySpreadConstraints": "topologySpreadConstraints defines rules for how Alertmanager Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", - "volumeClaimTemplate": "volumeClaimTemplate Defines persistent storage for Alertmanager. Use this setting to configure the persistent volume claim, including storage class, volume size, and name. If omitted, the Pod uses ephemeral storage and alert data will not persist across restarts. This field is optional.", + "volumeClaimTemplate": "volumeClaimTemplate defines persistent storage for Alertmanager. Use this setting to configure the persistent volume claim, including storage class and volume size. If omitted, the Pod uses ephemeral storage and alert data will not persist across restarts.", } func (AlertmanagerCustomConfig) SwaggerDoc() map[string]string { @@ -152,6 +129,26 @@ func (Audit) SwaggerDoc() map[string]string { return map_Audit } +var map_AuthorizationConfig = map[string]string{ + "": "AuthorizationConfig defines the authentication method for Alertmanager connections.", + "type": "type specifies the authentication type to use. Valid value is \"BearerToken\" (bearer token authentication). When set to BearerToken, the bearerToken field must be specified.", + "bearerToken": "bearerToken defines the secret reference containing the bearer token. Required when type is \"BearerToken\", and forbidden otherwise. The secret must exist in the openshift-monitoring namespace.", +} + +func (AuthorizationConfig) SwaggerDoc() map[string]string { + return map_AuthorizationConfig +} + +var map_BasicAuth = map[string]string{ + "": "BasicAuth defines basic authentication settings for the remote write endpoint URL.", + "username": "username defines the secret reference containing the username for basic authentication. The secret must exist in the openshift-monitoring namespace.", + "password": "password defines the secret reference containing the password for basic authentication. The secret must exist in the openshift-monitoring namespace.", +} + +func (BasicAuth) SwaggerDoc() map[string]string { + return map_BasicAuth +} + var map_ClusterMonitoring = map[string]string{ "": "ClusterMonitoring is the Custom Resource object which holds the current status of Cluster Monitoring Operator. CMO is a central component of the monitoring stack.\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. ClusterMonitoring is the Schema for the Cluster Monitoring Operators API", "metadata": "metadata is the standard object metadata.", @@ -177,9 +174,13 @@ var map_ClusterMonitoringSpec = map[string]string{ "": "ClusterMonitoringSpec defines the desired state of Cluster Monitoring Operator", "userDefined": "userDefined set the deployment mode for user-defined monitoring in addition to the default platform monitoring. userDefined is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default value is `Disabled`.", "alertmanagerConfig": "alertmanagerConfig allows users to configure how the default Alertmanager instance should be deployed in the `openshift-monitoring` namespace. alertmanagerConfig is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `DefaultConfig`.", + "prometheusConfig": "prometheusConfig provides configuration options for the default platform Prometheus instance that runs in the `openshift-monitoring` namespace. This configuration applies only to the platform Prometheus instance; user-workload Prometheus instances are configured separately.\n\nThis field allows you to customize how the platform Prometheus is deployed and operated, including:\n - Pod scheduling (node selectors, tolerations, topology spread constraints)\n - Resource allocation (CPU, memory requests/limits)\n - Retention policies (how long metrics are stored)\n - External integrations (remote write, additional alertmanagers)\n\nThis field is optional. When omitted, the platform chooses reasonable defaults, which may change over time.", "metricsServerConfig": "metricsServerConfig is an optional field that can be used to configure the Kubernetes Metrics Server that runs in the openshift-monitoring namespace. Specifically, it can configure how the Metrics Server instance is deployed, pod scheduling, its audit policy and log verbosity. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", "prometheusOperatorConfig": "prometheusOperatorConfig is an optional field that can be used to configure the Prometheus Operator component. Specifically, it can configure how the Prometheus Operator instance is deployed, pod scheduling, and resource allocation. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", "prometheusOperatorAdmissionWebhookConfig": "prometheusOperatorAdmissionWebhookConfig is an optional field that can be used to configure the admission webhook component of Prometheus Operator that runs in the openshift-monitoring namespace. The admission webhook validates PrometheusRule and AlertmanagerConfig objects to ensure they are semantically valid, mutates PrometheusRule annotations, and converts AlertmanagerConfig objects between API versions. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", + "openShiftStateMetricsConfig": "openShiftStateMetricsConfig is an optional field that can be used to configure the openshift-state-metrics agent that runs in the openshift-monitoring namespace. The openshift-state-metrics agent generates metrics about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", + "telemeterClientConfig": "telemeterClientConfig is an optional field that can be used to configure the Telemeter Client component that runs in the openshift-monitoring namespace. The Telemeter Client collects selected monitoring metrics and forwards them to Red Hat for telemetry purposes. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. When set, at least one field must be specified within telemeterClientConfig.", + "thanosQuerierConfig": "thanosQuerierConfig is an optional field that can be used to configure the Thanos Querier component that runs in the openshift-monitoring namespace. The Thanos Querier provides a global query view by aggregating and deduplicating metrics from multiple Prometheus instances. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default deploys the Thanos Querier on linux nodes with 5m CPU and 12Mi memory requests, and no custom tolerations or topology spread constraints. When set, at least one field must be specified within thanosQuerierConfig.", } func (ClusterMonitoringSpec) SwaggerDoc() map[string]string { @@ -197,7 +198,7 @@ func (ClusterMonitoringStatus) SwaggerDoc() map[string]string { var map_ContainerResource = map[string]string{ "": "ContainerResource defines a single resource requirement for a container.", "name": "name of the resource (e.g. \"cpu\", \"memory\", \"hugepages-2Mi\"). This field is required. name must consist only of alphanumeric characters, `-`, `_` and `.` and must start and end with an alphanumeric character.", - "request": "request is the minimum amount of the resource required (e.g. \"2Mi\", \"1Gi\"). This field is optional. When limit is specified, request cannot be greater than limit.", + "request": "request is the minimum amount of the resource required (e.g. \"2Mi\", \"1Gi\"). This field is optional. When limit is specified, request cannot be greater than limit. The value must be greater than 0 when specified.", "limit": "limit is the maximum amount of the resource allowed (e.g. \"2Mi\", \"1Gi\"). This field is optional. When request is specified, limit cannot be less than request. The value must be greater than 0 when specified.", } @@ -205,13 +206,88 @@ func (ContainerResource) SwaggerDoc() map[string]string { return map_ContainerResource } +var map_DropEqualActionConfig = map[string]string{ + "": "DropEqualActionConfig configures the DropEqual action. Drops targets for which the concatenated source_labels do match the value of target_label. Requires Prometheus >= v2.41.0.", + "targetLabel": "targetLabel is the label name whose value is compared to the concatenated source_labels; targets that match are dropped. Must be between 1 and 128 characters in length.", +} + +func (DropEqualActionConfig) SwaggerDoc() map[string]string { + return map_DropEqualActionConfig +} + +var map_HashModActionConfig = map[string]string{ + "": "HashModActionConfig configures the HashMod action. target_label is set to the modulus of a hash of the concatenated source_labels (target = hash % modulus).", + "targetLabel": "targetLabel is the label name where the hash modulus result is written. Must be between 1 and 128 characters in length.", + "modulus": "modulus is the divisor applied to the hash of the concatenated source label values (target = hash % modulus). Required when using the HashMod action so the intended behavior is explicit. Must be between 1 and 1000000.", +} + +func (HashModActionConfig) SwaggerDoc() map[string]string { + return map_HashModActionConfig +} + +var map_KeepEqualActionConfig = map[string]string{ + "": "KeepEqualActionConfig configures the KeepEqual action. Drops targets for which the concatenated source_labels do not match the value of target_label. Requires Prometheus >= v2.41.0.", + "targetLabel": "targetLabel is the label name whose value is compared to the concatenated source_labels; targets that do not match are dropped. Must be between 1 and 128 characters in length.", +} + +func (KeepEqualActionConfig) SwaggerDoc() map[string]string { + return map_KeepEqualActionConfig +} + +var map_Label = map[string]string{ + "": "Label represents a key/value pair for external labels.", + "key": "key is the name of the label. Prometheus supports UTF-8 label names, so any valid UTF-8 string is allowed. Must be between 1 and 128 characters in length.", + "value": "value is the value of the label. Must be between 1 and 128 characters in length.", +} + +func (Label) SwaggerDoc() map[string]string { + return map_Label +} + +var map_LabelMapActionConfig = map[string]string{ + "": "LabelMapActionConfig configures the LabelMap action. Regex is matched against all source label names (not just source_labels). Matching label values are copied to new label names given by replacement, with match group references (${1}, ${2}, ...) substituted.", + "replacement": "replacement is the template for new label names; match group references (${1}, ${2}, ...) are substituted from the matched label name. Required when using the LabelMap action so the intended behavior is explicit and the platform does not need to apply defaults. Use \"$1\" for the first capture group, \"$2\" for the second, etc. Must be between 1 and 255 characters in length. Empty string is invalid as it would produce invalid label names.", +} + +func (LabelMapActionConfig) SwaggerDoc() map[string]string { + return map_LabelMapActionConfig +} + +var map_LowercaseActionConfig = map[string]string{ + "": "LowercaseActionConfig configures the Lowercase action. Maps the concatenated source_labels to their lower case and writes to target_label. Requires Prometheus >= v2.36.0.", + "targetLabel": "targetLabel is the label name where the lower-cased value is written. Must be between 1 and 128 characters in length.", +} + +func (LowercaseActionConfig) SwaggerDoc() map[string]string { + return map_LowercaseActionConfig +} + +var map_MetadataConfig = map[string]string{ + "": "MetadataConfig defines whether and how to send series metadata to remote write storage.", + "sendPolicy": "sendPolicy specifies whether to send metadata and how it is configured. Default: send metadata using platform-chosen defaults (e.g. send interval 30 seconds). Custom: send metadata using the settings in the custom field.", + "custom": "custom defines custom metadata send settings. Required when sendPolicy is Custom (must have at least one property), and forbidden when sendPolicy is Default.", +} + +func (MetadataConfig) SwaggerDoc() map[string]string { + return map_MetadataConfig +} + +var map_MetadataConfigCustom = map[string]string{ + "": "MetadataConfigCustom defines custom settings for sending series metadata when sendPolicy is Custom. At least one property must be set when sendPolicy is Custom (e.g. sendIntervalSeconds).", + "sendIntervalSeconds": "sendIntervalSeconds is the interval in seconds at which metadata is sent. When omitted, the platform chooses a reasonable default (e.g. 30 seconds). Minimum value is 1 second. Maximum value is 86400 seconds (24 hours).", +} + +func (MetadataConfigCustom) SwaggerDoc() map[string]string { + return map_MetadataConfigCustom +} + var map_MetricsServerConfig = map[string]string{ "": "MetricsServerConfig provides configuration options for the Metrics Server instance that runs in the `openshift-monitoring` namespace. Use this configuration to control how the Metrics Server instance is deployed, how it logs, and how its pods are scheduled.", "audit": "audit defines the audit configuration used by the Metrics Server instance. audit is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default sets audit.profile to Metadata", "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`.", "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", "verbosity": "verbosity defines the verbosity of log messages for Metrics Server. Valid values are Errors, Info, Trace, TraceAll and omitted. When set to Errors, only critical messages and errors are logged. When set to Info, only basic information messages are logged. When set to Trace, information useful for general debugging is logged. When set to TraceAll, detailed information about metric scraping is logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Errors`", - "resources": "resources defines the compute resource requests and limits for the Metrics Server container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + "resources": "resources defines the compute resource requests and limits for the Metrics Server container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", "topologySpreadConstraints": "topologySpreadConstraints defines rules for how Metrics Server Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", } @@ -219,9 +295,65 @@ func (MetricsServerConfig) SwaggerDoc() map[string]string { return map_MetricsServerConfig } +var map_OAuth2 = map[string]string{ + "": "OAuth2 defines OAuth2 authentication settings for the remote write endpoint.", + "clientId": "clientId defines the secret reference containing the OAuth2 client ID. The secret must exist in the openshift-monitoring namespace.", + "clientSecret": "clientSecret defines the secret reference containing the OAuth2 client secret. The secret must exist in the openshift-monitoring namespace.", + "tokenUrl": "tokenUrl is the URL to fetch the token from. Must be a valid URL with http or https scheme. Must be between 1 and 2048 characters in length.", + "scopes": "scopes is a list of OAuth2 scopes to request. When omitted, no scopes are requested. Maximum of 20 scopes can be specified. Each scope must be between 1 and 256 characters.", + "endpointParams": "endpointParams defines additional parameters to append to the token URL. When omitted, no additional parameters are sent. Maximum of 20 parameters can be specified. Entries must have unique names (name is the list key).", +} + +func (OAuth2) SwaggerDoc() map[string]string { + return map_OAuth2 +} + +var map_OAuth2EndpointParam = map[string]string{ + "": "OAuth2EndpointParam defines a name/value parameter for the OAuth2 token URL.", + "name": "name is the parameter name. Must be between 1 and 256 characters.", + "value": "value is the optional parameter value. When omitted, the query parameter is applied as ?name (no value). When set (including to the empty string), it is applied as ?name=value. Empty string may be used when the external system expects a parameter with an empty value (e.g. ?parameter=\"\"). Must be between 0 and 2048 characters when present (aligned with common URL length recommendations).", +} + +func (OAuth2EndpointParam) SwaggerDoc() map[string]string { + return map_OAuth2EndpointParam +} + +var map_OpenShiftStateMetricsConfig = map[string]string{ + "": "OpenShiftStateMetricsConfig provides configuration options for the openshift-state-metrics agent that runs in the `openshift-monitoring` namespace. The openshift-state-metrics agent generates metrics about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments.", + "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + "resources": "resources defines the compute resource requests and limits for the openshift-state-metrics container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 1m\n limit: null\n - name: memory\n request: 32Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + "topologySpreadConstraints": "topologySpreadConstraints defines rules for how openshift-state-metrics Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", +} + +func (OpenShiftStateMetricsConfig) SwaggerDoc() map[string]string { + return map_OpenShiftStateMetricsConfig +} + +var map_PrometheusConfig = map[string]string{ + "": "PrometheusConfig provides configuration options for the Prometheus instance. Use this configuration to control Prometheus deployment, pod scheduling, resource allocation, retention policies, and external integrations.", + "additionalAlertmanagerConfigs": "additionalAlertmanagerConfigs configures additional Alertmanager instances that receive alerts from the Prometheus component. This is useful for organizations that need to:\n - Send alerts to external monitoring systems (like PagerDuty, Slack, or custom webhooks)\n - Route different types of alerts to different teams or systems\n - Integrate with existing enterprise alerting infrastructure\n - Maintain separate alert routing for compliance or organizational requirements\nWhen omitted, no additional Alertmanager instances are configured (default behavior). When provided, at least one configuration must be specified (minimum 1, maximum 10 items). Entries must have unique names (name is the list key).", + "enforcedBodySizeLimitBytes": "enforcedBodySizeLimitBytes enforces a body size limit (in bytes) for Prometheus scraped metrics. If a scraped target's body response is larger than the limit, the scrape will fail. This helps protect Prometheus from targets that return excessively large responses. The value is specified in bytes (e.g., 4194304 for 4MB, 1073741824 for 1GB). When omitted, the Cluster Monitoring Operator automatically calculates an appropriate limit based on cluster capacity. Set an explicit value to override the automatic calculation. Minimum value is 10240 (10kB). Maximum value is 1073741824 (1GB).", + "externalLabels": "externalLabels defines labels to be attached to time series and alerts when communicating with external systems such as federation, remote storage, and Alertmanager. These labels are not stored with metrics on disk; they are only added when data leaves Prometheus (e.g., during federation queries, remote write, or alert notifications). At least 1 label must be specified when set, with a maximum of 50 labels allowed. Each label key must be unique within this list. When omitted, no external labels are applied.", + "logLevel": "logLevel defines the verbosity of logs emitted by Prometheus. This field allows users to control the amount and severity of logs generated, which can be useful for debugging issues or reducing noise in production environments. Allowed values are Error, Warn, Info, and Debug. When set to Error, only errors will be logged. When set to Warn, both warnings and errors will be logged. When set to Info, general information, warnings, and errors will all be logged. When set to Debug, detailed debugging information will be logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Info`.", + "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least one key-value pair (minimum of 1) and must not contain more than 10 entries.", + "queryLogFile": "queryLogFile specifies the file to which PromQL queries are logged. This setting can be either a filename, in which case the queries are saved to an `emptyDir` volume at `/var/log/prometheus`, or a full path to a location where an `emptyDir` volume will be mounted and the queries saved. Writing to `/dev/stderr`, `/dev/stdout` or `/dev/null` is supported, but writing to any other `/dev/` path is not supported. Relative paths are also not supported. By default, PromQL queries are not logged. Must be an absolute path starting with `/` or a simple filename without path separators. Must not contain consecutive slashes, end with a slash, or include '..' path traversal. Must contain only alphanumeric characters, '.', '_', '-', or '/'. Must be between 1 and 255 characters in length.", + "remoteWrite": "remoteWrite defines the remote write configuration, including URL, authentication, and relabeling settings. Remote write allows Prometheus to send metrics it collects to external long-term storage systems. When omitted, no remote write endpoints are configured. When provided, at least one configuration must be specified (minimum 1, maximum 10 items). Entries must have unique names (name is the list key).", + "resources": "resources defines the compute resource requests and limits for the Prometheus container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + "retention": "retention configures how long Prometheus retains metrics data and how much storage it can use. When omitted, the platform chooses reasonable defaults (currently 15 days retention, no size limit).", + "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10 Minimum length for this list is 1", + "topologySpreadConstraints": "topologySpreadConstraints defines rules for how Prometheus Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1 Entries must have unique topologyKey and whenUnsatisfiable pairs.", + "collectionProfile": "collectionProfile defines the metrics collection profile that Prometheus uses to collect metrics from the platform components. Supported values are `Full` or `Minimal`. In the `Full` profile (default), Prometheus collects all metrics that are exposed by the platform components. In the `Minimal` profile, Prometheus only collects metrics necessary for the default platform alerts, recording rules, telemetry and console dashboards. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is `Full`.", + "volumeClaimTemplate": "volumeClaimTemplate defines persistent storage for Prometheus. Use this setting to configure the persistent volume claim, including storage class and volume size. If omitted, the Pod uses ephemeral storage and Prometheus data will not persist across restarts.", +} + +func (PrometheusConfig) SwaggerDoc() map[string]string { + return map_PrometheusConfig +} + var map_PrometheusOperatorAdmissionWebhookConfig = map[string]string{ "": "PrometheusOperatorAdmissionWebhookConfig provides configuration options for the admission webhook component of Prometheus Operator that runs in the `openshift-monitoring` namespace. The admission webhook validates PrometheusRule and AlertmanagerConfig objects, mutates PrometheusRule annotations, and converts AlertmanagerConfig objects between API versions.", - "resources": "resources defines the compute resource requests and limits for the prometheus-operator-admission-webhook container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 5m\n limit: null\n - name: memory\n request: 30Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + "resources": "resources defines the compute resource requests and limits for the prometheus-operator-admission-webhook container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 5m\n limit: null\n - name: memory\n request: 30Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", "topologySpreadConstraints": "topologySpreadConstraints defines rules for how admission webhook Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", } @@ -233,7 +365,7 @@ var map_PrometheusOperatorConfig = map[string]string{ "": "PrometheusOperatorConfig provides configuration options for the Prometheus Operator instance Use this configuration to control how the Prometheus Operator instance is deployed, how it logs, and how its pods are scheduled.", "logLevel": "logLevel defines the verbosity of logs emitted by Prometheus Operator. This field allows users to control the amount and severity of logs generated, which can be useful for debugging issues or reducing noise in production environments. Allowed values are Error, Warn, Info, and Debug. When set to Error, only errors will be logged. When set to Warn, both warnings and errors will be logged. When set to Info, general information, warnings, and errors will all be logged. When set to Debug, detailed debugging information will be logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Info`.", "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", - "resources": "resources defines the compute resource requests and limits for the Prometheus Operator container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + "resources": "resources defines the compute resource requests and limits for the Prometheus Operator container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", "topologySpreadConstraints": "topologySpreadConstraints defines rules for how Prometheus Operator Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", } @@ -242,191 +374,228 @@ func (PrometheusOperatorConfig) SwaggerDoc() map[string]string { return map_PrometheusOperatorConfig } -var map_UserDefinedMonitoring = map[string]string{ - "": "UserDefinedMonitoring config for user-defined projects.", - "mode": "mode defines the different configurations of UserDefinedMonitoring Valid values are Disabled and NamespaceIsolated Disabled disables monitoring for user-defined projects. This restricts the default monitoring stack, installed in the openshift-monitoring project, to monitor only platform namespaces, which prevents any custom monitoring configurations or resources from being applied to user-defined namespaces. NamespaceIsolated enables monitoring for user-defined projects with namespace-scoped tenancy. This ensures that metrics, alerts, and monitoring data are isolated at the namespace level. The current default value is `Disabled`.", +var map_PrometheusRemoteWriteHeader = map[string]string{ + "": "PrometheusRemoteWriteHeader defines a custom HTTP header for remote write requests. The header name must not be one of the reserved headers set by Prometheus (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate). Header names must contain only case-insensitive alphanumeric characters, hyphens (-), and underscores (_); other characters (e.g. emoji) are rejected by validation. Validation is enforced on the Headers field in RemoteWriteSpec.", + "name": "name is the HTTP header name. Must not be a reserved header (see type documentation). Must contain only alphanumeric characters, hyphens, and underscores; invalid characters are rejected. Must be between 1 and 256 characters.", + "value": "value is the HTTP header value. Must be at most 4096 characters.", } -func (UserDefinedMonitoring) SwaggerDoc() map[string]string { - return map_UserDefinedMonitoring +func (PrometheusRemoteWriteHeader) SwaggerDoc() map[string]string { + return map_PrometheusRemoteWriteHeader } -var map_CRIOCredentialProviderConfig = map[string]string{ - "": "CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is \"cluster\". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.\n\nThe resource is a singleton named \"cluster\".\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "spec": "spec defines the desired configuration of the CRI-O Credential Provider. This field is required and must be provided when creating the resource.", - "status": "status represents the current state of the CRIOCredentialProviderConfig. When omitted or nil, it indicates that the status has not yet been set by the controller. The controller will populate this field with validation conditions and operational state.", +var map_QueueConfig = map[string]string{ + "": "QueueConfig allows tuning configuration for remote write queue parameters. Configure this when you need to control throughput, backpressure, or retry behavior—for example to avoid overloading the remote endpoint, to reduce memory usage, or to tune for high-cardinality workloads. Consider capacity, maxShards, and batchSendDeadlineSeconds for throughput; minBackoffMilliseconds and maxBackoffMilliseconds for retries; and rateLimitedAction when the remote returns HTTP 429.", + "capacity": "capacity is the number of samples to buffer per shard before we start dropping them. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 10000. Minimum value is 1. Maximum value is 1000000.", + "maxShards": "maxShards is the maximum number of shards, i.e. amount of concurrency. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 200. Minimum value is 1. Maximum value is 10000.", + "minShards": "minShards is the minimum number of shards, i.e. amount of concurrency. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 1. Minimum value is 1. Maximum value is 10000.", + "maxSamplesPerSend": "maxSamplesPerSend is the maximum number of samples per send. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 1000. Minimum value is 1. Maximum value is 100000.", + "batchSendDeadlineSeconds": "batchSendDeadlineSeconds is the maximum time in seconds a sample will wait in buffer before being sent. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 second. Maximum value is 3600 seconds (1 hour).", + "minBackoffMilliseconds": "minBackoffMilliseconds is the minimum retry delay in milliseconds. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 millisecond. Maximum value is 3600000 milliseconds (1 hour).", + "maxBackoffMilliseconds": "maxBackoffMilliseconds is the maximum retry delay in milliseconds. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 millisecond. Maximum value is 3600000 milliseconds (1 hour).", + "rateLimitedAction": "rateLimitedAction controls what to do when the remote write endpoint returns HTTP 429 (Too Many Requests). When omitted, no retries are performed on rate limit responses. When set to \"Retry\", Prometheus will retry such requests using the backoff settings above. Valid value when set is \"Retry\".", } -func (CRIOCredentialProviderConfig) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfig +func (QueueConfig) SwaggerDoc() map[string]string { + return map_QueueConfig } -var map_CRIOCredentialProviderConfigList = map[string]string{ - "": "CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", +var map_RelabelActionConfig = map[string]string{ + "": "RelabelActionConfig represents the action to perform and its configuration. Exactly one action-specific configuration must be specified based on the action type.", + "type": "type specifies the action to perform on the matched labels. Allowed values are Replace, Lowercase, Uppercase, Keep, Drop, KeepEqual, DropEqual, HashMod, LabelMap, LabelDrop, LabelKeep.\n\nWhen set to Replace, regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. If regex does not match, no replacement takes place.\n\nWhen set to Lowercase, the concatenated source_labels are mapped to their lower case. Requires Prometheus >= v2.36.0.\n\nWhen set to Uppercase, the concatenated source_labels are mapped to their upper case. Requires Prometheus >= v2.36.0.\n\nWhen set to Keep, targets for which regex does not match the concatenated source_labels are dropped.\n\nWhen set to Drop, targets for which regex matches the concatenated source_labels are dropped.\n\nWhen set to KeepEqual, targets for which the concatenated source_labels do not match target_label are dropped. Requires Prometheus >= v2.41.0.\n\nWhen set to DropEqual, targets for which the concatenated source_labels do match target_label are dropped. Requires Prometheus >= v2.41.0.\n\nWhen set to HashMod, target_label is set to the modulus of a hash of the concatenated source_labels.\n\nWhen set to LabelMap, regex is matched against all source label names (not just source_labels); matching label values are copied to new names given by replacement with ${1}, ${2}, ... substituted.\n\nWhen set to LabelDrop, regex is matched against all label names; any label that matches is removed.\n\nWhen set to LabelKeep, regex is matched against all label names; any label that does not match is removed.", + "replace": "replace configures the Replace action. Required when type is Replace, and forbidden otherwise.", + "hashMod": "hashMod configures the HashMod action. Required when type is HashMod, and forbidden otherwise.", + "labelMap": "labelMap configures the LabelMap action. Required when type is LabelMap, and forbidden otherwise.", + "lowercase": "lowercase configures the Lowercase action. Required when type is Lowercase, and forbidden otherwise. Requires Prometheus >= v2.36.0.", + "uppercase": "uppercase configures the Uppercase action. Required when type is Uppercase, and forbidden otherwise. Requires Prometheus >= v2.36.0.", + "keepEqual": "keepEqual configures the KeepEqual action. Required when type is KeepEqual, and forbidden otherwise. Requires Prometheus >= v2.41.0.", + "dropEqual": "dropEqual configures the DropEqual action. Required when type is DropEqual, and forbidden otherwise. Requires Prometheus >= v2.41.0.", } -func (CRIOCredentialProviderConfigList) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfigList +func (RelabelActionConfig) SwaggerDoc() map[string]string { + return map_RelabelActionConfig } -var map_CRIOCredentialProviderConfigSpec = map[string]string{ - "": "CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider.", - "matchImages": "matchImages is a list of string patterns used to determine whether the CRI-O credential provider should be invoked for a given image. This list is passed to the kubelet CredentialProviderConfig, and if any pattern matches the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling that image or its mirrors. Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. Conflicts between the existing platform specific provider image match configuration and this list will be handled by the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those from the CRIOCredentialProviderConfig when both match the same image. To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). You can check the resource's Status conditions to see if any entries were ignored due to exact matches with known built-in provider patterns.\n\nThis field is optional, the items of the list must contain between 1 and 50 entries. The list is treated as a set, so duplicate entries are not allowed.\n\nFor more details, see: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ https://github.com/cri-o/crio-credential-provider#architecture\n\nEach entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). A global wildcard '*' (matching any domain) is not allowed. Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. Each wildcard matches only a single domain label, so '*.io' does **not** match '*.k8s.io'.\n\nA match exists between an image and a matchImage when all of the below are true: Both contain the same number of domain parts and each part matches. The URL path of an matchImages must be a prefix of the target image URL path. If the matchImages contains a port, then the port must match in the image as well.\n\nExample values of matchImages: - 123456789.dkr.ecr.us-east-1.amazonaws.com - *.azurecr.io - gcr.io - *.*.registry.io - registry.io:8080/path", +var map_RelabelConfig = map[string]string{ + "": "RelabelConfig represents a relabeling rule.", + "name": "name is a unique identifier for this relabel configuration. Must contain only alphanumeric characters, hyphens, and underscores. Must be between 1 and 63 characters in length.", + "sourceLabels": "sourceLabels specifies which label names to extract from each series for this relabeling rule. The values of these labels are joined together using the configured separator, and the resulting string is then matched against the regular expression. If a referenced label does not exist on a series, Prometheus substitutes an empty string. When omitted, the rule operates without extracting source labels (useful for actions like labelmap). Minimum of 1 and maximum of 10 source labels can be specified, each between 1 and 128 characters. Each entry must be unique. Label names beginning with \"__\" (two underscores) are reserved for internal Prometheus use and are not allowed. Label names SHOULD start with a letter (a-z, A-Z) or underscore (_), followed by zero or more letters, digits (0-9), or underscores for best compatibility. While Prometheus supports UTF-8 characters in label names (since v3.0.0), using the recommended character set ensures better compatibility with the wider ecosystem (tooling, third-party instrumentation, etc.).", + "separator": "separator is the character sequence used to join source label values. Common examples: \";\", \",\", \"::\", \"|||\". When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \";\". Must be between 1 and 5 characters in length when specified.", + "regex": "regex is the regular expression to match against the concatenated source label values. Must be a valid RE2 regular expression (https://github.com/google/re2/wiki/Syntax). When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \"(.*)\" to match everything. Must be between 1 and 1000 characters in length when specified.", + "action": "action defines the action to perform on the matched labels and its configuration. Exactly one action-specific configuration must be specified based on the action type.", } -func (CRIOCredentialProviderConfigSpec) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfigSpec +func (RelabelConfig) SwaggerDoc() map[string]string { + return map_RelabelConfig } -var map_CRIOCredentialProviderConfigStatus = map[string]string{ - "": "CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig", - "conditions": "conditions represent the latest available observations of the configuration state. When omitted, it indicates that no conditions have been reported yet. The maximum number of conditions is 16. Conditions are stored as a map keyed by condition type, ensuring uniqueness.\n\nExpected condition types include: \"Validated\": indicates whether the matchImages configuration is valid", +var map_RemoteWriteAuthorization = map[string]string{ + "": "RemoteWriteAuthorization defines the authorization method for a remote write endpoint. Exactly one of the nested configs must be set according to the type discriminator.", + "type": "type specifies the authorization method to use. Allowed values are BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, ServiceAccount.\n\nWhen set to BearerToken, the bearer token is read from a Secret referenced by the bearerToken field.\n\nWhen set to BasicAuth, HTTP basic authentication is used; the basicAuth field (username and password from Secrets) must be set.\n\nWhen set to OAuth2, OAuth2 client credentials flow is used; the oauth2 field (clientId, clientSecret, tokenUrl) must be set.\n\nWhen set to SigV4, AWS Signature Version 4 is used for authentication; the sigv4 field must be set.\n\nWhen set to SafeAuthorization, credentials are read from a single Secret key (Prometheus SafeAuthorization pattern). The secret key typically contains a Bearer token. Use the safeAuthorization field.\n\nWhen set to ServiceAccount, the pod's service account token is used for machine identity. No additional field is required; the operator configures the token path.", + "safeAuthorization": "safeAuthorization defines the secret reference containing the credentials for authentication (e.g. Bearer token). Required when type is \"SafeAuthorization\", and forbidden otherwise. Maps to Prometheus SafeAuthorization. The secret must exist in the openshift-monitoring namespace.", + "bearerToken": "bearerToken defines the secret reference containing the bearer token. Required when type is \"BearerToken\", and forbidden otherwise.", + "basicAuth": "basicAuth defines HTTP basic authentication credentials. Required when type is \"BasicAuth\", and forbidden otherwise.", + "oauth2": "oauth2 defines OAuth2 client credentials authentication. Required when type is \"OAuth2\", and forbidden otherwise.", + "sigv4": "sigv4 defines AWS Signature Version 4 authentication. Required when type is \"SigV4\", and forbidden otherwise.", } -func (CRIOCredentialProviderConfigStatus) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfigStatus +func (RemoteWriteAuthorization) SwaggerDoc() map[string]string { + return map_RemoteWriteAuthorization } -var map_ImagePolicy = map[string]string{ - "": "ImagePolicy holds namespace-wide configuration for image signature verification\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "spec": "spec holds user settable values for configuration", - "status": "status contains the observed state of the resource.", +var map_RemoteWriteSpec = map[string]string{ + "": "RemoteWriteSpec represents configuration for remote write endpoints.", + "url": "url is the URL of the remote write endpoint. Must be a valid URL with http or https scheme and a non-empty hostname. Query parameters, fragments, and user information (e.g. user:password@host) are not allowed. Empty string is invalid. Must be between 1 and 2048 characters in length.", + "name": "name is a required identifier for this remote write configuration (name is the list key for the remoteWrite list). This name is used in metrics and logging to differentiate remote write queues. Must contain only alphanumeric characters, hyphens, and underscores. Must be between 1 and 63 characters in length.", + "authorization": "authorization defines the authorization method for the remote write endpoint. When omitted, no authorization is performed. When set, type must be one of BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, or ServiceAccount; the corresponding nested config must be set (ServiceAccount has no config).", + "headers": "headers specifies the custom HTTP headers to be sent along with each remote write request. Sending custom headers makes the configuration of a proxy in between optional and helps the receiver recognize the given source better. Clients MAY allow users to send custom HTTP headers; they MUST NOT allow users to configure them in such a way as to send reserved headers. Headers set by Prometheus cannot be overwritten. When omitted, no custom headers are sent. Maximum of 50 headers can be specified. Each header name must be unique. Each header name must contain only alphanumeric characters, hyphens, and underscores, and must not be a reserved Prometheus header (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate).", + "metadataConfig": "metadataConfig configures the sending of series metadata to remote storage. When omitted, no metadata is sent. When set to sendPolicy: Default, metadata is sent using platform-chosen defaults (e.g. send interval 30 seconds). When set to sendPolicy: Custom, metadata is sent using the settings in the custom field (e.g. custom.sendIntervalSeconds).", + "proxyUrl": "proxyUrl defines an optional proxy URL. If the cluster-wide proxy is enabled, it replaces the proxyUrl setting. The cluster-wide proxy supports both HTTP and HTTPS proxies, with HTTPS taking precedence. When omitted, no proxy is used. Must be a valid URL with http or https scheme. Must be between 1 and 2048 characters in length.", + "queueConfig": "queueConfig allows tuning configuration for remote write queue parameters. When omitted, default queue configuration is used.", + "remoteTimeoutSeconds": "remoteTimeoutSeconds defines the timeout in seconds for requests to the remote write endpoint. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 second. Maximum value is 600 seconds (10 minutes).", + "exemplarsMode": "exemplarsMode controls whether exemplars are sent via remote write. Valid values are \"Send\", \"DoNotSend\" and omitted. When set to \"Send\", Prometheus is configured to store a maximum of 100,000 exemplars in memory and send them with remote write. Note that this setting only applies to user-defined monitoring. It is not applicable to default in-cluster monitoring. When omitted or set to \"DoNotSend\", exemplars are not sent.", + "tlsConfig": "tlsConfig defines TLS authentication settings for the remote write endpoint. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", + "writeRelabelConfigs": "writeRelabelConfigs is a list of relabeling rules to apply before sending data to the remote endpoint. When omitted, no relabeling is performed and all metrics are sent as-is. Minimum of 1 and maximum of 10 relabeling rules can be specified. Each rule must have a unique name.", } -func (ImagePolicy) SwaggerDoc() map[string]string { - return map_ImagePolicy +func (RemoteWriteSpec) SwaggerDoc() map[string]string { + return map_RemoteWriteSpec } -var map_ImagePolicyFulcioCAWithRekorRootOfTrust = map[string]string{ - "": "ImagePolicyFulcioCAWithRekorRootOfTrust defines the root of trust based on the Fulcio certificate and the Rekor public key.", - "fulcioCAData": "fulcioCAData contains inline base64-encoded data for the PEM format fulcio CA. fulcioCAData must be at most 8192 characters.", - "rekorKeyData": "rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. rekorKeyData must be at most 8192 characters.", - "fulcioSubject": "fulcioSubject specifies OIDC issuer and the email of the Fulcio authentication configuration.", +var map_ReplaceActionConfig = map[string]string{ + "": "ReplaceActionConfig configures the Replace action. Regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. No replacement if regex does not match.", + "targetLabel": "targetLabel is the label name where the replacement result is written. Must be between 1 and 128 characters in length.", + "replacement": "replacement is the value written to target_label when regex matches; match group references (${1}, ${2}, ...) are substituted. Required when using the Replace action so the intended behavior is explicit and the platform does not need to apply defaults. Use \"$1\" for the first capture group, \"$2\" for the second, etc. Use an empty string (\"\") to explicitly clear the target label value. Must be between 0 and 255 characters in length.", } -func (ImagePolicyFulcioCAWithRekorRootOfTrust) SwaggerDoc() map[string]string { - return map_ImagePolicyFulcioCAWithRekorRootOfTrust +func (ReplaceActionConfig) SwaggerDoc() map[string]string { + return map_ReplaceActionConfig } -var map_ImagePolicyList = map[string]string{ - "": "ImagePolicyList is a list of ImagePolicy resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", +var map_Retention = map[string]string{ + "": "Retention configures how long Prometheus retains metrics data and how much storage it can use.", + "durationInDays": "durationInDays specifies how many days Prometheus will retain metrics data. Prometheus automatically deletes data older than this duration. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 15. Minimum value is 1 day. Maximum value is 365 days (1 year).", + "sizeInGiB": "sizeInGiB specifies the maximum storage size in gibibytes (GiB) that Prometheus can use for data blocks and the write-ahead log (WAL). When the limit is reached, Prometheus will delete oldest data first. When omitted, no size limit is enforced and Prometheus uses available PersistentVolume capacity. Minimum value is 1 GiB. Maximum value is 16384 GiB (16 TiB).", } -func (ImagePolicyList) SwaggerDoc() map[string]string { - return map_ImagePolicyList +func (Retention) SwaggerDoc() map[string]string { + return map_Retention } -var map_ImagePolicyPKIRootOfTrust = map[string]string{ - "": "ImagePolicyPKIRootOfTrust defines the root of trust based on Root CA(s) and corresponding intermediate certificates.", - "caRootsData": "caRootsData contains base64-encoded data of a certificate bundle PEM file, which contains one or more CA roots in the PEM format. The total length of the data must not exceed 8192 characters. ", - "caIntermediatesData": "caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters. caIntermediatesData requires caRootsData to be set. ", - "pkiCertificateSubject": "pkiCertificateSubject defines the requirements imposed on the subject to which the certificate was issued.", +var map_SecretKeySelector = map[string]string{ + "": "SecretKeySelector selects a key of a Secret in the `openshift-monitoring` namespace.", + "name": "name is the name of the secret in the `openshift-monitoring` namespace to select from. Must be a valid Kubernetes secret name (lowercase alphanumeric, '-' or '.', start/end with alphanumeric). Must be between 1 and 253 characters in length.", + "key": "key is the key of the secret to select from. Must consist of alphanumeric characters, '-', '_', or '.'. Must be between 1 and 253 characters in length.", } -func (ImagePolicyPKIRootOfTrust) SwaggerDoc() map[string]string { - return map_ImagePolicyPKIRootOfTrust +func (SecretKeySelector) SwaggerDoc() map[string]string { + return map_SecretKeySelector } -var map_ImagePolicyPublicKeyRootOfTrust = map[string]string{ - "": "ImagePolicyPublicKeyRootOfTrust defines the root of trust based on a sigstore public key.", - "keyData": "keyData contains inline base64-encoded data for the PEM format public key. KeyData must be at most 8192 characters.", - "rekorKeyData": "rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. rekorKeyData must be at most 8192 characters.", +var map_Sigv4 = map[string]string{ + "": "Sigv4 defines AWS Signature Version 4 authentication settings. At least one of region, accessKey/secretKey, profile, or roleArn must be set so the platform can perform authentication.", + "region": "region is the AWS region. When omitted, the region is derived from the environment or instance metadata. Must be between 1 and 128 characters.", + "accessKey": "accessKey defines the secret reference containing the AWS access key ID. The secret must exist in the openshift-monitoring namespace. When omitted, the access key is derived from the environment or instance metadata.", + "secretKey": "secretKey defines the secret reference containing the AWS secret access key. The secret must exist in the openshift-monitoring namespace. When omitted, the secret key is derived from the environment or instance metadata.", + "profile": "profile is the named AWS profile used to authenticate. When omitted, the default profile is used. Must be between 1 and 128 characters.", + "roleArn": "roleArn is the AWS Role ARN, an alternative to using AWS API keys. When omitted, API keys are used for authentication. Must be a valid AWS ARN format (e.g., \"arn:aws:iam::123456789012:role/MyRole\"). Must be between 1 and 512 characters.", } -func (ImagePolicyPublicKeyRootOfTrust) SwaggerDoc() map[string]string { - return map_ImagePolicyPublicKeyRootOfTrust +func (Sigv4) SwaggerDoc() map[string]string { + return map_Sigv4 } -var map_ImagePolicySpec = map[string]string{ - "": "ImagePolicySpec is the specification of the ImagePolicy CRD.", - "scopes": "scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the \"Docker Registry HTTP API V2\". Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. For additional details about the format, please refer to the document explaining the docker transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker", - "policy": "policy contains configuration to allow scopes to be verified, and defines how images not matching the verification policy will be treated.", +var map_TLSConfig = map[string]string{ + "": "TLSConfig represents TLS configuration for Alertmanager connections. At least one TLS configuration option must be specified. For mutual TLS (mTLS), both cert and key must be specified together, or both omitted.", + "ca": "ca is an optional CA certificate to use for TLS connections. When omitted, the system's default CA bundle is used.", + "cert": "cert is an optional client certificate to use for mutual TLS connections. When omitted, no client certificate is presented.", + "key": "key is an optional client key to use for mutual TLS connections. When omitted, no client key is used.", + "serverName": "serverName is an optional server name to use for TLS connections. When specified, must be a valid DNS subdomain as per RFC 1123. When omitted, the server name is derived from the URL. Must be between 1 and 253 characters in length.", + "certificateVerification": "certificateVerification determines the policy for TLS certificate verification. Allowed values are \"Verify\" (performs certificate verification, secure) and \"SkipVerify\" (skips verification, insecure). When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \"Verify\".", } -func (ImagePolicySpec) SwaggerDoc() map[string]string { - return map_ImagePolicySpec +func (TLSConfig) SwaggerDoc() map[string]string { + return map_TLSConfig } -var map_ImagePolicyStatus = map[string]string{ - "conditions": "conditions provide details on the status of this API Resource.", +var map_TelemeterClientConfig = map[string]string{ + "": "TelemeterClientConfig provides configuration options for the Telemeter Client component that runs in the `openshift-monitoring` namespace. The Telemeter Client collects selected monitoring metrics and forwards them to Red Hat for telemetry purposes. At least one field must be specified.", + "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + "resources": "resources defines the compute resource requests and limits for the Telemeter Client container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 1m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + "topologySpreadConstraints": "topologySpreadConstraints defines rules for how Telemeter Client Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", } -func (ImagePolicyStatus) SwaggerDoc() map[string]string { - return map_ImagePolicyStatus +func (TelemeterClientConfig) SwaggerDoc() map[string]string { + return map_TelemeterClientConfig } -var map_ImageSigstoreVerificationPolicy = map[string]string{ - "": "ImageSigstoreVerificationPolicy defines the verification policy for the items in the scopes list.", - "rootOfTrust": "rootOfTrust specifies the root of trust for the policy.", - "signedIdentity": "signedIdentity specifies what image identity the signature claims about the image. The required matchPolicy field specifies the approach used in the verification process to verify the identity in the signature and the actual image identity, the default matchPolicy is \"MatchRepoDigestOrExact\".", +var map_ThanosQuerierConfig = map[string]string{ + "": "ThanosQuerierConfig provides configuration options for the Thanos Querier component that runs in the `openshift-monitoring` namespace. At least one field must be specified; an empty thanosQuerierConfig object is not allowed.", + "nodeSelector": "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + "resources": "resources defines the compute resource requests and limits for the Thanos Querier container. resources is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Requests cannot exceed limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 5m\n - name: memory\n request: 12Mi\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + "tolerations": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + "topologySpreadConstraints": "topologySpreadConstraints defines rules for how Thanos Querier Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", } -func (ImageSigstoreVerificationPolicy) SwaggerDoc() map[string]string { - return map_ImageSigstoreVerificationPolicy +func (ThanosQuerierConfig) SwaggerDoc() map[string]string { + return map_ThanosQuerierConfig } -var map_PKICertificateSubject = map[string]string{ - "": "PKICertificateSubject defines the requirements imposed on the subject to which the certificate was issued.", - "email": "email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate. The email should be a valid email address and at most 320 characters in length.", - "hostname": "hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate. The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length. It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk.", +var map_UppercaseActionConfig = map[string]string{ + "": "UppercaseActionConfig configures the Uppercase action. Maps the concatenated source_labels to their upper case and writes to target_label. Requires Prometheus >= v2.36.0.", + "targetLabel": "targetLabel is the label name where the upper-cased value is written. Must be between 1 and 128 characters in length.", } -func (PKICertificateSubject) SwaggerDoc() map[string]string { - return map_PKICertificateSubject +func (UppercaseActionConfig) SwaggerDoc() map[string]string { + return map_UppercaseActionConfig } -var map_PolicyFulcioSubject = map[string]string{ - "": "PolicyFulcioSubject defines the OIDC issuer and the email of the Fulcio authentication configuration.", - "oidcIssuer": "oidcIssuer contains the expected OIDC issuer. It will be verified that the Fulcio-issued certificate contains a (Fulcio-defined) certificate extension pointing at this OIDC issuer URL. When Fulcio issues certificates, it includes a value based on an URL inside the client-provided ID token. Example: \"https://expected.OIDC.issuer/\"", - "signedEmail": "signedEmail holds the email address the the Fulcio certificate is issued for. Example: \"expected-signing-user@example.com\"", +var map_UserDefinedMonitoring = map[string]string{ + "": "UserDefinedMonitoring config for user-defined projects.", + "mode": "mode defines the different configurations of UserDefinedMonitoring Valid values are Disabled and NamespaceIsolated Disabled disables monitoring for user-defined projects. This restricts the default monitoring stack, installed in the openshift-monitoring project, to monitor only platform namespaces, which prevents any custom monitoring configurations or resources from being applied to user-defined namespaces. NamespaceIsolated enables monitoring for user-defined projects with namespace-scoped tenancy. This ensures that metrics, alerts, and monitoring data are isolated at the namespace level. The current default value is `Disabled`.", } -func (PolicyFulcioSubject) SwaggerDoc() map[string]string { - return map_PolicyFulcioSubject +func (UserDefinedMonitoring) SwaggerDoc() map[string]string { + return map_UserDefinedMonitoring } -var map_PolicyIdentity = map[string]string{ - "": "PolicyIdentity defines image identity the signature claims about the image. When omitted, the default matchPolicy is \"MatchRepoDigestOrExact\".", - "matchPolicy": "matchPolicy sets the type of matching to be used. Valid values are \"MatchRepoDigestOrExact\", \"MatchRepository\", \"ExactRepository\", \"RemapIdentity\". When omitted, the default value is \"MatchRepoDigestOrExact\". If set matchPolicy to ExactRepository, then the exactRepository must be specified. If set matchPolicy to RemapIdentity, then the remapIdentity must be specified. \"MatchRepoDigestOrExact\" means that the identity in the signature must be in the same repository as the image identity if the image identity is referenced by a digest. Otherwise, the identity in the signature must be the same as the image identity. \"MatchRepository\" means that the identity in the signature must be in the same repository as the image identity. \"ExactRepository\" means that the identity in the signature must be in the same repository as a specific identity specified by \"repository\". \"RemapIdentity\" means that the signature must be in the same as the remapped image identity. Remapped image identity is obtained by replacing the \"prefix\" with the specified “signedPrefix” if the the image identity matches the specified remapPrefix.", - "exactRepository": "exactRepository is required if matchPolicy is set to \"ExactRepository\".", - "remapIdentity": "remapIdentity is required if matchPolicy is set to \"RemapIdentity\".", +var map_CRIOCredentialProviderConfig = map[string]string{ + "": "CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is \"cluster\". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.\n\nThe resource is a singleton named \"cluster\".\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "spec": "spec defines the desired configuration of the CRI-O Credential Provider. This field is required and must be provided when creating the resource.", + "status": "status represents the current state of the CRIOCredentialProviderConfig. When omitted or nil, it indicates that the status has not yet been set by the controller. The controller will populate this field with validation conditions and operational state.", } -func (PolicyIdentity) SwaggerDoc() map[string]string { - return map_PolicyIdentity +func (CRIOCredentialProviderConfig) SwaggerDoc() map[string]string { + return map_CRIOCredentialProviderConfig } -var map_PolicyMatchExactRepository = map[string]string{ - "repository": "repository is the reference of the image identity to be matched. The value should be a repository name (by omitting the tag or digest) in a registry implementing the \"Docker Registry HTTP API V2\". For example, docker.io/library/busybox", +var map_CRIOCredentialProviderConfigList = map[string]string{ + "": "CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", } -func (PolicyMatchExactRepository) SwaggerDoc() map[string]string { - return map_PolicyMatchExactRepository +func (CRIOCredentialProviderConfigList) SwaggerDoc() map[string]string { + return map_CRIOCredentialProviderConfigList } -var map_PolicyMatchRemapIdentity = map[string]string{ - "prefix": "prefix is the prefix of the image identity to be matched. If the image identity matches the specified prefix, that prefix is replaced by the specified “signedPrefix” (otherwise it is used as unchanged and no remapping takes place). This useful when verifying signatures for a mirror of some other repository namespace that preserves the vendor’s repository structure. The prefix and signedPrefix values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox.", - "signedPrefix": "signedPrefix is the prefix of the image identity to be matched in the signature. The format is the same as \"prefix\". The values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox.", +var map_CRIOCredentialProviderConfigSpec = map[string]string{ + "": "CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider.", + "matchImages": "matchImages is a list of string patterns used to determine whether the CRI-O credential provider should be invoked for a given image. This list is passed to the kubelet CredentialProviderConfig, and if any pattern matches the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling that image or its mirrors. Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. Conflicts between the existing platform specific provider image match configuration and this list will be handled by the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those from the CRIOCredentialProviderConfig when both match the same image. To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). You can check the resource's Status conditions to see if any entries were ignored due to exact matches with known built-in provider patterns.\n\nThis field is optional, the items of the list must contain between 1 and 50 entries. The list is treated as a set, so duplicate entries are not allowed.\n\nFor more details, see: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ https://github.com/cri-o/crio-credential-provider#architecture\n\nEach entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). A global wildcard '*' (matching any domain) is not allowed. Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. Each wildcard matches only a single domain label, so '*.io' does **not** match '*.k8s.io'.\n\nA match exists between an image and a matchImage when all of the below are true: Both contain the same number of domain parts and each part matches. The URL path of an matchImages must be a prefix of the target image URL path. If the matchImages contains a port, then the port must match in the image as well.\n\nExample values of matchImages: - 123456789.dkr.ecr.us-east-1.amazonaws.com - *.azurecr.io - gcr.io - *.*.registry.io - registry.io:8080/path", } -func (PolicyMatchRemapIdentity) SwaggerDoc() map[string]string { - return map_PolicyMatchRemapIdentity +func (CRIOCredentialProviderConfigSpec) SwaggerDoc() map[string]string { + return map_CRIOCredentialProviderConfigSpec } -var map_PolicyRootOfTrust = map[string]string{ - "": "PolicyRootOfTrust defines the root of trust based on the selected policyType.", - "policyType": "policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust. \"PublicKey\" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification. \"FulcioCAWithRekor\" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification. \"PKI\" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.", - "publicKey": "publicKey defines the root of trust based on a sigstore public key.", - "fulcioCAWithRekor": "fulcioCAWithRekor defines the root of trust based on the Fulcio certificate and the Rekor public key. For more information about Fulcio and Rekor, please refer to the document at: https://github.com/sigstore/fulcio and https://github.com/sigstore/rekor", - "pki": "pki defines the root of trust based on Bring Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and corresponding intermediate certificates.", +var map_CRIOCredentialProviderConfigStatus = map[string]string{ + "": "CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig", + "conditions": "conditions represent the latest available observations of the configuration state. When omitted, it indicates that no conditions have been reported yet. The maximum number of conditions is 16. Conditions are stored as a map keyed by condition type, ensuring uniqueness.\n\nExpected condition types include: \"Validated\": indicates whether the matchImages configuration is valid", } -func (PolicyRootOfTrust) SwaggerDoc() map[string]string { - return map_PolicyRootOfTrust +func (CRIOCredentialProviderConfigStatus) SwaggerDoc() map[string]string { + return map_CRIOCredentialProviderConfigStatus } var map_GatherConfig = map[string]string{ diff --git a/vendor/github.com/openshift/api/envtest-releases.yaml b/vendor/github.com/openshift/api/envtest-releases.yaml index e495e02796..ea376ded55 100644 --- a/vendor/github.com/openshift/api/envtest-releases.yaml +++ b/vendor/github.com/openshift/api/envtest-releases.yaml @@ -1,4 +1,30 @@ releases: + v1.28.15: + envtest-v1.28.15-darwin-amd64.tar.gz: + hash: 79e04e7e264e6907da73d27c04d50be7bfa702b059e66f21331c9c8e16daa6ff960e750c1910804b7aa2a5bd79488a5bd082b76a7bab003e613a2cdbb2a8b80d + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.28.15-darwin-amd64.tar.gz + envtest-v1.28.15-darwin-arm64.tar.gz: + hash: 9646d169cf5161793ded60fa2ffde705d8fdde7c7c77833be9a77909f5804b909f28d56b2b0b93bd200d8057db3e37da9fe1683368ae38777ea62609135d0b4d + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.28.15-darwin-arm64.tar.gz + envtest-v1.28.15-linux-amd64.tar.gz: + hash: bc7e3deabbb3c7ee5e572e1392041af9d2fa40a51eb88dcabdaf57ff2a476e81efbd837a87f1f0849a5083dcb7c0b4b2fc16107da4cf3308805eee377fb383c1 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.28.15-linux-amd64.tar.gz + envtest-v1.28.15-linux-arm64.tar.gz: + hash: 17ec8d5f7de118b66d1621d8b25b4f0a891e4a641d5e845d14c0da4cb2e258b6bf788fe6b5334b27beb12d9e67f7c8f2c2ded6023bf9a7e79ac3b483b8cdfcc2 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.28.15-linux-arm64.tar.gz + v1.29.7: + envtest-v1.29.7-darwin-amd64.tar.gz: + hash: 4a97f9162ee882632aafda20e562dfb4011879f9ec6c8ffa4922e566933fc35292171cc837b50860e2e91238d820931a1fb8c3280541a180f6e9057178c71889 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.29.7-darwin-amd64.tar.gz + envtest-v1.29.7-darwin-arm64.tar.gz: + hash: e810e04c14b1bba79c90c755ecb8b13094132a86339e78d1fe39029b9825b90b663d538b29d6ab4d905c22728efdf278881ee3f434f2215bc77157dee90a2bde + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.29.7-darwin-arm64.tar.gz + envtest-v1.29.7-linux-amd64.tar.gz: + hash: 91dcf683c95541691b8b9fdd332b0d3df56f8969b57c14797e990b9861ad71b2954f402913b5579f6afb99dce19817ba49542e2e276c7f70aeeb857a5ec1d57c + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.29.7-linux-amd64.tar.gz + envtest-v1.29.7-linux-arm64.tar.gz: + hash: 912333dee15e9cc068ebc5ef25591e16b9732cc70c23435efa72af352cffa9c25236d3982db910bd3a06172e9d57fc0d50585996f17c66ae1b80f0e2d3ef37b5 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.29.7-linux-arm64.tar.gz v1.30.3: envtest-v1.30.3-darwin-amd64.tar.gz: hash: 81ab2ad5841522976d9a5fc58642b745cf308230b0f2e634acfb2d5c8f288ef837f7b82144a5e91db607d86885101e06dd473a68bcac0d71be2297edc4aaa92e @@ -77,3 +103,16 @@ releases: envtest-v1.34.1-linux-arm64.tar.gz: hash: e2ee7e47ceeba56624fd869922ab9851200482ef835c09fe3dd57c9806a992a7e1f56641906510ebb095514953aa8a3af68d45a82be45b94981a50e894ac6e42 selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.34.1-linux-arm64.tar.gz + v1.35.1: + envtest-v1.35.1-darwin-amd64.tar.gz: + hash: 8b788ca564d0d2d49000b572b9c83a87f71978b7dcbb0c969dde5bf8923869dcb5860b8f905af9a3772431ba7e575c4215d1bcfa5d2857bd8db440272f252ddd + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.35.1-darwin-amd64.tar.gz + envtest-v1.35.1-darwin-arm64.tar.gz: + hash: d650d7a96c69efdc7321579d597b9dbd9ef71df5ea1e0f00815edb31eb0f4a40599fe223b9d0f2a114be32657ff842136a3ab65e646b08a0fce50d6871bcec71 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.35.1-darwin-arm64.tar.gz + envtest-v1.35.1-linux-amd64.tar.gz: + hash: 70e4e66f842d53cce174a3499feb04e0493ada374148c687da4e7ddc0e20e10dd6fa5e2cd765bd80b7d3dca3cd8388460503a0335e15f71212b333386fb3c2b1 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.35.1-linux-amd64.tar.gz + envtest-v1.35.1-linux-arm64.tar.gz: + hash: 309308f9c66f9e2e5192c65a333a388faaaa903841f26f8a96b8f13a5eb3039bcbb818ef6ddbb5803a9cfa9b25e37249a0aed5d472badb25539696569923f87f + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.35.1-linux-arm64.tar.gz diff --git a/vendor/github.com/openshift/api/etcd/install.go b/vendor/github.com/openshift/api/etcd/install.go index 7e7474152c..659816d814 100644 --- a/vendor/github.com/openshift/api/etcd/install.go +++ b/vendor/github.com/openshift/api/etcd/install.go @@ -5,6 +5,7 @@ import ( "k8s.io/apimachinery/pkg/runtime/schema" v1alpha1 "github.com/openshift/api/etcd/v1alpha1" + v1 "github.com/openshift/api/etcd/v1" ) const ( @@ -12,7 +13,7 @@ const ( ) var ( - schemeBuilder = runtime.NewSchemeBuilder(v1alpha1.Install) + schemeBuilder = runtime.NewSchemeBuilder(v1.Install, v1alpha1.Install) // Install is a function which adds every version of this group to a scheme Install = schemeBuilder.AddToScheme ) diff --git a/vendor/github.com/openshift/api/etcd/v1/Makefile b/vendor/github.com/openshift/api/etcd/v1/Makefile new file mode 100644 index 0000000000..6fa6435a24 --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/Makefile @@ -0,0 +1,3 @@ +.PHONY: test +test: + make -C ../../tests test GINKGO_EXTRA_ARGS=--focus="etcd.openshift.io/v1" diff --git a/vendor/github.com/openshift/api/etcd/v1/doc.go b/vendor/github.com/openshift/api/etcd/v1/doc.go new file mode 100644 index 0000000000..fe483fffd4 --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/doc.go @@ -0,0 +1,6 @@ +// +k8s:deepcopy-gen=package,register +// +k8s:defaulter-gen=TypeMeta +// +k8s:openapi-gen=true +// +openshift:featuregated-schema-gen=true +// +groupName=etcd.openshift.io +package v1 diff --git a/vendor/github.com/openshift/api/etcd/v1/register.go b/vendor/github.com/openshift/api/etcd/v1/register.go new file mode 100644 index 0000000000..1b59263043 --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/register.go @@ -0,0 +1,39 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +var ( + GroupName = "etcd.openshift.io" + GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"} + schemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) + // Install is a function which adds this version to a scheme + Install = schemeBuilder.AddToScheme + + // SchemeGroupVersion generated code relies on this name + // Deprecated + SchemeGroupVersion = GroupVersion + // AddToScheme exists solely to keep the old generators creating valid code + // DEPRECATED + AddToScheme = schemeBuilder.AddToScheme +) + +// Resource generated code relies on this being here, but it logically belongs to the group +// DEPRECATED +func Resource(resource string) schema.GroupResource { + return schema.GroupResource{Group: GroupName, Resource: resource} +} + +func addKnownTypes(scheme *runtime.Scheme) error { + metav1.AddToGroupVersion(scheme, GroupVersion) + + scheme.AddKnownTypes(GroupVersion, + &PacemakerCluster{}, + &PacemakerClusterList{}, + ) + + return nil +} diff --git a/vendor/github.com/openshift/api/etcd/v1/types_pacemakercluster.go b/vendor/github.com/openshift/api/etcd/v1/types_pacemakercluster.go new file mode 100644 index 0000000000..a481f5e1bd --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/types_pacemakercluster.go @@ -0,0 +1,737 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// PacemakerCluster is used in Two Node OpenShift with Fencing deployments to monitor the health +// of etcd running under pacemaker. + +// Cluster-level condition types for PacemakerCluster.status.conditions +const ( + // ClusterHealthyConditionType tracks the overall health of the pacemaker cluster. + // This is an aggregate condition that reflects the health of all cluster-level conditions and node health. + // Specifically, it aggregates the following conditions: + // - ClusterInServiceConditionType + // - ClusterNodeCountAsExpectedConditionType + // - NodeHealthyConditionType (for each node) + // When True, the cluster is healthy with reason "ClusterHealthy". + // When False, the cluster is unhealthy with reason "ClusterUnhealthy". + ClusterHealthyConditionType = "Healthy" + + // ClusterInServiceConditionType tracks whether the cluster is in service (not in maintenance mode). + // Maintenance mode is a cluster-wide setting that prevents pacemaker from starting or stopping resources. + // When True, the cluster is in service with reason "InService". This is the normal operating state. + // When False, the cluster is in maintenance mode with reason "InMaintenance". This is an unexpected state. + ClusterInServiceConditionType = "InService" + + // ClusterNodeCountAsExpectedConditionType tracks whether the cluster has the expected number of nodes. + // For Two Node OpenShift with Fencing, we are expecting exactly 2 nodes. + // When True, the expected number of nodes are present with reason "AsExpected". + // When False, the node count is incorrect with reason "InsufficientNodes" or "ExcessiveNodes". + ClusterNodeCountAsExpectedConditionType = "NodeCountAsExpected" +) + +// ClusterHealthy condition reasons +const ( + // ClusterHealthyReasonHealthy means the pacemaker cluster is healthy and operating normally. + ClusterHealthyReasonHealthy = "ClusterHealthy" + + // ClusterHealthyReasonUnhealthy means the pacemaker cluster has issues that need investigation. + ClusterHealthyReasonUnhealthy = "ClusterUnhealthy" +) + +// ClusterInService condition reasons +const ( + // ClusterInServiceReasonInService means the cluster is in service (not in maintenance mode). + // This is the normal operating state. + ClusterInServiceReasonInService = "InService" + + // ClusterInServiceReasonInMaintenance means the cluster is in maintenance mode. + // In maintenance mode, pacemaker will not start or stop any resources. Entering and exiting this state requires + // manual user intervention, and is unexpected during normal cluster operation. + ClusterInServiceReasonInMaintenance = "InMaintenance" +) + +// ClusterNodeCountAsExpected condition reasons +const ( + // ClusterNodeCountAsExpectedReasonAsExpected means the expected number of nodes are present. + // For Two Node OpenShift with Fencing, we are expecting exactly 2 nodes. This is the expected healthy state. + ClusterNodeCountAsExpectedReasonAsExpected = "AsExpected" + + // ClusterNodeCountAsExpectedReasonInsufficientNodes means fewer nodes than expected are present. + // For Two Node OpenShift with Fencing, this means that less than 2 nodes are present. Under normal operation, this will only happen during + // a node replacement operation. It's also possible to enter this state with manual user intervention, but + // will also require user intervention to restore normal functionality. + ClusterNodeCountAsExpectedReasonInsufficientNodes = "InsufficientNodes" + + // ClusterNodeCountAsExpectedReasonExcessiveNodes means more nodes than expected are present. + // For Two Node OpenShift with Fencing, this means more than 2 nodes are present. This should be investigated as it is unexpected and should + // never happen during normal cluster operation. It is possible to enter this state with manual user intervention, + // but will also require user intervention to restore normal functionality. + ClusterNodeCountAsExpectedReasonExcessiveNodes = "ExcessiveNodes" +) + +// Node-level condition types for PacemakerCluster.status.nodes[].conditions +const ( + // NodeHealthyConditionType tracks the overall health of a node in the pacemaker cluster. + // This is an aggregate condition that reflects the health of all node-level conditions and resource health. + // Specifically, it aggregates the following conditions: + // - NodeOnlineConditionType + // - NodeInServiceConditionType + // - NodeActiveConditionType + // - NodeReadyConditionType + // - NodeCleanConditionType + // - NodeMemberConditionType + // - NodeFencingAvailableConditionType + // - NodeFencingHealthyConditionType + // - ResourceHealthyConditionType (for each resource in the node's resources list) + // When True, the node is healthy with reason "NodeHealthy". + // When False, the node is unhealthy with reason "NodeUnhealthy". + NodeHealthyConditionType = "Healthy" + + // NodeOnlineConditionType tracks whether a node is online. + // When True, the node is online with reason "Online". This is the normal operating state. + // When False, the node is offline with reason "Offline". This can occur during reboots, failures, maintenance, or replacement. + NodeOnlineConditionType = "Online" + + // NodeInServiceConditionType tracks whether a node is in service (not in maintenance mode). + // A node in maintenance mode is ignored by pacemaker while maintenance mode is active. + // When True, the node is in service with reason "InService". This is the normal operating state. + // When False, the node is in maintenance mode with reason "InMaintenance". This is an unexpected state. + NodeInServiceConditionType = "InService" + + // NodeActiveConditionType tracks whether a node is active (not in standby mode). + // When a node enters standby mode, pacemaker moves its resources to other nodes in the cluster. + // In Two Node OpenShift with Fencing, we do not use standby mode during normal operation. + // When True, the node is active with reason "Active". This is the normal operating state. + // When False, the node is in standby mode with reason "Standby". This is an unexpected state. + NodeActiveConditionType = "Active" + + // NodeReadyConditionType tracks whether a node is ready (not in a pending state). + // A node in a pending state is in the process of joining or leaving the cluster. + // When True, the node is ready with reason "Ready". This is the normal operating state. + // When False, the node is pending with reason "Pending". This is expected to be temporary. + NodeReadyConditionType = "Ready" + + // NodeCleanConditionType tracks whether a node is in a clean state. + // An unclean state means that pacemaker was unable to confirm the node's state, which signifies issues + // in fencing, communication, or configuration. + // When True, the node is clean with reason "Clean". This is the normal operating state. + // When False, the node is unclean with reason "Unclean". This is an unexpected state. + NodeCleanConditionType = "Clean" + + // NodeMemberConditionType tracks whether a node is a member of the cluster. + // Some configurations may use remote nodes or ping nodes, which are nodes that are not members. + // For Two Node OpenShift with Fencing, we expect both nodes to be members. + // When True, the node is a member with reason "Member". This is the normal operating state. + // When False, the node is not a member with reason "NotMember". This is an unexpected state. + NodeMemberConditionType = "Member" + + // NodeFencingAvailableConditionType tracks whether a node can be fenced by at least one fencing agent. + // For Two Node OpenShift with Fencing, each node needs at least one healthy fencing agent to ensure + // that the cluster can recover from a node failure via STONITH (Shoot The Other Node In The Head). + // When True, at least one fencing agent is healthy with reason "FencingAvailable". + // When False, all fencing agents are unhealthy with reason "FencingUnavailable". This is a critical + // state that should degrade the operator. + NodeFencingAvailableConditionType = "FencingAvailable" + + // NodeFencingHealthyConditionType tracks whether all fencing agents for a node are healthy. + // This is an aggregate condition that reflects the health of all fencing agents targeting this node. + // When True, all fencing agents are healthy with reason "FencingHealthy". + // When False, one or more fencing agents are unhealthy with reason "FencingUnhealthy". Warning events + // should be emitted for failing agents, but the operator should not be degraded if FencingAvailable is True. + NodeFencingHealthyConditionType = "FencingHealthy" +) + +// NodeHealthy condition reasons +const ( + // NodeHealthyReasonHealthy means the node is healthy and operating normally. + NodeHealthyReasonHealthy = "NodeHealthy" + + // NodeHealthyReasonUnhealthy means the node has issues that need investigation. + NodeHealthyReasonUnhealthy = "NodeUnhealthy" +) + +// NodeOnline condition reasons +const ( + // NodeOnlineReasonOnline means the node is online. This is the normal operating state. + NodeOnlineReasonOnline = "Online" + + // NodeOnlineReasonOffline means the node is offline. + NodeOnlineReasonOffline = "Offline" +) + +// NodeInService condition reasons +const ( + // NodeInServiceReasonInService means the node is in service (not in maintenance mode). + // This is the normal operating state. + NodeInServiceReasonInService = "InService" + + // NodeInServiceReasonInMaintenance means the node is in maintenance mode. + // This is an unexpected state. + NodeInServiceReasonInMaintenance = "InMaintenance" +) + +// NodeActive condition reasons +const ( + // NodeActiveReasonActive means the node is active (not in standby mode). + // This is the normal operating state. + NodeActiveReasonActive = "Active" + + // NodeActiveReasonStandby means the node is in standby mode. + // This is an unexpected state. + NodeActiveReasonStandby = "Standby" +) + +// NodeReady condition reasons +const ( + // NodeReadyReasonReady means the node is ready (not in a pending state). + // This is the normal operating state. + NodeReadyReasonReady = "Ready" + + // NodeReadyReasonPending means the node is joining or leaving the cluster. + // This state is expected to be temporary. + NodeReadyReasonPending = "Pending" +) + +// NodeClean condition reasons +const ( + // NodeCleanReasonClean means the node is in a clean state. + // This is the normal operating state. + NodeCleanReasonClean = "Clean" + + // NodeCleanReasonUnclean means the node is in an unclean state. + // Pacemaker was unable to confirm the node's state, which signifies issues in fencing, communication, or configuration. + // This is an unexpected state. + NodeCleanReasonUnclean = "Unclean" +) + +// NodeMember condition reasons +const ( + // NodeMemberReasonMember means the node is a member of the cluster. + // For Two Node OpenShift with Fencing, we expect both nodes to be members. This is the normal operating state. + NodeMemberReasonMember = "Member" + + // NodeMemberReasonNotMember means the node is not a member of the cluster. + // This is an unexpected state. + NodeMemberReasonNotMember = "NotMember" +) + +// NodeFencingAvailable condition reasons +const ( + // NodeFencingAvailableReasonAvailable means at least one fencing agent for this node is healthy. + // The cluster can fence this node if needed. This is the normal operating state. + NodeFencingAvailableReasonAvailable = "FencingAvailable" + + // NodeFencingAvailableReasonUnavailable means all fencing agents for this node are unhealthy. + // The cluster cannot fence this node, which compromises high availability. + // This is a critical state that should degrade the operator. + NodeFencingAvailableReasonUnavailable = "FencingUnavailable" +) + +// NodeFencingHealthy condition reasons +const ( + // NodeFencingHealthyReasonHealthy means all fencing agents for this node are healthy. + // This is the ideal operating state with full redundancy. + NodeFencingHealthyReasonHealthy = "FencingHealthy" + + // NodeFencingHealthyReasonUnhealthy means one or more fencing agents for this node are unhealthy. + // Warning events should be emitted for failing agents, but the operator should not be degraded + // if FencingAvailable is still True. + NodeFencingHealthyReasonUnhealthy = "FencingUnhealthy" +) + +// Resource-level condition types for PacemakerCluster.status.nodes[].resources[].conditions +const ( + // ResourceHealthyConditionType tracks the overall health of a pacemaker resource. + // This is an aggregate condition that reflects the health of all resource-level conditions. + // Specifically, it aggregates the following conditions: + // - ResourceInServiceConditionType + // - ResourceManagedConditionType + // - ResourceEnabledConditionType + // - ResourceOperationalConditionType + // - ResourceActiveConditionType + // - ResourceStartedConditionType + // - ResourceSchedulableConditionType + // When True, the resource is healthy with reason "ResourceHealthy". + // When False, the resource is unhealthy with reason "ResourceUnhealthy". + ResourceHealthyConditionType = "Healthy" + + // ResourceInServiceConditionType tracks whether a resource is in service (not in maintenance mode). + // Resources in maintenance mode are not monitored or moved by pacemaker. + // In Two Node OpenShift with Fencing, we do not expect any resources to be in maintenance mode. + // When True, the resource is in service with reason "InService". This is the normal operating state. + // When False, the resource is in maintenance mode with reason "InMaintenance". This is an unexpected state. + ResourceInServiceConditionType = "InService" + + // ResourceManagedConditionType tracks whether a resource is managed by pacemaker. + // Resources that are not managed by pacemaker are effectively invisible to the pacemaker HA logic. + // For Two Node OpenShift with Fencing, all resources are expected to be managed. + // When True, the resource is managed with reason "Managed". This is the normal operating state. + // When False, the resource is not managed with reason "Unmanaged". This is an unexpected state. + ResourceManagedConditionType = "Managed" + + // ResourceEnabledConditionType tracks whether a resource is enabled. + // Resources that are disabled are stopped and not automatically managed or started by the cluster. + // In Two Node OpenShift with Fencing, we do not expect any resources to be disabled. + // When True, the resource is enabled with reason "Enabled". This is the normal operating state. + // When False, the resource is disabled with reason "Disabled". This is an unexpected state. + ResourceEnabledConditionType = "Enabled" + + // ResourceOperationalConditionType tracks whether a resource is operational (not failed). + // A failed resource is one that is not able to start or is in an error state. + // When True, the resource is operational with reason "Operational". This is the normal operating state. + // When False, the resource has failed with reason "Failed". This is an unexpected state. + ResourceOperationalConditionType = "Operational" + + // ResourceActiveConditionType tracks whether a resource is active. + // An active resource is running on a cluster node. + // In Two Node OpenShift with Fencing, all resources are expected to be active. + // When True, the resource is active with reason "Active". This is the normal operating state. + // When False, the resource is not active with reason "Inactive". This is an unexpected state. + ResourceActiveConditionType = "Active" + + // ResourceStartedConditionType tracks whether a resource is started. + // It's normal for a resource like etcd to become stopped in the event of a quorum loss event because + // the pacemaker recovery logic will fence a node and restore etcd quorum on the surviving node as a cluster-of-one. + // A resource that stays stopped for an extended period of time is an unexpected state and should be investigated. + // When True, the resource is started with reason "Started". This is the normal operating state. + // When False, the resource is not started with reason "Stopped". This is expected to be temporary. + ResourceStartedConditionType = "Started" + + // ResourceSchedulableConditionType tracks whether a resource is schedulable (not blocked). + // A resource that is not schedulable is unable to start or move to a different node. + // In Two Node OpenShift with Fencing, we do not expect any resources to be unschedulable. + // When True, the resource is schedulable with reason "Schedulable". This is the normal operating state. + // When False, the resource is not schedulable with reason "Unschedulable". This is an unexpected state. + ResourceSchedulableConditionType = "Schedulable" +) + +// ResourceHealthy condition reasons +const ( + // ResourceHealthyReasonHealthy means the resource is healthy and operating normally. + ResourceHealthyReasonHealthy = "ResourceHealthy" + + // ResourceHealthyReasonUnhealthy means the resource has issues that need investigation. + ResourceHealthyReasonUnhealthy = "ResourceUnhealthy" +) + +// ResourceInService condition reasons +const ( + // ResourceInServiceReasonInService means the resource is in service (not in maintenance mode). + // This is the normal operating state. + ResourceInServiceReasonInService = "InService" + + // ResourceInServiceReasonInMaintenance means the resource is in maintenance mode. + // Resources in maintenance mode are not monitored or moved by pacemaker. This is an unexpected state. + ResourceInServiceReasonInMaintenance = "InMaintenance" +) + +// ResourceManaged condition reasons +const ( + // ResourceManagedReasonManaged means the resource is managed by pacemaker. + // This is the normal operating state. + ResourceManagedReasonManaged = "Managed" + + // ResourceManagedReasonUnmanaged means the resource is not managed by pacemaker. + // Resources that are not managed by pacemaker are effectively invisible to the pacemaker HA logic. + // This is an unexpected state. + ResourceManagedReasonUnmanaged = "Unmanaged" +) + +// ResourceEnabled condition reasons +const ( + // ResourceEnabledReasonEnabled means the resource is enabled. + // This is the normal operating state. + ResourceEnabledReasonEnabled = "Enabled" + + // ResourceEnabledReasonDisabled means the resource is disabled. + // Resources that are disabled are stopped and not automatically managed or started by the cluster. + // This is an unexpected state. + ResourceEnabledReasonDisabled = "Disabled" +) + +// ResourceOperational condition reasons +const ( + // ResourceOperationalReasonOperational means the resource is operational (not failed). + // This is the normal operating state. + ResourceOperationalReasonOperational = "Operational" + + // ResourceOperationalReasonFailed means the resource has failed. + // A failed resource is one that is not able to start or is in an error state. This is an unexpected state. + ResourceOperationalReasonFailed = "Failed" +) + +// ResourceActive condition reasons +const ( + // ResourceActiveReasonActive means the resource is active. + // An active resource is running on a cluster node. This is the normal operating state. + ResourceActiveReasonActive = "Active" + + // ResourceActiveReasonInactive means the resource is not active. + // This is an unexpected state. + ResourceActiveReasonInactive = "Inactive" +) + +// ResourceStarted condition reasons +const ( + // ResourceStartedReasonStarted means the resource is started. + // This is the normal operating state. + ResourceStartedReasonStarted = "Started" + + // ResourceStartedReasonStopped means the resource is stopped. + // It's normal for a resource like etcd to become stopped in the event of a quorum loss event because + // the pacemaker recovery logic will fence a node and restore etcd quorum on the surviving node as a cluster-of-one. + // A resource that stays stopped for an extended period of time is an unexpected state and should be investigated. + ResourceStartedReasonStopped = "Stopped" +) + +// ResourceSchedulable condition reasons +const ( + // ResourceSchedulableReasonSchedulable means the resource is schedulable (not blocked). + // This is the normal operating state. + ResourceSchedulableReasonSchedulable = "Schedulable" + + // ResourceSchedulableReasonUnschedulable means the resource is not schedulable (blocked). + // A resource that is not schedulable is unable to start or move to a different node. This is an unexpected state. + ResourceSchedulableReasonUnschedulable = "Unschedulable" +) + +// PacemakerNodeAddressType represents the type of a node address. +// Currently only InternalIP is supported. +// +kubebuilder:validation:Enum=InternalIP +// +enum +type PacemakerNodeAddressType string + +const ( + // PacemakerNodeInternalIP is an internal IP address assigned to the node. + // This is typically the IP address used for intra-cluster communication. + PacemakerNodeInternalIP PacemakerNodeAddressType = "InternalIP" +) + +// PacemakerNodeAddress contains information for a node's address. +// This is similar to corev1.NodeAddress but adds validation for IP addresses. +type PacemakerNodeAddress struct { + // type is the type of node address. + // Currently only "InternalIP" is supported. + // +required + Type PacemakerNodeAddressType `json:"type,omitempty"` + + // address is the node address. + // For InternalIP, this must be a valid global unicast IPv4 or IPv6 address in canonical form. + // Canonical form means the shortest standard representation (e.g., "192.168.1.1" not "192.168.001.001", + // or "2001:db8::1" not "2001:0db8::1"). Maximum length is 39 characters (full IPv6 address). + // Global unicast includes private/RFC1918 addresses but excludes loopback, link-local, and multicast. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=39 + // +kubebuilder:validation:XValidation:rule="isIP(self) && ip.isCanonical(self) && ip(self).isGlobalUnicast()",message="must be a valid global unicast IPv4 or IPv6 address in canonical form" + // +required + Address string `json:"address,omitempty"` +} + +// PacemakerClusterResourceName represents the name of a pacemaker resource. +// Fencing agents are tracked separately in the fencingAgents field. +// +kubebuilder:validation:Enum=Kubelet;Etcd +// +enum +type PacemakerClusterResourceName string + +// PacemakerClusterResourceName values +const ( + // PacemakerClusterResourceNameKubelet is the kubelet pacemaker resource. + // The kubelet resource is a prerequisite for etcd in Two Node OpenShift with Fencing deployments. + PacemakerClusterResourceNameKubelet PacemakerClusterResourceName = "Kubelet" + + // PacemakerClusterResourceNameEtcd is the etcd pacemaker resource. + // The etcd resource may temporarily transition to stopped during pacemaker quorum-recovery operations. + PacemakerClusterResourceNameEtcd PacemakerClusterResourceName = "Etcd" +) + +// FencingMethod represents the method used by a fencing agent to isolate failed nodes. +// Valid values are "Redfish" and "IPMI". +// +kubebuilder:validation:Enum=Redfish;IPMI +// +enum +type FencingMethod string + +// FencingMethod values +const ( + // FencingMethodRedfish uses Redfish, a standard RESTful API for server management. + FencingMethodRedfish FencingMethod = "Redfish" + + // FencingMethodIPMI uses IPMI (Intelligent Platform Management Interface), a hardware management interface. + FencingMethodIPMI FencingMethod = "IPMI" +) + +// +genclient +// +genclient:nonNamespaced +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// PacemakerCluster represents the current state of the pacemaker cluster as reported by the pcs status command. +// PacemakerCluster is a cluster-scoped singleton resource. The name of this instance is "cluster". This +// resource provides a view into the health and status of a pacemaker-managed cluster in Two Node OpenShift with Fencing deployments. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +// +kubebuilder:object:root=true +// +kubebuilder:resource:path=pacemakerclusters,scope=Cluster,singular=pacemakercluster +// +kubebuilder:subresource:status +// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2544 +// +openshift:file-pattern=cvoRunLevel=0000_25,operatorName=etcd,operatorOrdering=01,operatorComponent=two-node-fencing +// +openshift:enable:FeatureGate=DualReplica +// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="PacemakerCluster must be named 'cluster'" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.status) || has(self.status)",message="status may not be removed once set" +type PacemakerCluster struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +required + metav1.ObjectMeta `json:"metadata,omitempty"` + + // status contains the actual pacemaker cluster status information collected from the cluster. + // The goal of this status is to be able to quickly identify if pacemaker is in a healthy state. + // In Two Node OpenShift with Fencing, a healthy pacemaker cluster has 2 nodes, both of which have healthy kubelet, etcd, and fencing resources. + // This field is optional on creation - the status collector populates it immediately after creating + // the resource via the status subresource. + // +optional + Status PacemakerClusterStatus `json:"status,omitzero"` +} + +// PacemakerClusterStatus contains the actual pacemaker cluster status information. As part of validating the status +// object, we need to ensure that the lastUpdated timestamp may not be set to an earlier timestamp than the current value. +// The validation rule checks if oldSelf has lastUpdated before comparing, to handle the initial status creation case. +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.lastUpdated) || self.lastUpdated >= oldSelf.lastUpdated",message="lastUpdated may not be set to an earlier timestamp" +type PacemakerClusterStatus struct { + // conditions represent the observations of the pacemaker cluster's current state. + // Known condition types are: "Healthy", "InService", "NodeCountAsExpected". + // The "Healthy" condition is an aggregate that tracks the overall health of the cluster. + // The "InService" condition tracks whether the cluster is in service (not in maintenance mode). + // The "NodeCountAsExpected" condition tracks whether the expected number of nodes are present. + // Each of these conditions is required, so the array must contain at least 3 items. + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=3 + // +kubebuilder:validation:MaxItems=8 + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Healthy')",message="conditions must contain a condition of type Healthy" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'InService')",message="conditions must contain a condition of type InService" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'NodeCountAsExpected')",message="conditions must contain a condition of type NodeCountAsExpected" + // +required + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // lastUpdated is the timestamp when this status was last updated. This is useful for identifying + // stale status reports. It must be a valid timestamp in RFC3339 format. Once set, this field cannot + // be removed and cannot be set to an earlier timestamp than the current value. + // +kubebuilder:validation:Format=date-time + // +required + LastUpdated metav1.Time `json:"lastUpdated,omitempty,omitzero"` + + // nodes provides detailed status for each control-plane node in the Pacemaker cluster. + // While Pacemaker supports up to 32 nodes, the limit is set to 5 (max OpenShift control-plane nodes). + // For Two Node OpenShift with Fencing, exactly 2 nodes are expected in a healthy cluster. + // An empty list indicates a catastrophic failure where Pacemaker reports no nodes. + // +listType=map + // +listMapKey=nodeName + // +kubebuilder:validation:MinItems=0 + // +kubebuilder:validation:MaxItems=5 + // +required + Nodes *[]PacemakerClusterNodeStatus `json:"nodes,omitempty"` +} + +// PacemakerClusterNodeStatus represents the status of a single node in the pacemaker cluster including +// the node's conditions and the health of critical resources running on that node. +type PacemakerClusterNodeStatus struct { + // conditions represent the observations of the node's current state. + // Known condition types are: "Healthy", "Online", "InService", "Active", "Ready", "Clean", "Member", + // "FencingAvailable", "FencingHealthy". + // The "Healthy" condition is an aggregate that tracks the overall health of the node. + // The "Online" condition tracks whether the node is online. + // The "InService" condition tracks whether the node is in service (not in maintenance mode). + // The "Active" condition tracks whether the node is active (not in standby mode). + // The "Ready" condition tracks whether the node is ready (not in a pending state). + // The "Clean" condition tracks whether the node is in a clean (status known) state. + // The "Member" condition tracks whether the node is a member of the cluster. + // The "FencingAvailable" condition tracks whether this node can be fenced by at least one healthy agent. + // The "FencingHealthy" condition tracks whether all fencing agents for this node are healthy. + // Each of these conditions is required, so the array must contain at least 9 items. + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=9 + // +kubebuilder:validation:MaxItems=16 + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Healthy')",message="conditions must contain a condition of type Healthy" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Online')",message="conditions must contain a condition of type Online" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'InService')",message="conditions must contain a condition of type InService" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Active')",message="conditions must contain a condition of type Active" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Ready')",message="conditions must contain a condition of type Ready" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Clean')",message="conditions must contain a condition of type Clean" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Member')",message="conditions must contain a condition of type Member" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'FencingAvailable')",message="conditions must contain a condition of type FencingAvailable" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'FencingHealthy')",message="conditions must contain a condition of type FencingHealthy" + // +required + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // nodeName is the name of the node. This is expected to match the Kubernetes node's name, which must be a lowercase + // RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with + // an alphanumeric character, and be at most 253 characters in length. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="nodeName must be a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character" + // +required + NodeName string `json:"nodeName,omitempty"` + + // addresses is a list of IP addresses for the node. + // Pacemaker allows multiple IP addresses for Corosync communication between nodes. + // The first address in this list is used for IP-based peer URLs for etcd membership. + // Each address must be a valid global unicast IPv4 or IPv6 address in canonical form + // (e.g., "192.168.1.1" not "192.168.001.001", or "2001:db8::1" not "2001:0db8::1"). + // This excludes loopback, link-local, and multicast addresses. + // +listType=atomic + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=8 + // +required + Addresses []PacemakerNodeAddress `json:"addresses,omitempty"` + + // resources contains the status of pacemaker resources scheduled on this node. + // Each resource entry includes the resource name and its health conditions. + // For Two Node OpenShift with Fencing, we track Kubelet and Etcd resources per node. + // Both resources are required to be present, so the array must contain at least 2 items. + // Valid resource names are "Kubelet" and "Etcd". + // Fencing agents are tracked separately in the fencingAgents field. + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MinItems=2 + // +kubebuilder:validation:MaxItems=8 + // +kubebuilder:validation:XValidation:rule="self.exists(r, r.name == 'Kubelet')",message="resources must contain a resource named Kubelet" + // +kubebuilder:validation:XValidation:rule="self.exists(r, r.name == 'Etcd')",message="resources must contain a resource named Etcd" + // +required + Resources []PacemakerClusterResourceStatus `json:"resources,omitempty"` + + // fencingAgents contains the status of fencing agents that can fence this node. + // Unlike resources (which are scheduled to run on this node), fencing agents are mapped + // to the node they can fence (their target), not the node where monitoring operations run. + // Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. + // A node is considered fence-capable if at least one fencing agent is healthy. + // A healthy node is expected to have at least 1 fencing agent, but the list may be empty + // when fencing agent discovery fails. + // Names must be unique within this array. + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MinItems=0 + // +kubebuilder:validation:MaxItems=8 + // +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x.name == y.name))",message="fencing agent names must be unique" + // +required + FencingAgents []PacemakerClusterFencingAgentStatus `json:"fencingAgents,omitempty"` +} + +// PacemakerClusterFencingAgentStatus represents the status of a fencing agent that can fence a node. +// Fencing agents are STONITH (Shoot The Other Node In The Head) devices used to isolate failed nodes. +// Unlike regular pacemaker resources, fencing agents are mapped to their target node (the node they +// can fence), not the node where their monitoring operations are scheduled. +type PacemakerClusterFencingAgentStatus struct { + // conditions represent the observations of the fencing agent's current state. + // Known condition types are: "Healthy", "InService", "Managed", "Enabled", "Operational", + // "Active", "Started", "Schedulable". + // The "Healthy" condition is an aggregate that tracks the overall health of the fencing agent. + // The "InService" condition tracks whether the fencing agent is in service (not in maintenance mode). + // The "Managed" condition tracks whether the fencing agent is managed by pacemaker. + // The "Enabled" condition tracks whether the fencing agent is enabled. + // The "Operational" condition tracks whether the fencing agent is operational (not failed). + // The "Active" condition tracks whether the fencing agent is active (available to be used). + // The "Started" condition tracks whether the fencing agent is started. + // The "Schedulable" condition tracks whether the fencing agent is schedulable (not blocked). + // Each of these conditions is required, so the array must contain at least 8 items. + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=8 + // +kubebuilder:validation:MaxItems=16 + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Healthy')",message="conditions must contain a condition of type Healthy" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'InService')",message="conditions must contain a condition of type InService" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Managed')",message="conditions must contain a condition of type Managed" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Enabled')",message="conditions must contain a condition of type Enabled" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Operational')",message="conditions must contain a condition of type Operational" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Active')",message="conditions must contain a condition of type Active" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Started')",message="conditions must contain a condition of type Started" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Schedulable')",message="conditions must contain a condition of type Schedulable" + // +required + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // name is the unique identifier for this fencing agent (e.g., "master-0_redfish"). + // The name must be unique within the fencingAgents array for this node. + // It may contain alphanumeric characters, dots, hyphens, and underscores. + // Maximum length is 300 characters, providing headroom beyond the typical format of + // _ (253 for RFC 1123 node name + 1 underscore + type). + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=300 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+$')",message="name must contain only alphanumeric characters, dots, hyphens, and underscores" + // +required + Name string `json:"name,omitempty"` + + // method is the fencing method used by this agent. + // Valid values are "Redfish" and "IPMI". + // Redfish is a standard RESTful API for server management. + // IPMI (Intelligent Platform Management Interface) is a hardware management interface. + // +required + Method FencingMethod `json:"method,omitempty"` +} + +// PacemakerClusterResourceStatus represents the status of a pacemaker resource scheduled on a node. +// A pacemaker resource is a unit of work managed by pacemaker. In pacemaker terminology, resources are services or +// applications that pacemaker monitors, starts, stops, and moves between nodes to maintain high availability. +// For Two Node OpenShift with Fencing, we track two resources per node: +// - Kubelet (the Kubernetes node agent and a prerequisite for etcd) +// - Etcd (the distributed key-value store) +// +// Fencing agents are tracked separately in the fencingAgents field because they are mapped to +// their target node (the node they can fence), not the node where monitoring operations are scheduled. +type PacemakerClusterResourceStatus struct { + // conditions represent the observations of the resource's current state. + // Known condition types are: "Healthy", "InService", "Managed", "Enabled", "Operational", + // "Active", "Started", "Schedulable". + // The "Healthy" condition is an aggregate that tracks the overall health of the resource. + // The "InService" condition tracks whether the resource is in service (not in maintenance mode). + // The "Managed" condition tracks whether the resource is managed by pacemaker. + // The "Enabled" condition tracks whether the resource is enabled. + // The "Operational" condition tracks whether the resource is operational (not failed). + // The "Active" condition tracks whether the resource is active (available to be used). + // The "Started" condition tracks whether the resource is started. + // The "Schedulable" condition tracks whether the resource is schedulable (not blocked). + // Each of these conditions is required, so the array must contain at least 8 items. + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=8 + // +kubebuilder:validation:MaxItems=16 + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Healthy')",message="conditions must contain a condition of type Healthy" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'InService')",message="conditions must contain a condition of type InService" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Managed')",message="conditions must contain a condition of type Managed" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Enabled')",message="conditions must contain a condition of type Enabled" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Operational')",message="conditions must contain a condition of type Operational" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Active')",message="conditions must contain a condition of type Active" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Started')",message="conditions must contain a condition of type Started" + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'Schedulable')",message="conditions must contain a condition of type Schedulable" + // +required + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // name is the name of the pacemaker resource. + // Valid values are "Kubelet" and "Etcd". + // The Kubelet resource is a prerequisite for etcd in Two Node OpenShift with Fencing deployments. + // The Etcd resource may temporarily transition to stopped during pacemaker quorum-recovery operations. + // Fencing agents are tracked separately in the node's fencingAgents field. + // +required + Name PacemakerClusterResourceName `json:"name,omitempty"` +} + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// PacemakerClusterList contains a list of PacemakerCluster objects. PacemakerCluster is a cluster-scoped singleton +// resource; only one instance named "cluster" may exist. This list type exists only to satisfy Kubernetes API +// conventions. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +type PacemakerClusterList struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard list's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + metav1.ListMeta `json:"metadata,omitempty"` + + // items is a list of PacemakerCluster objects. + Items []PacemakerCluster `json:"items"` +} diff --git a/vendor/github.com/openshift/api/etcd/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/etcd/v1/zz_generated.deepcopy.go new file mode 100644 index 0000000000..c529240e40 --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/zz_generated.deepcopy.go @@ -0,0 +1,210 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by codegen. DO NOT EDIT. + +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerCluster) DeepCopyInto(out *PacemakerCluster) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Status.DeepCopyInto(&out.Status) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerCluster. +func (in *PacemakerCluster) DeepCopy() *PacemakerCluster { + if in == nil { + return nil + } + out := new(PacemakerCluster) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *PacemakerCluster) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerClusterFencingAgentStatus) DeepCopyInto(out *PacemakerClusterFencingAgentStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerClusterFencingAgentStatus. +func (in *PacemakerClusterFencingAgentStatus) DeepCopy() *PacemakerClusterFencingAgentStatus { + if in == nil { + return nil + } + out := new(PacemakerClusterFencingAgentStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerClusterList) DeepCopyInto(out *PacemakerClusterList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]PacemakerCluster, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerClusterList. +func (in *PacemakerClusterList) DeepCopy() *PacemakerClusterList { + if in == nil { + return nil + } + out := new(PacemakerClusterList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *PacemakerClusterList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerClusterNodeStatus) DeepCopyInto(out *PacemakerClusterNodeStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Addresses != nil { + in, out := &in.Addresses, &out.Addresses + *out = make([]PacemakerNodeAddress, len(*in)) + copy(*out, *in) + } + if in.Resources != nil { + in, out := &in.Resources, &out.Resources + *out = make([]PacemakerClusterResourceStatus, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.FencingAgents != nil { + in, out := &in.FencingAgents, &out.FencingAgents + *out = make([]PacemakerClusterFencingAgentStatus, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerClusterNodeStatus. +func (in *PacemakerClusterNodeStatus) DeepCopy() *PacemakerClusterNodeStatus { + if in == nil { + return nil + } + out := new(PacemakerClusterNodeStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerClusterResourceStatus) DeepCopyInto(out *PacemakerClusterResourceStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerClusterResourceStatus. +func (in *PacemakerClusterResourceStatus) DeepCopy() *PacemakerClusterResourceStatus { + if in == nil { + return nil + } + out := new(PacemakerClusterResourceStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerClusterStatus) DeepCopyInto(out *PacemakerClusterStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + in.LastUpdated.DeepCopyInto(&out.LastUpdated) + if in.Nodes != nil { + in, out := &in.Nodes, &out.Nodes + *out = new([]PacemakerClusterNodeStatus) + if **in != nil { + in, out := *in, *out + *out = make([]PacemakerClusterNodeStatus, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerClusterStatus. +func (in *PacemakerClusterStatus) DeepCopy() *PacemakerClusterStatus { + if in == nil { + return nil + } + out := new(PacemakerClusterStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PacemakerNodeAddress) DeepCopyInto(out *PacemakerNodeAddress) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacemakerNodeAddress. +func (in *PacemakerNodeAddress) DeepCopy() *PacemakerNodeAddress { + if in == nil { + return nil + } + out := new(PacemakerNodeAddress) + in.DeepCopyInto(out) + return out +} diff --git a/vendor/github.com/openshift/api/etcd/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/etcd/v1/zz_generated.featuregated-crd-manifests.yaml new file mode 100644 index 0000000000..1a11a877c4 --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/zz_generated.featuregated-crd-manifests.yaml @@ -0,0 +1,23 @@ +pacemakerclusters.etcd.openshift.io: + Annotations: {} + ApprovedPRNumber: https://github.com/openshift/api/pull/2544 + CRDName: pacemakerclusters.etcd.openshift.io + Capability: "" + Category: "" + FeatureGates: + - DualReplica + FilenameOperatorName: etcd + FilenameOperatorOrdering: "01" + FilenameRunLevel: "0000_25" + GroupName: etcd.openshift.io + HasStatus: true + KindName: PacemakerCluster + Labels: {} + PluralName: pacemakerclusters + PrinterColumns: [] + Scope: Cluster + ShortNames: null + TopLevelFeatureGates: + - DualReplica + Version: v1 + diff --git a/vendor/github.com/openshift/api/etcd/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/etcd/v1/zz_generated.swagger_doc_generated.go new file mode 100644 index 0000000000..e9e47b47cf --- /dev/null +++ b/vendor/github.com/openshift/api/etcd/v1/zz_generated.swagger_doc_generated.go @@ -0,0 +1,89 @@ +package v1 + +// This file contains a collection of methods that can be used from go-restful to +// generate Swagger API documentation for its models. Please read this PR for more +// information on the implementation: https://github.com/emicklei/go-restful/pull/215 +// +// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if +// they are on one line! For multiple line or blocks that you want to ignore use ---. +// Any context after a --- is ignored. +// +// Those methods can be generated by using hack/update-swagger-docs.sh + +// AUTO-GENERATED FUNCTIONS START HERE +var map_PacemakerCluster = map[string]string{ + "": "PacemakerCluster represents the current state of the pacemaker cluster as reported by the pcs status command. PacemakerCluster is a cluster-scoped singleton resource. The name of this instance is \"cluster\". This resource provides a view into the health and status of a pacemaker-managed cluster in Two Node OpenShift with Fencing deployments.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "status": "status contains the actual pacemaker cluster status information collected from the cluster. The goal of this status is to be able to quickly identify if pacemaker is in a healthy state. In Two Node OpenShift with Fencing, a healthy pacemaker cluster has 2 nodes, both of which have healthy kubelet, etcd, and fencing resources. This field is optional on creation - the status collector populates it immediately after creating the resource via the status subresource.", +} + +func (PacemakerCluster) SwaggerDoc() map[string]string { + return map_PacemakerCluster +} + +var map_PacemakerClusterFencingAgentStatus = map[string]string{ + "": "PacemakerClusterFencingAgentStatus represents the status of a fencing agent that can fence a node. Fencing agents are STONITH (Shoot The Other Node In The Head) devices used to isolate failed nodes. Unlike regular pacemaker resources, fencing agents are mapped to their target node (the node they can fence), not the node where their monitoring operations are scheduled.", + "conditions": "conditions represent the observations of the fencing agent's current state. Known condition types are: \"Healthy\", \"InService\", \"Managed\", \"Enabled\", \"Operational\", \"Active\", \"Started\", \"Schedulable\". The \"Healthy\" condition is an aggregate that tracks the overall health of the fencing agent. The \"InService\" condition tracks whether the fencing agent is in service (not in maintenance mode). The \"Managed\" condition tracks whether the fencing agent is managed by pacemaker. The \"Enabled\" condition tracks whether the fencing agent is enabled. The \"Operational\" condition tracks whether the fencing agent is operational (not failed). The \"Active\" condition tracks whether the fencing agent is active (available to be used). The \"Started\" condition tracks whether the fencing agent is started. The \"Schedulable\" condition tracks whether the fencing agent is schedulable (not blocked). Each of these conditions is required, so the array must contain at least 8 items.", + "name": "name is the unique identifier for this fencing agent (e.g., \"master-0_redfish\"). The name must be unique within the fencingAgents array for this node. It may contain alphanumeric characters, dots, hyphens, and underscores. Maximum length is 300 characters, providing headroom beyond the typical format of _ (253 for RFC 1123 node name + 1 underscore + type).", + "method": "method is the fencing method used by this agent. Valid values are \"Redfish\" and \"IPMI\". Redfish is a standard RESTful API for server management. IPMI (Intelligent Platform Management Interface) is a hardware management interface.", +} + +func (PacemakerClusterFencingAgentStatus) SwaggerDoc() map[string]string { + return map_PacemakerClusterFencingAgentStatus +} + +var map_PacemakerClusterList = map[string]string{ + "": "PacemakerClusterList contains a list of PacemakerCluster objects. PacemakerCluster is a cluster-scoped singleton resource; only one instance named \"cluster\" may exist. This list type exists only to satisfy Kubernetes API conventions.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of PacemakerCluster objects.", +} + +func (PacemakerClusterList) SwaggerDoc() map[string]string { + return map_PacemakerClusterList +} + +var map_PacemakerClusterNodeStatus = map[string]string{ + "": "PacemakerClusterNodeStatus represents the status of a single node in the pacemaker cluster including the node's conditions and the health of critical resources running on that node.", + "conditions": "conditions represent the observations of the node's current state. Known condition types are: \"Healthy\", \"Online\", \"InService\", \"Active\", \"Ready\", \"Clean\", \"Member\", \"FencingAvailable\", \"FencingHealthy\". The \"Healthy\" condition is an aggregate that tracks the overall health of the node. The \"Online\" condition tracks whether the node is online. The \"InService\" condition tracks whether the node is in service (not in maintenance mode). The \"Active\" condition tracks whether the node is active (not in standby mode). The \"Ready\" condition tracks whether the node is ready (not in a pending state). The \"Clean\" condition tracks whether the node is in a clean (status known) state. The \"Member\" condition tracks whether the node is a member of the cluster. The \"FencingAvailable\" condition tracks whether this node can be fenced by at least one healthy agent. The \"FencingHealthy\" condition tracks whether all fencing agents for this node are healthy. Each of these conditions is required, so the array must contain at least 9 items.", + "nodeName": "nodeName is the name of the node. This is expected to match the Kubernetes node's name, which must be a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.", + "addresses": "addresses is a list of IP addresses for the node. Pacemaker allows multiple IP addresses for Corosync communication between nodes. The first address in this list is used for IP-based peer URLs for etcd membership. Each address must be a valid global unicast IPv4 or IPv6 address in canonical form (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). This excludes loopback, link-local, and multicast addresses.", + "resources": "resources contains the status of pacemaker resources scheduled on this node. Each resource entry includes the resource name and its health conditions. For Two Node OpenShift with Fencing, we track Kubelet and Etcd resources per node. Both resources are required to be present, so the array must contain at least 2 items. Valid resource names are \"Kubelet\" and \"Etcd\". Fencing agents are tracked separately in the fencingAgents field.", + "fencingAgents": "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. A healthy node is expected to have at least 1 fencing agent, but the list may be empty when fencing agent discovery fails. Names must be unique within this array.", +} + +func (PacemakerClusterNodeStatus) SwaggerDoc() map[string]string { + return map_PacemakerClusterNodeStatus +} + +var map_PacemakerClusterResourceStatus = map[string]string{ + "": "PacemakerClusterResourceStatus represents the status of a pacemaker resource scheduled on a node. A pacemaker resource is a unit of work managed by pacemaker. In pacemaker terminology, resources are services or applications that pacemaker monitors, starts, stops, and moves between nodes to maintain high availability. For Two Node OpenShift with Fencing, we track two resources per node:\n - Kubelet (the Kubernetes node agent and a prerequisite for etcd)\n - Etcd (the distributed key-value store)\n\nFencing agents are tracked separately in the fencingAgents field because they are mapped to their target node (the node they can fence), not the node where monitoring operations are scheduled.", + "conditions": "conditions represent the observations of the resource's current state. Known condition types are: \"Healthy\", \"InService\", \"Managed\", \"Enabled\", \"Operational\", \"Active\", \"Started\", \"Schedulable\". The \"Healthy\" condition is an aggregate that tracks the overall health of the resource. The \"InService\" condition tracks whether the resource is in service (not in maintenance mode). The \"Managed\" condition tracks whether the resource is managed by pacemaker. The \"Enabled\" condition tracks whether the resource is enabled. The \"Operational\" condition tracks whether the resource is operational (not failed). The \"Active\" condition tracks whether the resource is active (available to be used). The \"Started\" condition tracks whether the resource is started. The \"Schedulable\" condition tracks whether the resource is schedulable (not blocked). Each of these conditions is required, so the array must contain at least 8 items.", + "name": "name is the name of the pacemaker resource. Valid values are \"Kubelet\" and \"Etcd\". The Kubelet resource is a prerequisite for etcd in Two Node OpenShift with Fencing deployments. The Etcd resource may temporarily transition to stopped during pacemaker quorum-recovery operations. Fencing agents are tracked separately in the node's fencingAgents field.", +} + +func (PacemakerClusterResourceStatus) SwaggerDoc() map[string]string { + return map_PacemakerClusterResourceStatus +} + +var map_PacemakerClusterStatus = map[string]string{ + "": "PacemakerClusterStatus contains the actual pacemaker cluster status information. As part of validating the status object, we need to ensure that the lastUpdated timestamp may not be set to an earlier timestamp than the current value. The validation rule checks if oldSelf has lastUpdated before comparing, to handle the initial status creation case.", + "conditions": "conditions represent the observations of the pacemaker cluster's current state. Known condition types are: \"Healthy\", \"InService\", \"NodeCountAsExpected\". The \"Healthy\" condition is an aggregate that tracks the overall health of the cluster. The \"InService\" condition tracks whether the cluster is in service (not in maintenance mode). The \"NodeCountAsExpected\" condition tracks whether the expected number of nodes are present. Each of these conditions is required, so the array must contain at least 3 items.", + "lastUpdated": "lastUpdated is the timestamp when this status was last updated. This is useful for identifying stale status reports. It must be a valid timestamp in RFC3339 format. Once set, this field cannot be removed and cannot be set to an earlier timestamp than the current value.", + "nodes": "nodes provides detailed status for each control-plane node in the Pacemaker cluster. While Pacemaker supports up to 32 nodes, the limit is set to 5 (max OpenShift control-plane nodes). For Two Node OpenShift with Fencing, exactly 2 nodes are expected in a healthy cluster. An empty list indicates a catastrophic failure where Pacemaker reports no nodes.", +} + +func (PacemakerClusterStatus) SwaggerDoc() map[string]string { + return map_PacemakerClusterStatus +} + +var map_PacemakerNodeAddress = map[string]string{ + "": "PacemakerNodeAddress contains information for a node's address. This is similar to corev1.NodeAddress but adds validation for IP addresses.", + "type": "type is the type of node address. Currently only \"InternalIP\" is supported.", + "address": "address is the node address. For InternalIP, this must be a valid global unicast IPv4 or IPv6 address in canonical form. Canonical form means the shortest standard representation (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). Maximum length is 39 characters (full IPv6 address). Global unicast includes private/RFC1918 addresses but excludes loopback, link-local, and multicast.", +} + +func (PacemakerNodeAddress) SwaggerDoc() map[string]string { + return map_PacemakerNodeAddress +} + +// AUTO-GENERATED FUNCTIONS END HERE diff --git a/vendor/github.com/openshift/api/etcd/v1alpha1/types_pacemakercluster.go b/vendor/github.com/openshift/api/etcd/v1alpha1/types_pacemakercluster.go index ab06d0e390..b627413474 100644 --- a/vendor/github.com/openshift/api/etcd/v1alpha1/types_pacemakercluster.go +++ b/vendor/github.com/openshift/api/etcd/v1alpha1/types_pacemakercluster.go @@ -609,11 +609,12 @@ type PacemakerClusterNodeStatus struct { // to the node they can fence (their target), not the node where monitoring operations run. // Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. // A node is considered fence-capable if at least one fencing agent is healthy. - // Expected to have 1 fencing agent per node, but up to 8 are supported for redundancy. + // A healthy node is expected to have at least 1 fencing agent, but the list may be empty + // when fencing agent discovery fails. // Names must be unique within this array. // +listType=map // +listMapKey=name - // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MinItems=0 // +kubebuilder:validation:MaxItems=8 // +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x.name == y.name))",message="fencing agent names must be unique" // +required diff --git a/vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.swagger_doc_generated.go index 62e1c3ebd7..dc6f224288 100644 --- a/vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.swagger_doc_generated.go @@ -48,7 +48,7 @@ var map_PacemakerClusterNodeStatus = map[string]string{ "nodeName": "nodeName is the name of the node. This is expected to match the Kubernetes node's name, which must be a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.", "addresses": "addresses is a list of IP addresses for the node. Pacemaker allows multiple IP addresses for Corosync communication between nodes. The first address in this list is used for IP-based peer URLs for etcd membership. Each address must be a valid global unicast IPv4 or IPv6 address in canonical form (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). This excludes loopback, link-local, and multicast addresses.", "resources": "resources contains the status of pacemaker resources scheduled on this node. Each resource entry includes the resource name and its health conditions. For Two Node OpenShift with Fencing, we track Kubelet and Etcd resources per node. Both resources are required to be present, so the array must contain at least 2 items. Valid resource names are \"Kubelet\" and \"Etcd\". Fencing agents are tracked separately in the fencingAgents field.", - "fencingAgents": "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. Expected to have 1 fencing agent per node, but up to 8 are supported for redundancy. Names must be unique within this array.", + "fencingAgents": "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. A healthy node is expected to have at least 1 fencing agent, but the list may be empty when fencing agent discovery fails. Names must be unique within this array.", } func (PacemakerClusterNodeStatus) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/features.md b/vendor/github.com/openshift/api/features.md index 45074e6497..8112c57f72 100644 --- a/vendor/github.com/openshift/api/features.md +++ b/vendor/github.com/openshift/api/features.md @@ -8,6 +8,8 @@ | ShortCertRotation| | | | | | | | | | ClusterAPIComputeInstall| | | Enabled | Enabled | | | | | | ClusterAPIControlPlaneInstall| | | Enabled | Enabled | | | | | +| ClusterUpdatePreflight| | | Enabled | Enabled | | | | | +| ConfidentialCluster| | | Enabled | Enabled | | | | | | Example2| | | Enabled | Enabled | | | | | | ExternalOIDCExternalClaimsSourcing| | | Enabled | Enabled | | | | | | ExternalSnapshotMetadata| | | Enabled | Enabled | | | | | @@ -16,21 +18,22 @@ | NetworkConnect| | | Enabled | Enabled | | | | | | NewOLMBoxCutterRuntime| | | | Enabled | | | | Enabled | | NewOLMCatalogdAPIV1Metas| | | | Enabled | | | | Enabled | +| NewOLMConfigAPI| | | | Enabled | | | | Enabled | +| NewOLMOwnSingleNamespace| | | | Enabled | | | | Enabled | | NewOLMPreflightPermissionChecks| | | | Enabled | | | | Enabled | | NoRegistryClusterInstall| | | | Enabled | | | | Enabled | | ProvisioningRequestAvailable| | | Enabled | Enabled | | | | | +| VSphereMultiVCenterDay2| | | Enabled | Enabled | | | | | | AWSClusterHostedDNS| | | Enabled | Enabled | | | Enabled | Enabled | | AWSClusterHostedDNSInstall| | | Enabled | Enabled | | | Enabled | Enabled | | AWSDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled | | AWSDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | -| AWSServiceLBNetworkSecurityGroup| | | Enabled | Enabled | | | Enabled | Enabled | +| AWSEuropeanSovereignCloudInstall| | | Enabled | Enabled | | | Enabled | Enabled | | AdditionalStorageConfig| | | Enabled | Enabled | | | Enabled | Enabled | | AutomatedEtcdBackup| | | Enabled | Enabled | | | Enabled | Enabled | -| AzureClusterHostedDNSInstall| | | Enabled | Enabled | | | Enabled | Enabled | | AzureDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled | | AzureDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | | AzureMultiDisk| | | Enabled | Enabled | | | Enabled | Enabled | -| BootImageSkewEnforcement| | | Enabled | Enabled | | | Enabled | Enabled | | BootcNodeManagement| | | Enabled | Enabled | | | Enabled | Enabled | | CBORServingAndStorage| | | Enabled | Enabled | | | Enabled | Enabled | | CRDCompatibilityRequirementOperator| | | Enabled | Enabled | | | Enabled | Enabled | @@ -51,18 +54,14 @@ | ConfigurablePKI| | | Enabled | Enabled | | | Enabled | Enabled | | DNSNameResolver| | | Enabled | Enabled | | | Enabled | Enabled | | DRAPartitionableDevices| | | Enabled | Enabled | | | Enabled | Enabled | -| DualReplica| | | Enabled | Enabled | | | Enabled | Enabled | | DyanmicServiceEndpointIBMCloud| | | Enabled | Enabled | | | Enabled | Enabled | | EVPN| | | Enabled | Enabled | | | Enabled | Enabled | | EtcdBackendQuota| | | Enabled | Enabled | | | Enabled | Enabled | -| EventTTL| | | Enabled | Enabled | | | Enabled | Enabled | | Example| | | Enabled | Enabled | | | Enabled | Enabled | | ExternalOIDCWithUpstreamParity| | | Enabled | Enabled | | | Enabled | Enabled | -| GCPClusterHostedDNS| | | Enabled | Enabled | | | Enabled | Enabled | | GCPCustomAPIEndpoints| | | Enabled | Enabled | | | Enabled | Enabled | | GCPCustomAPIEndpointsInstall| | | Enabled | Enabled | | | Enabled | Enabled | | GCPDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | -| GatewayAPIWithoutOLM| | | Enabled | Enabled | | | Enabled | Enabled | | HyperShiftOnlyDynamicResourceAllocation| Enabled | | Enabled | | Enabled | | Enabled | | | ImageModeStatusReporting| | | Enabled | Enabled | | | Enabled | Enabled | | IngressControllerDynamicConfigurationManager| | | Enabled | Enabled | | | Enabled | Enabled | @@ -77,42 +76,37 @@ | MultiDiskSetup| | | Enabled | Enabled | | | Enabled | Enabled | | MutatingAdmissionPolicy| | | Enabled | Enabled | | | Enabled | Enabled | | NewOLM| | Enabled | | Enabled | | Enabled | | Enabled | -| NewOLMOwnSingleNamespace| | Enabled | | Enabled | | Enabled | | Enabled | | NewOLMWebhookProviderOpenshiftServiceCA| | Enabled | | Enabled | | Enabled | | Enabled | +| NoOverlayMode| | | Enabled | Enabled | | | Enabled | Enabled | | NutanixMultiSubnets| | | Enabled | Enabled | | | Enabled | Enabled | | OSStreams| | | Enabled | Enabled | | | Enabled | Enabled | | OVNObservability| | | Enabled | Enabled | | | Enabled | Enabled | | OnPremDNSRecords| | | Enabled | Enabled | | | Enabled | Enabled | | SELinuxMount| | | Enabled | Enabled | | | Enabled | Enabled | | SignatureStores| | | Enabled | Enabled | | | Enabled | Enabled | +| TLSAdherence| | | Enabled | Enabled | | | Enabled | Enabled | | VSphereConfigurableMaxAllowedBlockVolumesPerNode| | | Enabled | Enabled | | | Enabled | Enabled | -| VSphereHostVMGroupZonal| | | Enabled | Enabled | | | Enabled | Enabled | | VSphereMixedNodeEnv| | | Enabled | Enabled | | | Enabled | Enabled | | VolumeGroupSnapshot| | | Enabled | Enabled | | | Enabled | Enabled | +| AWSServiceLBNetworkSecurityGroup| | Enabled | Enabled | Enabled | | Enabled | Enabled | Enabled | +| AzureClusterHostedDNSInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AzureWorkloadIdentity| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| BootImageSkewEnforcement| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | BuildCSIVolumes| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ConsolePluginContentSecurityPolicy| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| DualReplica| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| EventTTL| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ExternalOIDC| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ExternalOIDCWithUIDAndExtraClaimMappings| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| GCPClusterHostedDNSInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| GatewayAPI| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| GatewayAPIController| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| HighlyAvailableArbiter| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| GatewayAPIWithoutOLM| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ImageStreamImportMode| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| ImageVolume| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsOnDemandDataGather| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | KMSv1| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| MachineConfigNodes| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| ManagedBootImages| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| ManagedBootImagesAWS| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| ManagedBootImagesAzure| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ManagedBootImagesCPMS| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| ManagedBootImagesvSphere| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MetricsCollectionProfiles| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MutableCSINodeAllocatableCount| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | OpenShiftPodSecurityAdmission| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| PinnedImages| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | RouteExternalCertificate| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ServiceAccountTokenNodeBinding| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SigstoreImageVerification| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | @@ -121,5 +115,6 @@ | UpgradeStatus| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | UserNamespacesPodSecurityStandards| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | UserNamespacesSupport| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| VSphereHostVMGroupZonal| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | VSphereMultiDisk| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | VSphereMultiNetworks| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/vendor/github.com/openshift/api/features/features.go b/vendor/github.com/openshift/api/features/features.go index 96152dba36..5d148165cc 100644 --- a/vendor/github.com/openshift/api/features/features.go +++ b/vendor/github.com/openshift/api/features/features.go @@ -99,14 +99,6 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateGatewayAPI = newFeatureGate("GatewayAPI"). - reportProblemsToJiraComponent("Routing"). - contactPerson("miciah"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateOpenShiftPodSecurityAdmission = newFeatureGate("OpenShiftPodSecurityAdmission"). reportProblemsToJiraComponent("auth"). contactPerson("ibihim"). @@ -183,7 +175,7 @@ var ( contactPerson("jcpowermac"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1677"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateVSphereMultiDisk = newFeatureGate("VSphereMultiDisk"). @@ -210,6 +202,14 @@ var ( enable(inDevPreviewNoUpgrade()). mustRegister() + FeatureGateNoOverlayMode = newFeatureGate("NoOverlayMode"). + reportProblemsToJiraComponent("Networking/ovn-kubernetes"). + contactPerson("pliurh"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1859"). + enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + mustRegister() + FeatureGateEVPN = newFeatureGate("EVPN"). reportProblemsToJiraComponent("Networking/ovn-kubernetes"). contactPerson("jcaamano"). @@ -257,14 +257,6 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateMachineConfigNodes = newFeatureGate("MachineConfigNodes"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("ijanssen"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1765"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateImageModeStatusReporting = newFeatureGate("ImageModeStatusReporting"). reportProblemsToJiraComponent("MachineConfigOperator"). contactPerson("ijanssen"). @@ -280,14 +272,6 @@ var ( enhancementPR(legacyFeatureGateWithoutEnhancement). mustRegister() - FeatureGateGCPClusterHostedDNS = newFeatureGate("GCPClusterHostedDNS"). - reportProblemsToJiraComponent("Installer"). - contactPerson("barbacbd"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateAWSClusterHostedDNS = newFeatureGate("AWSClusterHostedDNS"). reportProblemsToJiraComponent("Installer"). contactPerson("barbacbd"). @@ -301,7 +285,7 @@ var ( contactPerson("sadasu"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1468"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateMixedCPUsAllocation = newFeatureGate("MixedCPUsAllocation"). @@ -312,38 +296,6 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateManagedBootImages = newFeatureGate("ManagedBootImages"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("djoshy"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - - FeatureGateManagedBootImagesAWS = newFeatureGate("ManagedBootImagesAWS"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("djoshy"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - - FeatureGateManagedBootImagesvSphere = newFeatureGate("ManagedBootImagesvSphere"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("rsaini"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1496"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - - FeatureGateManagedBootImagesAzure = newFeatureGate("ManagedBootImagesAzure"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("djoshy"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1761"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateManagedBootImagesCPMS = newFeatureGate("ManagedBootImagesCPMS"). reportProblemsToJiraComponent("MachineConfigOperator"). contactPerson("djoshy"). @@ -357,7 +309,7 @@ var ( contactPerson("djoshy"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1761"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateBootcNodeManagement = newFeatureGate("BootcNodeManagement"). @@ -384,14 +336,6 @@ var ( enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGatePinnedImages = newFeatureGate("PinnedImages"). - reportProblemsToJiraComponent("MachineConfigOperator"). - contactPerson("RishabhSaini"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateAdditionalStorageConfig = newFeatureGate("AdditionalStorageConfig"). reportProblemsToJiraComponent("node"). contactPerson("saschagrunert"). @@ -501,7 +445,7 @@ var ( contactPerson("nschieder"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1849"). - enable(inClusterProfile(SelfManaged), inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateNewOLMWebhookProviderOpenshiftServiceCA = newFeatureGate("NewOLMWebhookProviderOpenshiftServiceCA"). @@ -520,6 +464,14 @@ var ( enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() + FeatureGateNewOLMConfigAPI = newFeatureGate("NewOLMConfigAPI"). + reportProblemsToJiraComponent("olm"). + contactPerson("tmshort"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1915"). + enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + mustRegister() + FeatureGateInsightsOnDemandDataGather = newFeatureGate("InsightsOnDemandDataGather"). reportProblemsToJiraComponent("insights"). contactPerson("tremes"). @@ -737,14 +689,6 @@ var ( enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() - FeatureGateHighlyAvailableArbiter = newFeatureGate("HighlyAvailableArbiter"). - reportProblemsToJiraComponent("Two Node with Arbiter"). - contactPerson("eggfoobar"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1674"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateCVOConfiguration = newFeatureGate("ClusterVersionOperatorConfiguration"). reportProblemsToJiraComponent("Cluster Version Operator"). contactPerson("dhurta"). @@ -761,6 +705,14 @@ var ( enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() + FeatureGateClusterUpdatePreflight = newFeatureGate("ClusterUpdatePreflight"). + reportProblemsToJiraComponent("Cluster Version Operator"). + contactPerson("fao89"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1930"). + enable(inDevPreviewNoUpgrade()). + mustRegister() + FeatureGateGCPCustomAPIEndpoints = newFeatureGate("GCPCustomAPIEndpoints"). reportProblemsToJiraComponent("Installer"). contactPerson("barbacbd"). @@ -790,22 +742,9 @@ var ( contactPerson("jaypoulz"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1675"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateGatewayAPIController = newFeatureGate("GatewayAPIController"). - reportProblemsToJiraComponent("Routing"). - contactPerson("miciah"). - productScope(ocpSpecific). - // Previously, the "GatewayAPI" feature gate managed both the GatewayAPI CRDs - // and the Gateway Controller. However, with the introduction of Gateway CRD - // lifecycle management (EP#1756), these responsibilities were separated. - // A dedicated feature gate now controls the Gateway Controller to distinguish - // its production readiness from that of the CRDs. - enhancementPR("https://github.com/openshift/enhancements/pull/1756"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureShortCertRotation = newFeatureGate("ShortCertRotation"). reportProblemsToJiraComponent("kube-apiserver"). contactPerson("vrutkovs"). @@ -861,22 +800,23 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() + FeatureGateVSphereMultiVCenterDay2 = newFeatureGate("VSphereMultiVCenterDay2"). + reportProblemsToJiraComponent("splat"). + contactPerson("vr4manta"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1961"). + enable(inDevPreviewNoUpgrade()). + mustRegister() + FeatureGateAWSServiceLBNetworkSecurityGroup = newFeatureGate("AWSServiceLBNetworkSecurityGroup"). reportProblemsToJiraComponent("Cloud Compute / Cloud Controller Manager"). contactPerson("mtulio"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1802"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inClusterProfile(SelfManaged), inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inClusterProfile(Hypershift), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateImageVolume = newFeatureGate("ImageVolume"). - reportProblemsToJiraComponent("Node"). - contactPerson("haircommander"). - productScope(kubernetes). - enhancementPR("https://github.com/openshift/enhancements/pull/1792"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateNoRegistryClusterInstall = newFeatureGate("NoRegistryClusterInstall"). reportProblemsToJiraComponent("Installer / Agent based installation"). contactPerson("andfasano"). @@ -885,14 +825,6 @@ var ( enable(inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateGCPClusterHostedDNSInstall = newFeatureGate("GCPClusterHostedDNSInstall"). - reportProblemsToJiraComponent("Installer"). - contactPerson("barbacbd"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1468"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateAWSClusterHostedDNSInstall = newFeatureGate("AWSClusterHostedDNSInstall"). reportProblemsToJiraComponent("Installer"). contactPerson("barbacbd"). @@ -968,7 +900,7 @@ var ( contactPerson("tjungblu"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1857"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateMutableCSINodeAllocatableCount = newFeatureGate("MutableCSINodeAllocatableCount"). @@ -1049,11 +981,35 @@ var ( enable(inDevPreviewNoUpgrade()). mustRegister() + FeatureGateAWSEuropeanSovereignCloudInstall = newFeatureGate("AWSEuropeanSovereignCloudInstall"). + reportProblemsToJiraComponent("Installer / openshift-installer"). + contactPerson("tthvo"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1952"). + enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + mustRegister() + FeatureGateGatewayAPIWithoutOLM = newFeatureGate("GatewayAPIWithoutOLM"). reportProblemsToJiraComponent("Routing"). contactPerson("miciah"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1933"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() + + FeatureGateTLSAdherence = newFeatureGate("TLSAdherence"). + reportProblemsToJiraComponent("HPCASE / TLS Adherence"). + contactPerson("joelanford"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1910"). + enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + mustRegister() + + FeatureGateConfidentialCluster = newFeatureGate("ConfidentialCluster"). + reportProblemsToJiraComponent("ConfidentialClusters"). + contactPerson("fjin"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1962"). + enable(inDevPreviewNoUpgrade()). + mustRegister() ) diff --git a/vendor/github.com/openshift/api/features/legacyfeaturegates.go b/vendor/github.com/openshift/api/features/legacyfeaturegates.go index a92c0b9bb9..a82089b9f7 100644 --- a/vendor/github.com/openshift/api/features/legacyfeaturegates.go +++ b/vendor/github.com/openshift/api/features/legacyfeaturegates.go @@ -33,8 +33,6 @@ var legacyFeatureGates = sets.New( // never add to this list, if you think you have an exception ask @deads2k "GCPClusterHostedDNS", // never add to this list, if you think you have an exception ask @deads2k - "GatewayAPI", - // never add to this list, if you think you have an exception ask @deads2k "HardwareSpeed", // never add to this list, if you think you have an exception ask @deads2k "ImageStreamImportMode", diff --git a/vendor/github.com/openshift/api/openapi/generated_openapi/zz_generated.openapi.go b/vendor/github.com/openshift/api/openapi/generated_openapi/zz_generated.openapi.go index f9f998b2e5..e8003aa02c 100644 --- a/vendor/github.com/openshift/api/openapi/generated_openapi/zz_generated.openapi.go +++ b/vendor/github.com/openshift/api/openapi/generated_openapi/zz_generated.openapi.go @@ -20,1714 +20,1723 @@ import ( func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition { return map[string]common.OpenAPIDefinition{ - "github.com/openshift/api/apiextensions/v1alpha1.APIExcludedField": schema_openshift_api_apiextensions_v1alpha1_APIExcludedField(ref), - "github.com/openshift/api/apiextensions/v1alpha1.APIVersions": schema_openshift_api_apiextensions_v1alpha1_APIVersions(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CRDData": schema_openshift_api_apiextensions_v1alpha1_CRDData(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirement": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirement(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirementList": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirementList(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirementSpec": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirementSpec(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirementStatus": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirementStatus(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CompatibilitySchema": schema_openshift_api_apiextensions_v1alpha1_CompatibilitySchema(ref), - "github.com/openshift/api/apiextensions/v1alpha1.CustomResourceDefinitionSchemaValidation": schema_openshift_api_apiextensions_v1alpha1_CustomResourceDefinitionSchemaValidation(ref), - "github.com/openshift/api/apiextensions/v1alpha1.ObjectSchemaValidation": schema_openshift_api_apiextensions_v1alpha1_ObjectSchemaValidation(ref), - "github.com/openshift/api/apiextensions/v1alpha1.ObservedCRD": schema_openshift_api_apiextensions_v1alpha1_ObservedCRD(ref), - "github.com/openshift/api/apiserver/v1.APIRequestCount": schema_openshift_api_apiserver_v1_APIRequestCount(ref), - "github.com/openshift/api/apiserver/v1.APIRequestCountList": schema_openshift_api_apiserver_v1_APIRequestCountList(ref), - "github.com/openshift/api/apiserver/v1.APIRequestCountSpec": schema_openshift_api_apiserver_v1_APIRequestCountSpec(ref), - "github.com/openshift/api/apiserver/v1.APIRequestCountStatus": schema_openshift_api_apiserver_v1_APIRequestCountStatus(ref), - "github.com/openshift/api/apiserver/v1.PerNodeAPIRequestLog": schema_openshift_api_apiserver_v1_PerNodeAPIRequestLog(ref), - "github.com/openshift/api/apiserver/v1.PerResourceAPIRequestLog": schema_openshift_api_apiserver_v1_PerResourceAPIRequestLog(ref), - "github.com/openshift/api/apiserver/v1.PerUserAPIRequestCount": schema_openshift_api_apiserver_v1_PerUserAPIRequestCount(ref), - "github.com/openshift/api/apiserver/v1.PerVerbAPIRequestCount": schema_openshift_api_apiserver_v1_PerVerbAPIRequestCount(ref), - "github.com/openshift/api/apps/v1.CustomDeploymentStrategyParams": schema_openshift_api_apps_v1_CustomDeploymentStrategyParams(ref), - "github.com/openshift/api/apps/v1.DeploymentCause": schema_openshift_api_apps_v1_DeploymentCause(ref), - "github.com/openshift/api/apps/v1.DeploymentCauseImageTrigger": schema_openshift_api_apps_v1_DeploymentCauseImageTrigger(ref), - "github.com/openshift/api/apps/v1.DeploymentCondition": schema_openshift_api_apps_v1_DeploymentCondition(ref), - "github.com/openshift/api/apps/v1.DeploymentConfig": schema_openshift_api_apps_v1_DeploymentConfig(ref), - "github.com/openshift/api/apps/v1.DeploymentConfigList": schema_openshift_api_apps_v1_DeploymentConfigList(ref), - "github.com/openshift/api/apps/v1.DeploymentConfigRollback": schema_openshift_api_apps_v1_DeploymentConfigRollback(ref), - "github.com/openshift/api/apps/v1.DeploymentConfigRollbackSpec": schema_openshift_api_apps_v1_DeploymentConfigRollbackSpec(ref), - "github.com/openshift/api/apps/v1.DeploymentConfigSpec": schema_openshift_api_apps_v1_DeploymentConfigSpec(ref), - "github.com/openshift/api/apps/v1.DeploymentConfigStatus": schema_openshift_api_apps_v1_DeploymentConfigStatus(ref), - "github.com/openshift/api/apps/v1.DeploymentDetails": schema_openshift_api_apps_v1_DeploymentDetails(ref), - "github.com/openshift/api/apps/v1.DeploymentLog": schema_openshift_api_apps_v1_DeploymentLog(ref), - "github.com/openshift/api/apps/v1.DeploymentLogOptions": schema_openshift_api_apps_v1_DeploymentLogOptions(ref), - "github.com/openshift/api/apps/v1.DeploymentRequest": schema_openshift_api_apps_v1_DeploymentRequest(ref), - "github.com/openshift/api/apps/v1.DeploymentStrategy": schema_openshift_api_apps_v1_DeploymentStrategy(ref), - "github.com/openshift/api/apps/v1.DeploymentTriggerImageChangeParams": schema_openshift_api_apps_v1_DeploymentTriggerImageChangeParams(ref), - "github.com/openshift/api/apps/v1.DeploymentTriggerPolicy": schema_openshift_api_apps_v1_DeploymentTriggerPolicy(ref), - "github.com/openshift/api/apps/v1.ExecNewPodHook": schema_openshift_api_apps_v1_ExecNewPodHook(ref), - "github.com/openshift/api/apps/v1.LifecycleHook": schema_openshift_api_apps_v1_LifecycleHook(ref), - "github.com/openshift/api/apps/v1.RecreateDeploymentStrategyParams": schema_openshift_api_apps_v1_RecreateDeploymentStrategyParams(ref), - "github.com/openshift/api/apps/v1.RollingDeploymentStrategyParams": schema_openshift_api_apps_v1_RollingDeploymentStrategyParams(ref), - "github.com/openshift/api/apps/v1.TagImageHook": schema_openshift_api_apps_v1_TagImageHook(ref), - "github.com/openshift/api/authorization/v1.Action": schema_openshift_api_authorization_v1_Action(ref), - "github.com/openshift/api/authorization/v1.ClusterRole": schema_openshift_api_authorization_v1_ClusterRole(ref), - "github.com/openshift/api/authorization/v1.ClusterRoleBinding": schema_openshift_api_authorization_v1_ClusterRoleBinding(ref), - "github.com/openshift/api/authorization/v1.ClusterRoleBindingList": schema_openshift_api_authorization_v1_ClusterRoleBindingList(ref), - "github.com/openshift/api/authorization/v1.ClusterRoleList": schema_openshift_api_authorization_v1_ClusterRoleList(ref), - "github.com/openshift/api/authorization/v1.GroupRestriction": schema_openshift_api_authorization_v1_GroupRestriction(ref), - "github.com/openshift/api/authorization/v1.IsPersonalSubjectAccessReview": schema_openshift_api_authorization_v1_IsPersonalSubjectAccessReview(ref), - "github.com/openshift/api/authorization/v1.LocalResourceAccessReview": schema_openshift_api_authorization_v1_LocalResourceAccessReview(ref), - "github.com/openshift/api/authorization/v1.LocalSubjectAccessReview": schema_openshift_api_authorization_v1_LocalSubjectAccessReview(ref), - "github.com/openshift/api/authorization/v1.NamedClusterRole": schema_openshift_api_authorization_v1_NamedClusterRole(ref), - "github.com/openshift/api/authorization/v1.NamedClusterRoleBinding": schema_openshift_api_authorization_v1_NamedClusterRoleBinding(ref), - "github.com/openshift/api/authorization/v1.NamedRole": schema_openshift_api_authorization_v1_NamedRole(ref), - "github.com/openshift/api/authorization/v1.NamedRoleBinding": schema_openshift_api_authorization_v1_NamedRoleBinding(ref), - "github.com/openshift/api/authorization/v1.PolicyRule": schema_openshift_api_authorization_v1_PolicyRule(ref), - "github.com/openshift/api/authorization/v1.ResourceAccessReview": schema_openshift_api_authorization_v1_ResourceAccessReview(ref), - "github.com/openshift/api/authorization/v1.ResourceAccessReviewResponse": schema_openshift_api_authorization_v1_ResourceAccessReviewResponse(ref), - "github.com/openshift/api/authorization/v1.Role": schema_openshift_api_authorization_v1_Role(ref), - "github.com/openshift/api/authorization/v1.RoleBinding": schema_openshift_api_authorization_v1_RoleBinding(ref), - "github.com/openshift/api/authorization/v1.RoleBindingList": schema_openshift_api_authorization_v1_RoleBindingList(ref), - "github.com/openshift/api/authorization/v1.RoleBindingRestriction": schema_openshift_api_authorization_v1_RoleBindingRestriction(ref), - "github.com/openshift/api/authorization/v1.RoleBindingRestrictionList": schema_openshift_api_authorization_v1_RoleBindingRestrictionList(ref), - "github.com/openshift/api/authorization/v1.RoleBindingRestrictionSpec": schema_openshift_api_authorization_v1_RoleBindingRestrictionSpec(ref), - "github.com/openshift/api/authorization/v1.RoleList": schema_openshift_api_authorization_v1_RoleList(ref), - "github.com/openshift/api/authorization/v1.SelfSubjectRulesReview": schema_openshift_api_authorization_v1_SelfSubjectRulesReview(ref), - "github.com/openshift/api/authorization/v1.SelfSubjectRulesReviewSpec": schema_openshift_api_authorization_v1_SelfSubjectRulesReviewSpec(ref), - "github.com/openshift/api/authorization/v1.ServiceAccountReference": schema_openshift_api_authorization_v1_ServiceAccountReference(ref), - "github.com/openshift/api/authorization/v1.ServiceAccountRestriction": schema_openshift_api_authorization_v1_ServiceAccountRestriction(ref), - "github.com/openshift/api/authorization/v1.SubjectAccessReview": schema_openshift_api_authorization_v1_SubjectAccessReview(ref), - "github.com/openshift/api/authorization/v1.SubjectAccessReviewResponse": schema_openshift_api_authorization_v1_SubjectAccessReviewResponse(ref), - "github.com/openshift/api/authorization/v1.SubjectRulesReview": schema_openshift_api_authorization_v1_SubjectRulesReview(ref), - "github.com/openshift/api/authorization/v1.SubjectRulesReviewSpec": schema_openshift_api_authorization_v1_SubjectRulesReviewSpec(ref), - "github.com/openshift/api/authorization/v1.SubjectRulesReviewStatus": schema_openshift_api_authorization_v1_SubjectRulesReviewStatus(ref), - "github.com/openshift/api/authorization/v1.UserRestriction": schema_openshift_api_authorization_v1_UserRestriction(ref), - "github.com/openshift/api/build/v1.BinaryBuildRequestOptions": schema_openshift_api_build_v1_BinaryBuildRequestOptions(ref), - "github.com/openshift/api/build/v1.BinaryBuildSource": schema_openshift_api_build_v1_BinaryBuildSource(ref), - "github.com/openshift/api/build/v1.BitbucketWebHookCause": schema_openshift_api_build_v1_BitbucketWebHookCause(ref), - "github.com/openshift/api/build/v1.Build": schema_openshift_api_build_v1_Build(ref), - "github.com/openshift/api/build/v1.BuildCondition": schema_openshift_api_build_v1_BuildCondition(ref), - "github.com/openshift/api/build/v1.BuildConfig": schema_openshift_api_build_v1_BuildConfig(ref), - "github.com/openshift/api/build/v1.BuildConfigList": schema_openshift_api_build_v1_BuildConfigList(ref), - "github.com/openshift/api/build/v1.BuildConfigSpec": schema_openshift_api_build_v1_BuildConfigSpec(ref), - "github.com/openshift/api/build/v1.BuildConfigStatus": schema_openshift_api_build_v1_BuildConfigStatus(ref), - "github.com/openshift/api/build/v1.BuildList": schema_openshift_api_build_v1_BuildList(ref), - "github.com/openshift/api/build/v1.BuildLog": schema_openshift_api_build_v1_BuildLog(ref), - "github.com/openshift/api/build/v1.BuildLogOptions": schema_openshift_api_build_v1_BuildLogOptions(ref), - "github.com/openshift/api/build/v1.BuildOutput": schema_openshift_api_build_v1_BuildOutput(ref), - "github.com/openshift/api/build/v1.BuildPostCommitSpec": schema_openshift_api_build_v1_BuildPostCommitSpec(ref), - "github.com/openshift/api/build/v1.BuildRequest": schema_openshift_api_build_v1_BuildRequest(ref), - "github.com/openshift/api/build/v1.BuildSource": schema_openshift_api_build_v1_BuildSource(ref), - "github.com/openshift/api/build/v1.BuildSpec": schema_openshift_api_build_v1_BuildSpec(ref), - "github.com/openshift/api/build/v1.BuildStatus": schema_openshift_api_build_v1_BuildStatus(ref), - "github.com/openshift/api/build/v1.BuildStatusOutput": schema_openshift_api_build_v1_BuildStatusOutput(ref), - "github.com/openshift/api/build/v1.BuildStatusOutputTo": schema_openshift_api_build_v1_BuildStatusOutputTo(ref), - "github.com/openshift/api/build/v1.BuildStrategy": schema_openshift_api_build_v1_BuildStrategy(ref), - "github.com/openshift/api/build/v1.BuildTriggerCause": schema_openshift_api_build_v1_BuildTriggerCause(ref), - "github.com/openshift/api/build/v1.BuildTriggerPolicy": schema_openshift_api_build_v1_BuildTriggerPolicy(ref), - "github.com/openshift/api/build/v1.BuildVolume": schema_openshift_api_build_v1_BuildVolume(ref), - "github.com/openshift/api/build/v1.BuildVolumeMount": schema_openshift_api_build_v1_BuildVolumeMount(ref), - "github.com/openshift/api/build/v1.BuildVolumeSource": schema_openshift_api_build_v1_BuildVolumeSource(ref), - "github.com/openshift/api/build/v1.CommonSpec": schema_openshift_api_build_v1_CommonSpec(ref), - "github.com/openshift/api/build/v1.CommonWebHookCause": schema_openshift_api_build_v1_CommonWebHookCause(ref), - "github.com/openshift/api/build/v1.ConfigMapBuildSource": schema_openshift_api_build_v1_ConfigMapBuildSource(ref), - "github.com/openshift/api/build/v1.CustomBuildStrategy": schema_openshift_api_build_v1_CustomBuildStrategy(ref), - "github.com/openshift/api/build/v1.DockerBuildStrategy": schema_openshift_api_build_v1_DockerBuildStrategy(ref), - "github.com/openshift/api/build/v1.DockerStrategyOptions": schema_openshift_api_build_v1_DockerStrategyOptions(ref), - "github.com/openshift/api/build/v1.GenericWebHookCause": schema_openshift_api_build_v1_GenericWebHookCause(ref), - "github.com/openshift/api/build/v1.GenericWebHookEvent": schema_openshift_api_build_v1_GenericWebHookEvent(ref), - "github.com/openshift/api/build/v1.GitBuildSource": schema_openshift_api_build_v1_GitBuildSource(ref), - "github.com/openshift/api/build/v1.GitHubWebHookCause": schema_openshift_api_build_v1_GitHubWebHookCause(ref), - "github.com/openshift/api/build/v1.GitInfo": schema_openshift_api_build_v1_GitInfo(ref), - "github.com/openshift/api/build/v1.GitLabWebHookCause": schema_openshift_api_build_v1_GitLabWebHookCause(ref), - "github.com/openshift/api/build/v1.GitRefInfo": schema_openshift_api_build_v1_GitRefInfo(ref), - "github.com/openshift/api/build/v1.GitSourceRevision": schema_openshift_api_build_v1_GitSourceRevision(ref), - "github.com/openshift/api/build/v1.ImageChangeCause": schema_openshift_api_build_v1_ImageChangeCause(ref), - "github.com/openshift/api/build/v1.ImageChangeTrigger": schema_openshift_api_build_v1_ImageChangeTrigger(ref), - "github.com/openshift/api/build/v1.ImageChangeTriggerStatus": schema_openshift_api_build_v1_ImageChangeTriggerStatus(ref), - "github.com/openshift/api/build/v1.ImageLabel": schema_openshift_api_build_v1_ImageLabel(ref), - "github.com/openshift/api/build/v1.ImageSource": schema_openshift_api_build_v1_ImageSource(ref), - "github.com/openshift/api/build/v1.ImageSourcePath": schema_openshift_api_build_v1_ImageSourcePath(ref), - "github.com/openshift/api/build/v1.ImageStreamTagReference": schema_openshift_api_build_v1_ImageStreamTagReference(ref), - "github.com/openshift/api/build/v1.JenkinsPipelineBuildStrategy": schema_openshift_api_build_v1_JenkinsPipelineBuildStrategy(ref), - "github.com/openshift/api/build/v1.ProxyConfig": schema_openshift_api_build_v1_ProxyConfig(ref), - "github.com/openshift/api/build/v1.SecretBuildSource": schema_openshift_api_build_v1_SecretBuildSource(ref), - "github.com/openshift/api/build/v1.SecretLocalReference": schema_openshift_api_build_v1_SecretLocalReference(ref), - "github.com/openshift/api/build/v1.SecretSpec": schema_openshift_api_build_v1_SecretSpec(ref), - "github.com/openshift/api/build/v1.SourceBuildStrategy": schema_openshift_api_build_v1_SourceBuildStrategy(ref), - "github.com/openshift/api/build/v1.SourceControlUser": schema_openshift_api_build_v1_SourceControlUser(ref), - "github.com/openshift/api/build/v1.SourceRevision": schema_openshift_api_build_v1_SourceRevision(ref), - "github.com/openshift/api/build/v1.SourceStrategyOptions": schema_openshift_api_build_v1_SourceStrategyOptions(ref), - "github.com/openshift/api/build/v1.StageInfo": schema_openshift_api_build_v1_StageInfo(ref), - "github.com/openshift/api/build/v1.StepInfo": schema_openshift_api_build_v1_StepInfo(ref), - "github.com/openshift/api/build/v1.WebHookTrigger": schema_openshift_api_build_v1_WebHookTrigger(ref), - "github.com/openshift/api/cloudnetwork/v1.CloudPrivateIPConfig": schema_openshift_api_cloudnetwork_v1_CloudPrivateIPConfig(ref), - "github.com/openshift/api/cloudnetwork/v1.CloudPrivateIPConfigSpec": schema_openshift_api_cloudnetwork_v1_CloudPrivateIPConfigSpec(ref), - "github.com/openshift/api/cloudnetwork/v1.CloudPrivateIPConfigStatus": schema_openshift_api_cloudnetwork_v1_CloudPrivateIPConfigStatus(ref), - "github.com/openshift/api/config/v1.APIServer": schema_openshift_api_config_v1_APIServer(ref), - "github.com/openshift/api/config/v1.APIServerEncryption": schema_openshift_api_config_v1_APIServerEncryption(ref), - "github.com/openshift/api/config/v1.APIServerList": schema_openshift_api_config_v1_APIServerList(ref), - "github.com/openshift/api/config/v1.APIServerNamedServingCert": schema_openshift_api_config_v1_APIServerNamedServingCert(ref), - "github.com/openshift/api/config/v1.APIServerServingCerts": schema_openshift_api_config_v1_APIServerServingCerts(ref), - "github.com/openshift/api/config/v1.APIServerSpec": schema_openshift_api_config_v1_APIServerSpec(ref), - "github.com/openshift/api/config/v1.APIServerStatus": schema_openshift_api_config_v1_APIServerStatus(ref), - "github.com/openshift/api/config/v1.AWSDNSSpec": schema_openshift_api_config_v1_AWSDNSSpec(ref), - "github.com/openshift/api/config/v1.AWSIngressSpec": schema_openshift_api_config_v1_AWSIngressSpec(ref), - "github.com/openshift/api/config/v1.AWSKMSConfig": schema_openshift_api_config_v1_AWSKMSConfig(ref), - "github.com/openshift/api/config/v1.AWSPlatformSpec": schema_openshift_api_config_v1_AWSPlatformSpec(ref), - "github.com/openshift/api/config/v1.AWSPlatformStatus": schema_openshift_api_config_v1_AWSPlatformStatus(ref), - "github.com/openshift/api/config/v1.AWSResourceTag": schema_openshift_api_config_v1_AWSResourceTag(ref), - "github.com/openshift/api/config/v1.AWSServiceEndpoint": schema_openshift_api_config_v1_AWSServiceEndpoint(ref), - "github.com/openshift/api/config/v1.AcceptRisk": schema_openshift_api_config_v1_AcceptRisk(ref), - "github.com/openshift/api/config/v1.AdmissionConfig": schema_openshift_api_config_v1_AdmissionConfig(ref), - "github.com/openshift/api/config/v1.AdmissionPluginConfig": schema_openshift_api_config_v1_AdmissionPluginConfig(ref), - "github.com/openshift/api/config/v1.AlibabaCloudPlatformSpec": schema_openshift_api_config_v1_AlibabaCloudPlatformSpec(ref), - "github.com/openshift/api/config/v1.AlibabaCloudPlatformStatus": schema_openshift_api_config_v1_AlibabaCloudPlatformStatus(ref), - "github.com/openshift/api/config/v1.AlibabaCloudResourceTag": schema_openshift_api_config_v1_AlibabaCloudResourceTag(ref), - "github.com/openshift/api/config/v1.Audit": schema_openshift_api_config_v1_Audit(ref), - "github.com/openshift/api/config/v1.AuditConfig": schema_openshift_api_config_v1_AuditConfig(ref), - "github.com/openshift/api/config/v1.AuditCustomRule": schema_openshift_api_config_v1_AuditCustomRule(ref), - "github.com/openshift/api/config/v1.Authentication": schema_openshift_api_config_v1_Authentication(ref), - "github.com/openshift/api/config/v1.AuthenticationList": schema_openshift_api_config_v1_AuthenticationList(ref), - "github.com/openshift/api/config/v1.AuthenticationSpec": schema_openshift_api_config_v1_AuthenticationSpec(ref), - "github.com/openshift/api/config/v1.AuthenticationStatus": schema_openshift_api_config_v1_AuthenticationStatus(ref), - "github.com/openshift/api/config/v1.AzurePlatformSpec": schema_openshift_api_config_v1_AzurePlatformSpec(ref), - "github.com/openshift/api/config/v1.AzurePlatformStatus": schema_openshift_api_config_v1_AzurePlatformStatus(ref), - "github.com/openshift/api/config/v1.AzureResourceTag": schema_openshift_api_config_v1_AzureResourceTag(ref), - "github.com/openshift/api/config/v1.BareMetalPlatformLoadBalancer": schema_openshift_api_config_v1_BareMetalPlatformLoadBalancer(ref), - "github.com/openshift/api/config/v1.BareMetalPlatformSpec": schema_openshift_api_config_v1_BareMetalPlatformSpec(ref), - "github.com/openshift/api/config/v1.BareMetalPlatformStatus": schema_openshift_api_config_v1_BareMetalPlatformStatus(ref), - "github.com/openshift/api/config/v1.BasicAuthIdentityProvider": schema_openshift_api_config_v1_BasicAuthIdentityProvider(ref), - "github.com/openshift/api/config/v1.Build": schema_openshift_api_config_v1_Build(ref), - "github.com/openshift/api/config/v1.BuildDefaults": schema_openshift_api_config_v1_BuildDefaults(ref), - "github.com/openshift/api/config/v1.BuildList": schema_openshift_api_config_v1_BuildList(ref), - "github.com/openshift/api/config/v1.BuildOverrides": schema_openshift_api_config_v1_BuildOverrides(ref), - "github.com/openshift/api/config/v1.BuildSpec": schema_openshift_api_config_v1_BuildSpec(ref), - "github.com/openshift/api/config/v1.CertInfo": schema_openshift_api_config_v1_CertInfo(ref), - "github.com/openshift/api/config/v1.ClientConnectionOverrides": schema_openshift_api_config_v1_ClientConnectionOverrides(ref), - "github.com/openshift/api/config/v1.CloudControllerManagerStatus": schema_openshift_api_config_v1_CloudControllerManagerStatus(ref), - "github.com/openshift/api/config/v1.CloudLoadBalancerConfig": schema_openshift_api_config_v1_CloudLoadBalancerConfig(ref), - "github.com/openshift/api/config/v1.CloudLoadBalancerIPs": schema_openshift_api_config_v1_CloudLoadBalancerIPs(ref), - "github.com/openshift/api/config/v1.ClusterCondition": schema_openshift_api_config_v1_ClusterCondition(ref), - "github.com/openshift/api/config/v1.ClusterImagePolicy": schema_openshift_api_config_v1_ClusterImagePolicy(ref), - "github.com/openshift/api/config/v1.ClusterImagePolicyList": schema_openshift_api_config_v1_ClusterImagePolicyList(ref), - "github.com/openshift/api/config/v1.ClusterImagePolicySpec": schema_openshift_api_config_v1_ClusterImagePolicySpec(ref), - "github.com/openshift/api/config/v1.ClusterImagePolicyStatus": schema_openshift_api_config_v1_ClusterImagePolicyStatus(ref), - "github.com/openshift/api/config/v1.ClusterNetworkEntry": schema_openshift_api_config_v1_ClusterNetworkEntry(ref), - "github.com/openshift/api/config/v1.ClusterOperator": schema_openshift_api_config_v1_ClusterOperator(ref), - "github.com/openshift/api/config/v1.ClusterOperatorList": schema_openshift_api_config_v1_ClusterOperatorList(ref), - "github.com/openshift/api/config/v1.ClusterOperatorSpec": schema_openshift_api_config_v1_ClusterOperatorSpec(ref), - "github.com/openshift/api/config/v1.ClusterOperatorStatus": schema_openshift_api_config_v1_ClusterOperatorStatus(ref), - "github.com/openshift/api/config/v1.ClusterOperatorStatusCondition": schema_openshift_api_config_v1_ClusterOperatorStatusCondition(ref), - "github.com/openshift/api/config/v1.ClusterVersion": schema_openshift_api_config_v1_ClusterVersion(ref), - "github.com/openshift/api/config/v1.ClusterVersionCapabilitiesSpec": schema_openshift_api_config_v1_ClusterVersionCapabilitiesSpec(ref), - "github.com/openshift/api/config/v1.ClusterVersionCapabilitiesStatus": schema_openshift_api_config_v1_ClusterVersionCapabilitiesStatus(ref), - "github.com/openshift/api/config/v1.ClusterVersionList": schema_openshift_api_config_v1_ClusterVersionList(ref), - "github.com/openshift/api/config/v1.ClusterVersionSpec": schema_openshift_api_config_v1_ClusterVersionSpec(ref), - "github.com/openshift/api/config/v1.ClusterVersionStatus": schema_openshift_api_config_v1_ClusterVersionStatus(ref), - "github.com/openshift/api/config/v1.ComponentOverride": schema_openshift_api_config_v1_ComponentOverride(ref), - "github.com/openshift/api/config/v1.ComponentRouteSpec": schema_openshift_api_config_v1_ComponentRouteSpec(ref), - "github.com/openshift/api/config/v1.ComponentRouteStatus": schema_openshift_api_config_v1_ComponentRouteStatus(ref), - "github.com/openshift/api/config/v1.ConditionalUpdate": schema_openshift_api_config_v1_ConditionalUpdate(ref), - "github.com/openshift/api/config/v1.ConditionalUpdateRisk": schema_openshift_api_config_v1_ConditionalUpdateRisk(ref), - "github.com/openshift/api/config/v1.ConfigMapFileReference": schema_openshift_api_config_v1_ConfigMapFileReference(ref), - "github.com/openshift/api/config/v1.ConfigMapNameReference": schema_openshift_api_config_v1_ConfigMapNameReference(ref), - "github.com/openshift/api/config/v1.Console": schema_openshift_api_config_v1_Console(ref), - "github.com/openshift/api/config/v1.ConsoleAuthentication": schema_openshift_api_config_v1_ConsoleAuthentication(ref), - "github.com/openshift/api/config/v1.ConsoleList": schema_openshift_api_config_v1_ConsoleList(ref), - "github.com/openshift/api/config/v1.ConsoleSpec": schema_openshift_api_config_v1_ConsoleSpec(ref), - "github.com/openshift/api/config/v1.ConsoleStatus": schema_openshift_api_config_v1_ConsoleStatus(ref), - "github.com/openshift/api/config/v1.Custom": schema_openshift_api_config_v1_Custom(ref), - "github.com/openshift/api/config/v1.CustomFeatureGates": schema_openshift_api_config_v1_CustomFeatureGates(ref), - "github.com/openshift/api/config/v1.CustomTLSProfile": schema_openshift_api_config_v1_CustomTLSProfile(ref), - "github.com/openshift/api/config/v1.DNS": schema_openshift_api_config_v1_DNS(ref), - "github.com/openshift/api/config/v1.DNSList": schema_openshift_api_config_v1_DNSList(ref), - "github.com/openshift/api/config/v1.DNSPlatformSpec": schema_openshift_api_config_v1_DNSPlatformSpec(ref), - "github.com/openshift/api/config/v1.DNSSpec": schema_openshift_api_config_v1_DNSSpec(ref), - "github.com/openshift/api/config/v1.DNSStatus": schema_openshift_api_config_v1_DNSStatus(ref), - "github.com/openshift/api/config/v1.DNSZone": schema_openshift_api_config_v1_DNSZone(ref), - "github.com/openshift/api/config/v1.DelegatedAuthentication": schema_openshift_api_config_v1_DelegatedAuthentication(ref), - "github.com/openshift/api/config/v1.DelegatedAuthorization": schema_openshift_api_config_v1_DelegatedAuthorization(ref), - "github.com/openshift/api/config/v1.DeprecatedWebhookTokenAuthenticator": schema_openshift_api_config_v1_DeprecatedWebhookTokenAuthenticator(ref), - "github.com/openshift/api/config/v1.EquinixMetalPlatformSpec": schema_openshift_api_config_v1_EquinixMetalPlatformSpec(ref), - "github.com/openshift/api/config/v1.EquinixMetalPlatformStatus": schema_openshift_api_config_v1_EquinixMetalPlatformStatus(ref), - "github.com/openshift/api/config/v1.EtcdConnectionInfo": schema_openshift_api_config_v1_EtcdConnectionInfo(ref), - "github.com/openshift/api/config/v1.EtcdStorageConfig": schema_openshift_api_config_v1_EtcdStorageConfig(ref), - "github.com/openshift/api/config/v1.ExternalIPConfig": schema_openshift_api_config_v1_ExternalIPConfig(ref), - "github.com/openshift/api/config/v1.ExternalIPPolicy": schema_openshift_api_config_v1_ExternalIPPolicy(ref), - "github.com/openshift/api/config/v1.ExternalPlatformSpec": schema_openshift_api_config_v1_ExternalPlatformSpec(ref), - "github.com/openshift/api/config/v1.ExternalPlatformStatus": schema_openshift_api_config_v1_ExternalPlatformStatus(ref), - "github.com/openshift/api/config/v1.ExtraMapping": schema_openshift_api_config_v1_ExtraMapping(ref), - "github.com/openshift/api/config/v1.FeatureGate": schema_openshift_api_config_v1_FeatureGate(ref), - "github.com/openshift/api/config/v1.FeatureGateAttributes": schema_openshift_api_config_v1_FeatureGateAttributes(ref), - "github.com/openshift/api/config/v1.FeatureGateDetails": schema_openshift_api_config_v1_FeatureGateDetails(ref), - "github.com/openshift/api/config/v1.FeatureGateList": schema_openshift_api_config_v1_FeatureGateList(ref), - "github.com/openshift/api/config/v1.FeatureGateSelection": schema_openshift_api_config_v1_FeatureGateSelection(ref), - "github.com/openshift/api/config/v1.FeatureGateSpec": schema_openshift_api_config_v1_FeatureGateSpec(ref), - "github.com/openshift/api/config/v1.FeatureGateStatus": schema_openshift_api_config_v1_FeatureGateStatus(ref), - "github.com/openshift/api/config/v1.FeatureGateTests": schema_openshift_api_config_v1_FeatureGateTests(ref), - "github.com/openshift/api/config/v1.GCPPlatformSpec": schema_openshift_api_config_v1_GCPPlatformSpec(ref), - "github.com/openshift/api/config/v1.GCPPlatformStatus": schema_openshift_api_config_v1_GCPPlatformStatus(ref), - "github.com/openshift/api/config/v1.GCPResourceLabel": schema_openshift_api_config_v1_GCPResourceLabel(ref), - "github.com/openshift/api/config/v1.GCPResourceTag": schema_openshift_api_config_v1_GCPResourceTag(ref), - "github.com/openshift/api/config/v1.GatherConfig": schema_openshift_api_config_v1_GatherConfig(ref), - "github.com/openshift/api/config/v1.GathererConfig": schema_openshift_api_config_v1_GathererConfig(ref), - "github.com/openshift/api/config/v1.Gatherers": schema_openshift_api_config_v1_Gatherers(ref), - "github.com/openshift/api/config/v1.GenericAPIServerConfig": schema_openshift_api_config_v1_GenericAPIServerConfig(ref), - "github.com/openshift/api/config/v1.GenericControllerConfig": schema_openshift_api_config_v1_GenericControllerConfig(ref), - "github.com/openshift/api/config/v1.GitHubIdentityProvider": schema_openshift_api_config_v1_GitHubIdentityProvider(ref), - "github.com/openshift/api/config/v1.GitLabIdentityProvider": schema_openshift_api_config_v1_GitLabIdentityProvider(ref), - "github.com/openshift/api/config/v1.GoogleIdentityProvider": schema_openshift_api_config_v1_GoogleIdentityProvider(ref), - "github.com/openshift/api/config/v1.HTPasswdIdentityProvider": schema_openshift_api_config_v1_HTPasswdIdentityProvider(ref), - "github.com/openshift/api/config/v1.HTTPServingInfo": schema_openshift_api_config_v1_HTTPServingInfo(ref), - "github.com/openshift/api/config/v1.HubSource": schema_openshift_api_config_v1_HubSource(ref), - "github.com/openshift/api/config/v1.HubSourceStatus": schema_openshift_api_config_v1_HubSourceStatus(ref), - "github.com/openshift/api/config/v1.IBMCloudPlatformSpec": schema_openshift_api_config_v1_IBMCloudPlatformSpec(ref), - "github.com/openshift/api/config/v1.IBMCloudPlatformStatus": schema_openshift_api_config_v1_IBMCloudPlatformStatus(ref), - "github.com/openshift/api/config/v1.IBMCloudServiceEndpoint": schema_openshift_api_config_v1_IBMCloudServiceEndpoint(ref), - "github.com/openshift/api/config/v1.IdentityProvider": schema_openshift_api_config_v1_IdentityProvider(ref), - "github.com/openshift/api/config/v1.IdentityProviderConfig": schema_openshift_api_config_v1_IdentityProviderConfig(ref), - "github.com/openshift/api/config/v1.Image": schema_openshift_api_config_v1_Image(ref), - "github.com/openshift/api/config/v1.ImageContentPolicy": schema_openshift_api_config_v1_ImageContentPolicy(ref), - "github.com/openshift/api/config/v1.ImageContentPolicyList": schema_openshift_api_config_v1_ImageContentPolicyList(ref), - "github.com/openshift/api/config/v1.ImageContentPolicySpec": schema_openshift_api_config_v1_ImageContentPolicySpec(ref), - "github.com/openshift/api/config/v1.ImageDigestMirrorSet": schema_openshift_api_config_v1_ImageDigestMirrorSet(ref), - "github.com/openshift/api/config/v1.ImageDigestMirrorSetList": schema_openshift_api_config_v1_ImageDigestMirrorSetList(ref), - "github.com/openshift/api/config/v1.ImageDigestMirrorSetSpec": schema_openshift_api_config_v1_ImageDigestMirrorSetSpec(ref), - "github.com/openshift/api/config/v1.ImageDigestMirrorSetStatus": schema_openshift_api_config_v1_ImageDigestMirrorSetStatus(ref), - "github.com/openshift/api/config/v1.ImageDigestMirrors": schema_openshift_api_config_v1_ImageDigestMirrors(ref), - "github.com/openshift/api/config/v1.ImageLabel": schema_openshift_api_config_v1_ImageLabel(ref), - "github.com/openshift/api/config/v1.ImageList": schema_openshift_api_config_v1_ImageList(ref), - "github.com/openshift/api/config/v1.ImagePolicy": schema_openshift_api_config_v1_ImagePolicy(ref), - "github.com/openshift/api/config/v1.ImagePolicyFulcioCAWithRekorRootOfTrust": schema_openshift_api_config_v1_ImagePolicyFulcioCAWithRekorRootOfTrust(ref), - "github.com/openshift/api/config/v1.ImagePolicyList": schema_openshift_api_config_v1_ImagePolicyList(ref), - "github.com/openshift/api/config/v1.ImagePolicyPKIRootOfTrust": schema_openshift_api_config_v1_ImagePolicyPKIRootOfTrust(ref), - "github.com/openshift/api/config/v1.ImagePolicyPublicKeyRootOfTrust": schema_openshift_api_config_v1_ImagePolicyPublicKeyRootOfTrust(ref), - "github.com/openshift/api/config/v1.ImagePolicySpec": schema_openshift_api_config_v1_ImagePolicySpec(ref), - "github.com/openshift/api/config/v1.ImagePolicyStatus": schema_openshift_api_config_v1_ImagePolicyStatus(ref), - "github.com/openshift/api/config/v1.ImageSigstoreVerificationPolicy": schema_openshift_api_config_v1_ImageSigstoreVerificationPolicy(ref), - "github.com/openshift/api/config/v1.ImageSpec": schema_openshift_api_config_v1_ImageSpec(ref), - "github.com/openshift/api/config/v1.ImageStatus": schema_openshift_api_config_v1_ImageStatus(ref), - "github.com/openshift/api/config/v1.ImageTagMirrorSet": schema_openshift_api_config_v1_ImageTagMirrorSet(ref), - "github.com/openshift/api/config/v1.ImageTagMirrorSetList": schema_openshift_api_config_v1_ImageTagMirrorSetList(ref), - "github.com/openshift/api/config/v1.ImageTagMirrorSetSpec": schema_openshift_api_config_v1_ImageTagMirrorSetSpec(ref), - "github.com/openshift/api/config/v1.ImageTagMirrorSetStatus": schema_openshift_api_config_v1_ImageTagMirrorSetStatus(ref), - "github.com/openshift/api/config/v1.ImageTagMirrors": schema_openshift_api_config_v1_ImageTagMirrors(ref), - "github.com/openshift/api/config/v1.Infrastructure": schema_openshift_api_config_v1_Infrastructure(ref), - "github.com/openshift/api/config/v1.InfrastructureList": schema_openshift_api_config_v1_InfrastructureList(ref), - "github.com/openshift/api/config/v1.InfrastructureSpec": schema_openshift_api_config_v1_InfrastructureSpec(ref), - "github.com/openshift/api/config/v1.InfrastructureStatus": schema_openshift_api_config_v1_InfrastructureStatus(ref), - "github.com/openshift/api/config/v1.Ingress": schema_openshift_api_config_v1_Ingress(ref), - "github.com/openshift/api/config/v1.IngressList": schema_openshift_api_config_v1_IngressList(ref), - "github.com/openshift/api/config/v1.IngressPlatformSpec": schema_openshift_api_config_v1_IngressPlatformSpec(ref), - "github.com/openshift/api/config/v1.IngressSpec": schema_openshift_api_config_v1_IngressSpec(ref), - "github.com/openshift/api/config/v1.IngressStatus": schema_openshift_api_config_v1_IngressStatus(ref), - "github.com/openshift/api/config/v1.InsightsDataGather": schema_openshift_api_config_v1_InsightsDataGather(ref), - "github.com/openshift/api/config/v1.InsightsDataGatherList": schema_openshift_api_config_v1_InsightsDataGatherList(ref), - "github.com/openshift/api/config/v1.InsightsDataGatherSpec": schema_openshift_api_config_v1_InsightsDataGatherSpec(ref), - "github.com/openshift/api/config/v1.IntermediateTLSProfile": schema_openshift_api_config_v1_IntermediateTLSProfile(ref), - "github.com/openshift/api/config/v1.KMSConfig": schema_openshift_api_config_v1_KMSConfig(ref), - "github.com/openshift/api/config/v1.KeystoneIdentityProvider": schema_openshift_api_config_v1_KeystoneIdentityProvider(ref), - "github.com/openshift/api/config/v1.KubeClientConfig": schema_openshift_api_config_v1_KubeClientConfig(ref), - "github.com/openshift/api/config/v1.KubevirtPlatformSpec": schema_openshift_api_config_v1_KubevirtPlatformSpec(ref), - "github.com/openshift/api/config/v1.KubevirtPlatformStatus": schema_openshift_api_config_v1_KubevirtPlatformStatus(ref), - "github.com/openshift/api/config/v1.LDAPAttributeMapping": schema_openshift_api_config_v1_LDAPAttributeMapping(ref), - "github.com/openshift/api/config/v1.LDAPIdentityProvider": schema_openshift_api_config_v1_LDAPIdentityProvider(ref), - "github.com/openshift/api/config/v1.LeaderElection": schema_openshift_api_config_v1_LeaderElection(ref), - "github.com/openshift/api/config/v1.LoadBalancer": schema_openshift_api_config_v1_LoadBalancer(ref), - "github.com/openshift/api/config/v1.MTUMigration": schema_openshift_api_config_v1_MTUMigration(ref), - "github.com/openshift/api/config/v1.MTUMigrationValues": schema_openshift_api_config_v1_MTUMigrationValues(ref), - "github.com/openshift/api/config/v1.MaxAgePolicy": schema_openshift_api_config_v1_MaxAgePolicy(ref), - "github.com/openshift/api/config/v1.ModernTLSProfile": schema_openshift_api_config_v1_ModernTLSProfile(ref), - "github.com/openshift/api/config/v1.NamedCertificate": schema_openshift_api_config_v1_NamedCertificate(ref), - "github.com/openshift/api/config/v1.Network": schema_openshift_api_config_v1_Network(ref), - "github.com/openshift/api/config/v1.NetworkDiagnostics": schema_openshift_api_config_v1_NetworkDiagnostics(ref), - "github.com/openshift/api/config/v1.NetworkDiagnosticsSourcePlacement": schema_openshift_api_config_v1_NetworkDiagnosticsSourcePlacement(ref), - "github.com/openshift/api/config/v1.NetworkDiagnosticsTargetPlacement": schema_openshift_api_config_v1_NetworkDiagnosticsTargetPlacement(ref), - "github.com/openshift/api/config/v1.NetworkList": schema_openshift_api_config_v1_NetworkList(ref), - "github.com/openshift/api/config/v1.NetworkMigration": schema_openshift_api_config_v1_NetworkMigration(ref), - "github.com/openshift/api/config/v1.NetworkSpec": schema_openshift_api_config_v1_NetworkSpec(ref), - "github.com/openshift/api/config/v1.NetworkStatus": schema_openshift_api_config_v1_NetworkStatus(ref), - "github.com/openshift/api/config/v1.Node": schema_openshift_api_config_v1_Node(ref), - "github.com/openshift/api/config/v1.NodeList": schema_openshift_api_config_v1_NodeList(ref), - "github.com/openshift/api/config/v1.NodeSpec": schema_openshift_api_config_v1_NodeSpec(ref), - "github.com/openshift/api/config/v1.NodeStatus": schema_openshift_api_config_v1_NodeStatus(ref), - "github.com/openshift/api/config/v1.NutanixFailureDomain": schema_openshift_api_config_v1_NutanixFailureDomain(ref), - "github.com/openshift/api/config/v1.NutanixPlatformLoadBalancer": schema_openshift_api_config_v1_NutanixPlatformLoadBalancer(ref), - "github.com/openshift/api/config/v1.NutanixPlatformSpec": schema_openshift_api_config_v1_NutanixPlatformSpec(ref), - "github.com/openshift/api/config/v1.NutanixPlatformStatus": schema_openshift_api_config_v1_NutanixPlatformStatus(ref), - "github.com/openshift/api/config/v1.NutanixPrismElementEndpoint": schema_openshift_api_config_v1_NutanixPrismElementEndpoint(ref), - "github.com/openshift/api/config/v1.NutanixPrismEndpoint": schema_openshift_api_config_v1_NutanixPrismEndpoint(ref), - "github.com/openshift/api/config/v1.NutanixResourceIdentifier": schema_openshift_api_config_v1_NutanixResourceIdentifier(ref), - "github.com/openshift/api/config/v1.OAuth": schema_openshift_api_config_v1_OAuth(ref), - "github.com/openshift/api/config/v1.OAuthList": schema_openshift_api_config_v1_OAuthList(ref), - "github.com/openshift/api/config/v1.OAuthRemoteConnectionInfo": schema_openshift_api_config_v1_OAuthRemoteConnectionInfo(ref), - "github.com/openshift/api/config/v1.OAuthSpec": schema_openshift_api_config_v1_OAuthSpec(ref), - "github.com/openshift/api/config/v1.OAuthStatus": schema_openshift_api_config_v1_OAuthStatus(ref), - "github.com/openshift/api/config/v1.OAuthTemplates": schema_openshift_api_config_v1_OAuthTemplates(ref), - "github.com/openshift/api/config/v1.OIDCClientConfig": schema_openshift_api_config_v1_OIDCClientConfig(ref), - "github.com/openshift/api/config/v1.OIDCClientReference": schema_openshift_api_config_v1_OIDCClientReference(ref), - "github.com/openshift/api/config/v1.OIDCClientStatus": schema_openshift_api_config_v1_OIDCClientStatus(ref), - "github.com/openshift/api/config/v1.OIDCProvider": schema_openshift_api_config_v1_OIDCProvider(ref), - "github.com/openshift/api/config/v1.ObjectReference": schema_openshift_api_config_v1_ObjectReference(ref), - "github.com/openshift/api/config/v1.OldTLSProfile": schema_openshift_api_config_v1_OldTLSProfile(ref), - "github.com/openshift/api/config/v1.OpenIDClaims": schema_openshift_api_config_v1_OpenIDClaims(ref), - "github.com/openshift/api/config/v1.OpenIDIdentityProvider": schema_openshift_api_config_v1_OpenIDIdentityProvider(ref), - "github.com/openshift/api/config/v1.OpenStackPlatformLoadBalancer": schema_openshift_api_config_v1_OpenStackPlatformLoadBalancer(ref), - "github.com/openshift/api/config/v1.OpenStackPlatformSpec": schema_openshift_api_config_v1_OpenStackPlatformSpec(ref), - "github.com/openshift/api/config/v1.OpenStackPlatformStatus": schema_openshift_api_config_v1_OpenStackPlatformStatus(ref), - "github.com/openshift/api/config/v1.OperandVersion": schema_openshift_api_config_v1_OperandVersion(ref), - "github.com/openshift/api/config/v1.OperatorHub": schema_openshift_api_config_v1_OperatorHub(ref), - "github.com/openshift/api/config/v1.OperatorHubList": schema_openshift_api_config_v1_OperatorHubList(ref), - "github.com/openshift/api/config/v1.OperatorHubSpec": schema_openshift_api_config_v1_OperatorHubSpec(ref), - "github.com/openshift/api/config/v1.OperatorHubStatus": schema_openshift_api_config_v1_OperatorHubStatus(ref), - "github.com/openshift/api/config/v1.OvirtPlatformLoadBalancer": schema_openshift_api_config_v1_OvirtPlatformLoadBalancer(ref), - "github.com/openshift/api/config/v1.OvirtPlatformSpec": schema_openshift_api_config_v1_OvirtPlatformSpec(ref), - "github.com/openshift/api/config/v1.OvirtPlatformStatus": schema_openshift_api_config_v1_OvirtPlatformStatus(ref), - "github.com/openshift/api/config/v1.PKICertificateSubject": schema_openshift_api_config_v1_PKICertificateSubject(ref), - "github.com/openshift/api/config/v1.PersistentVolumeClaimReference": schema_openshift_api_config_v1_PersistentVolumeClaimReference(ref), - "github.com/openshift/api/config/v1.PersistentVolumeConfig": schema_openshift_api_config_v1_PersistentVolumeConfig(ref), - "github.com/openshift/api/config/v1.PlatformSpec": schema_openshift_api_config_v1_PlatformSpec(ref), - "github.com/openshift/api/config/v1.PlatformStatus": schema_openshift_api_config_v1_PlatformStatus(ref), - "github.com/openshift/api/config/v1.PolicyFulcioSubject": schema_openshift_api_config_v1_PolicyFulcioSubject(ref), - "github.com/openshift/api/config/v1.PolicyIdentity": schema_openshift_api_config_v1_PolicyIdentity(ref), - "github.com/openshift/api/config/v1.PolicyMatchExactRepository": schema_openshift_api_config_v1_PolicyMatchExactRepository(ref), - "github.com/openshift/api/config/v1.PolicyMatchRemapIdentity": schema_openshift_api_config_v1_PolicyMatchRemapIdentity(ref), - "github.com/openshift/api/config/v1.PolicyRootOfTrust": schema_openshift_api_config_v1_PolicyRootOfTrust(ref), - "github.com/openshift/api/config/v1.PowerVSPlatformSpec": schema_openshift_api_config_v1_PowerVSPlatformSpec(ref), - "github.com/openshift/api/config/v1.PowerVSPlatformStatus": schema_openshift_api_config_v1_PowerVSPlatformStatus(ref), - "github.com/openshift/api/config/v1.PowerVSServiceEndpoint": schema_openshift_api_config_v1_PowerVSServiceEndpoint(ref), - "github.com/openshift/api/config/v1.PrefixedClaimMapping": schema_openshift_api_config_v1_PrefixedClaimMapping(ref), - "github.com/openshift/api/config/v1.ProfileCustomizations": schema_openshift_api_config_v1_ProfileCustomizations(ref), - "github.com/openshift/api/config/v1.Project": schema_openshift_api_config_v1_Project(ref), - "github.com/openshift/api/config/v1.ProjectList": schema_openshift_api_config_v1_ProjectList(ref), - "github.com/openshift/api/config/v1.ProjectSpec": schema_openshift_api_config_v1_ProjectSpec(ref), - "github.com/openshift/api/config/v1.ProjectStatus": schema_openshift_api_config_v1_ProjectStatus(ref), - "github.com/openshift/api/config/v1.PromQLClusterCondition": schema_openshift_api_config_v1_PromQLClusterCondition(ref), - "github.com/openshift/api/config/v1.Proxy": schema_openshift_api_config_v1_Proxy(ref), - "github.com/openshift/api/config/v1.ProxyList": schema_openshift_api_config_v1_ProxyList(ref), - "github.com/openshift/api/config/v1.ProxySpec": schema_openshift_api_config_v1_ProxySpec(ref), - "github.com/openshift/api/config/v1.ProxyStatus": schema_openshift_api_config_v1_ProxyStatus(ref), - "github.com/openshift/api/config/v1.RegistryLocation": schema_openshift_api_config_v1_RegistryLocation(ref), - "github.com/openshift/api/config/v1.RegistrySources": schema_openshift_api_config_v1_RegistrySources(ref), - "github.com/openshift/api/config/v1.Release": schema_openshift_api_config_v1_Release(ref), - "github.com/openshift/api/config/v1.RemoteConnectionInfo": schema_openshift_api_config_v1_RemoteConnectionInfo(ref), - "github.com/openshift/api/config/v1.RepositoryDigestMirrors": schema_openshift_api_config_v1_RepositoryDigestMirrors(ref), - "github.com/openshift/api/config/v1.RequestHeaderIdentityProvider": schema_openshift_api_config_v1_RequestHeaderIdentityProvider(ref), - "github.com/openshift/api/config/v1.RequiredHSTSPolicy": schema_openshift_api_config_v1_RequiredHSTSPolicy(ref), - "github.com/openshift/api/config/v1.Scheduler": schema_openshift_api_config_v1_Scheduler(ref), - "github.com/openshift/api/config/v1.SchedulerList": schema_openshift_api_config_v1_SchedulerList(ref), - "github.com/openshift/api/config/v1.SchedulerSpec": schema_openshift_api_config_v1_SchedulerSpec(ref), - "github.com/openshift/api/config/v1.SchedulerStatus": schema_openshift_api_config_v1_SchedulerStatus(ref), - "github.com/openshift/api/config/v1.SecretNameReference": schema_openshift_api_config_v1_SecretNameReference(ref), - "github.com/openshift/api/config/v1.ServingInfo": schema_openshift_api_config_v1_ServingInfo(ref), - "github.com/openshift/api/config/v1.SignatureStore": schema_openshift_api_config_v1_SignatureStore(ref), - "github.com/openshift/api/config/v1.Storage": schema_openshift_api_config_v1_Storage(ref), - "github.com/openshift/api/config/v1.StringSource": schema_openshift_api_config_v1_StringSource(ref), - "github.com/openshift/api/config/v1.StringSourceSpec": schema_openshift_api_config_v1_StringSourceSpec(ref), - "github.com/openshift/api/config/v1.TLSProfileSpec": schema_openshift_api_config_v1_TLSProfileSpec(ref), - "github.com/openshift/api/config/v1.TLSSecurityProfile": schema_openshift_api_config_v1_TLSSecurityProfile(ref), - "github.com/openshift/api/config/v1.TemplateReference": schema_openshift_api_config_v1_TemplateReference(ref), - "github.com/openshift/api/config/v1.TestDetails": schema_openshift_api_config_v1_TestDetails(ref), - "github.com/openshift/api/config/v1.TestReporting": schema_openshift_api_config_v1_TestReporting(ref), - "github.com/openshift/api/config/v1.TestReportingSpec": schema_openshift_api_config_v1_TestReportingSpec(ref), - "github.com/openshift/api/config/v1.TestReportingStatus": schema_openshift_api_config_v1_TestReportingStatus(ref), - "github.com/openshift/api/config/v1.TokenClaimMapping": schema_openshift_api_config_v1_TokenClaimMapping(ref), - "github.com/openshift/api/config/v1.TokenClaimMappings": schema_openshift_api_config_v1_TokenClaimMappings(ref), - "github.com/openshift/api/config/v1.TokenClaimOrExpressionMapping": schema_openshift_api_config_v1_TokenClaimOrExpressionMapping(ref), - "github.com/openshift/api/config/v1.TokenClaimValidationCELRule": schema_openshift_api_config_v1_TokenClaimValidationCELRule(ref), - "github.com/openshift/api/config/v1.TokenClaimValidationRule": schema_openshift_api_config_v1_TokenClaimValidationRule(ref), - "github.com/openshift/api/config/v1.TokenConfig": schema_openshift_api_config_v1_TokenConfig(ref), - "github.com/openshift/api/config/v1.TokenIssuer": schema_openshift_api_config_v1_TokenIssuer(ref), - "github.com/openshift/api/config/v1.TokenRequiredClaim": schema_openshift_api_config_v1_TokenRequiredClaim(ref), - "github.com/openshift/api/config/v1.TokenUserValidationRule": schema_openshift_api_config_v1_TokenUserValidationRule(ref), - "github.com/openshift/api/config/v1.Update": schema_openshift_api_config_v1_Update(ref), - "github.com/openshift/api/config/v1.UpdateHistory": schema_openshift_api_config_v1_UpdateHistory(ref), - "github.com/openshift/api/config/v1.UsernameClaimMapping": schema_openshift_api_config_v1_UsernameClaimMapping(ref), - "github.com/openshift/api/config/v1.UsernamePrefix": schema_openshift_api_config_v1_UsernamePrefix(ref), - "github.com/openshift/api/config/v1.VSphereFailureDomainHostGroup": schema_openshift_api_config_v1_VSphereFailureDomainHostGroup(ref), - "github.com/openshift/api/config/v1.VSphereFailureDomainRegionAffinity": schema_openshift_api_config_v1_VSphereFailureDomainRegionAffinity(ref), - "github.com/openshift/api/config/v1.VSphereFailureDomainZoneAffinity": schema_openshift_api_config_v1_VSphereFailureDomainZoneAffinity(ref), - "github.com/openshift/api/config/v1.VSpherePlatformFailureDomainSpec": schema_openshift_api_config_v1_VSpherePlatformFailureDomainSpec(ref), - "github.com/openshift/api/config/v1.VSpherePlatformLoadBalancer": schema_openshift_api_config_v1_VSpherePlatformLoadBalancer(ref), - "github.com/openshift/api/config/v1.VSpherePlatformNodeNetworking": schema_openshift_api_config_v1_VSpherePlatformNodeNetworking(ref), - "github.com/openshift/api/config/v1.VSpherePlatformNodeNetworkingSpec": schema_openshift_api_config_v1_VSpherePlatformNodeNetworkingSpec(ref), - "github.com/openshift/api/config/v1.VSpherePlatformSpec": schema_openshift_api_config_v1_VSpherePlatformSpec(ref), - "github.com/openshift/api/config/v1.VSpherePlatformStatus": schema_openshift_api_config_v1_VSpherePlatformStatus(ref), - "github.com/openshift/api/config/v1.VSpherePlatformTopology": schema_openshift_api_config_v1_VSpherePlatformTopology(ref), - "github.com/openshift/api/config/v1.VSpherePlatformVCenterSpec": schema_openshift_api_config_v1_VSpherePlatformVCenterSpec(ref), - "github.com/openshift/api/config/v1.WebhookTokenAuthenticator": schema_openshift_api_config_v1_WebhookTokenAuthenticator(ref), - "github.com/openshift/api/config/v1alpha1.AlertmanagerConfig": schema_openshift_api_config_v1alpha1_AlertmanagerConfig(ref), - "github.com/openshift/api/config/v1alpha1.AlertmanagerCustomConfig": schema_openshift_api_config_v1alpha1_AlertmanagerCustomConfig(ref), - "github.com/openshift/api/config/v1alpha1.Audit": schema_openshift_api_config_v1alpha1_Audit(ref), - "github.com/openshift/api/config/v1alpha1.Backup": schema_openshift_api_config_v1alpha1_Backup(ref), - "github.com/openshift/api/config/v1alpha1.BackupList": schema_openshift_api_config_v1alpha1_BackupList(ref), - "github.com/openshift/api/config/v1alpha1.BackupSpec": schema_openshift_api_config_v1alpha1_BackupSpec(ref), - "github.com/openshift/api/config/v1alpha1.BackupStatus": schema_openshift_api_config_v1alpha1_BackupStatus(ref), - "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfig": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfig(ref), - "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigList": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigList(ref), - "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigSpec": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigSpec(ref), - "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigStatus": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigStatus(ref), - "github.com/openshift/api/config/v1alpha1.CertificateConfig": schema_openshift_api_config_v1alpha1_CertificateConfig(ref), - "github.com/openshift/api/config/v1alpha1.ClusterImagePolicy": schema_openshift_api_config_v1alpha1_ClusterImagePolicy(ref), - "github.com/openshift/api/config/v1alpha1.ClusterImagePolicyList": schema_openshift_api_config_v1alpha1_ClusterImagePolicyList(ref), - "github.com/openshift/api/config/v1alpha1.ClusterImagePolicySpec": schema_openshift_api_config_v1alpha1_ClusterImagePolicySpec(ref), - "github.com/openshift/api/config/v1alpha1.ClusterImagePolicyStatus": schema_openshift_api_config_v1alpha1_ClusterImagePolicyStatus(ref), - "github.com/openshift/api/config/v1alpha1.ClusterMonitoring": schema_openshift_api_config_v1alpha1_ClusterMonitoring(ref), - "github.com/openshift/api/config/v1alpha1.ClusterMonitoringList": schema_openshift_api_config_v1alpha1_ClusterMonitoringList(ref), - "github.com/openshift/api/config/v1alpha1.ClusterMonitoringSpec": schema_openshift_api_config_v1alpha1_ClusterMonitoringSpec(ref), - "github.com/openshift/api/config/v1alpha1.ClusterMonitoringStatus": schema_openshift_api_config_v1alpha1_ClusterMonitoringStatus(ref), - "github.com/openshift/api/config/v1alpha1.ContainerResource": schema_openshift_api_config_v1alpha1_ContainerResource(ref), - "github.com/openshift/api/config/v1alpha1.CustomPKIPolicy": schema_openshift_api_config_v1alpha1_CustomPKIPolicy(ref), - "github.com/openshift/api/config/v1alpha1.DefaultCertificateConfig": schema_openshift_api_config_v1alpha1_DefaultCertificateConfig(ref), - "github.com/openshift/api/config/v1alpha1.ECDSAKeyConfig": schema_openshift_api_config_v1alpha1_ECDSAKeyConfig(ref), - "github.com/openshift/api/config/v1alpha1.EtcdBackupSpec": schema_openshift_api_config_v1alpha1_EtcdBackupSpec(ref), - "github.com/openshift/api/config/v1alpha1.GatherConfig": schema_openshift_api_config_v1alpha1_GatherConfig(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicy": schema_openshift_api_config_v1alpha1_ImagePolicy(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicyFulcioCAWithRekorRootOfTrust": schema_openshift_api_config_v1alpha1_ImagePolicyFulcioCAWithRekorRootOfTrust(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicyList": schema_openshift_api_config_v1alpha1_ImagePolicyList(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicyPKIRootOfTrust": schema_openshift_api_config_v1alpha1_ImagePolicyPKIRootOfTrust(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicyPublicKeyRootOfTrust": schema_openshift_api_config_v1alpha1_ImagePolicyPublicKeyRootOfTrust(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicySpec": schema_openshift_api_config_v1alpha1_ImagePolicySpec(ref), - "github.com/openshift/api/config/v1alpha1.ImagePolicyStatus": schema_openshift_api_config_v1alpha1_ImagePolicyStatus(ref), - "github.com/openshift/api/config/v1alpha1.ImageSigstoreVerificationPolicy": schema_openshift_api_config_v1alpha1_ImageSigstoreVerificationPolicy(ref), - "github.com/openshift/api/config/v1alpha1.InsightsDataGather": schema_openshift_api_config_v1alpha1_InsightsDataGather(ref), - "github.com/openshift/api/config/v1alpha1.InsightsDataGatherList": schema_openshift_api_config_v1alpha1_InsightsDataGatherList(ref), - "github.com/openshift/api/config/v1alpha1.InsightsDataGatherSpec": schema_openshift_api_config_v1alpha1_InsightsDataGatherSpec(ref), - "github.com/openshift/api/config/v1alpha1.InsightsDataGatherStatus": schema_openshift_api_config_v1alpha1_InsightsDataGatherStatus(ref), - "github.com/openshift/api/config/v1alpha1.KeyConfig": schema_openshift_api_config_v1alpha1_KeyConfig(ref), - "github.com/openshift/api/config/v1alpha1.MetricsServerConfig": schema_openshift_api_config_v1alpha1_MetricsServerConfig(ref), - "github.com/openshift/api/config/v1alpha1.PKI": schema_openshift_api_config_v1alpha1_PKI(ref), - "github.com/openshift/api/config/v1alpha1.PKICertificateManagement": schema_openshift_api_config_v1alpha1_PKICertificateManagement(ref), - "github.com/openshift/api/config/v1alpha1.PKICertificateSubject": schema_openshift_api_config_v1alpha1_PKICertificateSubject(ref), - "github.com/openshift/api/config/v1alpha1.PKIList": schema_openshift_api_config_v1alpha1_PKIList(ref), - "github.com/openshift/api/config/v1alpha1.PKIProfile": schema_openshift_api_config_v1alpha1_PKIProfile(ref), - "github.com/openshift/api/config/v1alpha1.PKISpec": schema_openshift_api_config_v1alpha1_PKISpec(ref), - "github.com/openshift/api/config/v1alpha1.PersistentVolumeClaimReference": schema_openshift_api_config_v1alpha1_PersistentVolumeClaimReference(ref), - "github.com/openshift/api/config/v1alpha1.PersistentVolumeConfig": schema_openshift_api_config_v1alpha1_PersistentVolumeConfig(ref), - "github.com/openshift/api/config/v1alpha1.PolicyFulcioSubject": schema_openshift_api_config_v1alpha1_PolicyFulcioSubject(ref), - "github.com/openshift/api/config/v1alpha1.PolicyIdentity": schema_openshift_api_config_v1alpha1_PolicyIdentity(ref), - "github.com/openshift/api/config/v1alpha1.PolicyMatchExactRepository": schema_openshift_api_config_v1alpha1_PolicyMatchExactRepository(ref), - "github.com/openshift/api/config/v1alpha1.PolicyMatchRemapIdentity": schema_openshift_api_config_v1alpha1_PolicyMatchRemapIdentity(ref), - "github.com/openshift/api/config/v1alpha1.PolicyRootOfTrust": schema_openshift_api_config_v1alpha1_PolicyRootOfTrust(ref), - "github.com/openshift/api/config/v1alpha1.PrometheusOperatorAdmissionWebhookConfig": schema_openshift_api_config_v1alpha1_PrometheusOperatorAdmissionWebhookConfig(ref), - "github.com/openshift/api/config/v1alpha1.PrometheusOperatorConfig": schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref), - "github.com/openshift/api/config/v1alpha1.RSAKeyConfig": schema_openshift_api_config_v1alpha1_RSAKeyConfig(ref), - "github.com/openshift/api/config/v1alpha1.RetentionNumberConfig": schema_openshift_api_config_v1alpha1_RetentionNumberConfig(ref), - "github.com/openshift/api/config/v1alpha1.RetentionPolicy": schema_openshift_api_config_v1alpha1_RetentionPolicy(ref), - "github.com/openshift/api/config/v1alpha1.RetentionSizeConfig": schema_openshift_api_config_v1alpha1_RetentionSizeConfig(ref), - "github.com/openshift/api/config/v1alpha1.Storage": schema_openshift_api_config_v1alpha1_Storage(ref), - "github.com/openshift/api/config/v1alpha1.UserDefinedMonitoring": schema_openshift_api_config_v1alpha1_UserDefinedMonitoring(ref), - "github.com/openshift/api/config/v1alpha2.Custom": schema_openshift_api_config_v1alpha2_Custom(ref), - "github.com/openshift/api/config/v1alpha2.GatherConfig": schema_openshift_api_config_v1alpha2_GatherConfig(ref), - "github.com/openshift/api/config/v1alpha2.GathererConfig": schema_openshift_api_config_v1alpha2_GathererConfig(ref), - "github.com/openshift/api/config/v1alpha2.Gatherers": schema_openshift_api_config_v1alpha2_Gatherers(ref), - "github.com/openshift/api/config/v1alpha2.InsightsDataGather": schema_openshift_api_config_v1alpha2_InsightsDataGather(ref), - "github.com/openshift/api/config/v1alpha2.InsightsDataGatherList": schema_openshift_api_config_v1alpha2_InsightsDataGatherList(ref), - "github.com/openshift/api/config/v1alpha2.InsightsDataGatherSpec": schema_openshift_api_config_v1alpha2_InsightsDataGatherSpec(ref), - "github.com/openshift/api/config/v1alpha2.InsightsDataGatherStatus": schema_openshift_api_config_v1alpha2_InsightsDataGatherStatus(ref), - "github.com/openshift/api/config/v1alpha2.PersistentVolumeClaimReference": schema_openshift_api_config_v1alpha2_PersistentVolumeClaimReference(ref), - "github.com/openshift/api/config/v1alpha2.PersistentVolumeConfig": schema_openshift_api_config_v1alpha2_PersistentVolumeConfig(ref), - "github.com/openshift/api/config/v1alpha2.Storage": schema_openshift_api_config_v1alpha2_Storage(ref), - "github.com/openshift/api/console/v1.ApplicationMenuSpec": schema_openshift_api_console_v1_ApplicationMenuSpec(ref), - "github.com/openshift/api/console/v1.CLIDownloadLink": schema_openshift_api_console_v1_CLIDownloadLink(ref), - "github.com/openshift/api/console/v1.ConsoleCLIDownload": schema_openshift_api_console_v1_ConsoleCLIDownload(ref), - "github.com/openshift/api/console/v1.ConsoleCLIDownloadList": schema_openshift_api_console_v1_ConsoleCLIDownloadList(ref), - "github.com/openshift/api/console/v1.ConsoleCLIDownloadSpec": schema_openshift_api_console_v1_ConsoleCLIDownloadSpec(ref), - "github.com/openshift/api/console/v1.ConsoleExternalLogLink": schema_openshift_api_console_v1_ConsoleExternalLogLink(ref), - "github.com/openshift/api/console/v1.ConsoleExternalLogLinkList": schema_openshift_api_console_v1_ConsoleExternalLogLinkList(ref), - "github.com/openshift/api/console/v1.ConsoleExternalLogLinkSpec": schema_openshift_api_console_v1_ConsoleExternalLogLinkSpec(ref), - "github.com/openshift/api/console/v1.ConsoleLink": schema_openshift_api_console_v1_ConsoleLink(ref), - "github.com/openshift/api/console/v1.ConsoleLinkList": schema_openshift_api_console_v1_ConsoleLinkList(ref), - "github.com/openshift/api/console/v1.ConsoleLinkSpec": schema_openshift_api_console_v1_ConsoleLinkSpec(ref), - "github.com/openshift/api/console/v1.ConsoleNotification": schema_openshift_api_console_v1_ConsoleNotification(ref), - "github.com/openshift/api/console/v1.ConsoleNotificationList": schema_openshift_api_console_v1_ConsoleNotificationList(ref), - "github.com/openshift/api/console/v1.ConsoleNotificationSpec": schema_openshift_api_console_v1_ConsoleNotificationSpec(ref), - "github.com/openshift/api/console/v1.ConsolePlugin": schema_openshift_api_console_v1_ConsolePlugin(ref), - "github.com/openshift/api/console/v1.ConsolePluginBackend": schema_openshift_api_console_v1_ConsolePluginBackend(ref), - "github.com/openshift/api/console/v1.ConsolePluginCSP": schema_openshift_api_console_v1_ConsolePluginCSP(ref), - "github.com/openshift/api/console/v1.ConsolePluginI18n": schema_openshift_api_console_v1_ConsolePluginI18n(ref), - "github.com/openshift/api/console/v1.ConsolePluginList": schema_openshift_api_console_v1_ConsolePluginList(ref), - "github.com/openshift/api/console/v1.ConsolePluginProxy": schema_openshift_api_console_v1_ConsolePluginProxy(ref), - "github.com/openshift/api/console/v1.ConsolePluginProxyEndpoint": schema_openshift_api_console_v1_ConsolePluginProxyEndpoint(ref), - "github.com/openshift/api/console/v1.ConsolePluginProxyServiceConfig": schema_openshift_api_console_v1_ConsolePluginProxyServiceConfig(ref), - "github.com/openshift/api/console/v1.ConsolePluginService": schema_openshift_api_console_v1_ConsolePluginService(ref), - "github.com/openshift/api/console/v1.ConsolePluginSpec": schema_openshift_api_console_v1_ConsolePluginSpec(ref), - "github.com/openshift/api/console/v1.ConsoleQuickStart": schema_openshift_api_console_v1_ConsoleQuickStart(ref), - "github.com/openshift/api/console/v1.ConsoleQuickStartList": schema_openshift_api_console_v1_ConsoleQuickStartList(ref), - "github.com/openshift/api/console/v1.ConsoleQuickStartSpec": schema_openshift_api_console_v1_ConsoleQuickStartSpec(ref), - "github.com/openshift/api/console/v1.ConsoleQuickStartTask": schema_openshift_api_console_v1_ConsoleQuickStartTask(ref), - "github.com/openshift/api/console/v1.ConsoleQuickStartTaskReview": schema_openshift_api_console_v1_ConsoleQuickStartTaskReview(ref), - "github.com/openshift/api/console/v1.ConsoleQuickStartTaskSummary": schema_openshift_api_console_v1_ConsoleQuickStartTaskSummary(ref), - "github.com/openshift/api/console/v1.ConsoleSample": schema_openshift_api_console_v1_ConsoleSample(ref), - "github.com/openshift/api/console/v1.ConsoleSampleContainerImportSource": schema_openshift_api_console_v1_ConsoleSampleContainerImportSource(ref), - "github.com/openshift/api/console/v1.ConsoleSampleContainerImportSourceService": schema_openshift_api_console_v1_ConsoleSampleContainerImportSourceService(ref), - "github.com/openshift/api/console/v1.ConsoleSampleGitImportSource": schema_openshift_api_console_v1_ConsoleSampleGitImportSource(ref), - "github.com/openshift/api/console/v1.ConsoleSampleGitImportSourceRepository": schema_openshift_api_console_v1_ConsoleSampleGitImportSourceRepository(ref), - "github.com/openshift/api/console/v1.ConsoleSampleGitImportSourceService": schema_openshift_api_console_v1_ConsoleSampleGitImportSourceService(ref), - "github.com/openshift/api/console/v1.ConsoleSampleList": schema_openshift_api_console_v1_ConsoleSampleList(ref), - "github.com/openshift/api/console/v1.ConsoleSampleSource": schema_openshift_api_console_v1_ConsoleSampleSource(ref), - "github.com/openshift/api/console/v1.ConsoleSampleSpec": schema_openshift_api_console_v1_ConsoleSampleSpec(ref), - "github.com/openshift/api/console/v1.ConsoleYAMLSample": schema_openshift_api_console_v1_ConsoleYAMLSample(ref), - "github.com/openshift/api/console/v1.ConsoleYAMLSampleList": schema_openshift_api_console_v1_ConsoleYAMLSampleList(ref), - "github.com/openshift/api/console/v1.ConsoleYAMLSampleSpec": schema_openshift_api_console_v1_ConsoleYAMLSampleSpec(ref), - "github.com/openshift/api/console/v1.Link": schema_openshift_api_console_v1_Link(ref), - "github.com/openshift/api/console/v1.NamespaceDashboardSpec": schema_openshift_api_console_v1_NamespaceDashboardSpec(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerCluster": schema_openshift_api_etcd_v1alpha1_PacemakerCluster(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterFencingAgentStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterFencingAgentStatus(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterList": schema_openshift_api_etcd_v1alpha1_PacemakerClusterList(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterNodeStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterNodeStatus(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterResourceStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterResourceStatus(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterStatus(ref), - "github.com/openshift/api/etcd/v1alpha1.PacemakerNodeAddress": schema_openshift_api_etcd_v1alpha1_PacemakerNodeAddress(ref), - "github.com/openshift/api/example/v1.CELUnion": schema_openshift_api_example_v1_CELUnion(ref), - "github.com/openshift/api/example/v1.EvolvingUnion": schema_openshift_api_example_v1_EvolvingUnion(ref), - "github.com/openshift/api/example/v1.FormatMarkerExamples": schema_openshift_api_example_v1_FormatMarkerExamples(ref), - "github.com/openshift/api/example/v1.StableConfigType": schema_openshift_api_example_v1_StableConfigType(ref), - "github.com/openshift/api/example/v1.StableConfigTypeList": schema_openshift_api_example_v1_StableConfigTypeList(ref), - "github.com/openshift/api/example/v1.StableConfigTypeSpec": schema_openshift_api_example_v1_StableConfigTypeSpec(ref), - "github.com/openshift/api/example/v1.StableConfigTypeStatus": schema_openshift_api_example_v1_StableConfigTypeStatus(ref), - "github.com/openshift/api/example/v1.SubnetsWithExclusions": schema_openshift_api_example_v1_SubnetsWithExclusions(ref), - "github.com/openshift/api/example/v1alpha1.NotStableConfigType": schema_openshift_api_example_v1alpha1_NotStableConfigType(ref), - "github.com/openshift/api/example/v1alpha1.NotStableConfigTypeList": schema_openshift_api_example_v1alpha1_NotStableConfigTypeList(ref), - "github.com/openshift/api/example/v1alpha1.NotStableConfigTypeSpec": schema_openshift_api_example_v1alpha1_NotStableConfigTypeSpec(ref), - "github.com/openshift/api/example/v1alpha1.NotStableConfigTypeStatus": schema_openshift_api_example_v1alpha1_NotStableConfigTypeStatus(ref), - "github.com/openshift/api/helm/v1beta1.ConnectionConfig": schema_openshift_api_helm_v1beta1_ConnectionConfig(ref), - "github.com/openshift/api/helm/v1beta1.ConnectionConfigNamespaceScoped": schema_openshift_api_helm_v1beta1_ConnectionConfigNamespaceScoped(ref), - "github.com/openshift/api/helm/v1beta1.HelmChartRepository": schema_openshift_api_helm_v1beta1_HelmChartRepository(ref), - "github.com/openshift/api/helm/v1beta1.HelmChartRepositoryList": schema_openshift_api_helm_v1beta1_HelmChartRepositoryList(ref), - "github.com/openshift/api/helm/v1beta1.HelmChartRepositorySpec": schema_openshift_api_helm_v1beta1_HelmChartRepositorySpec(ref), - "github.com/openshift/api/helm/v1beta1.HelmChartRepositoryStatus": schema_openshift_api_helm_v1beta1_HelmChartRepositoryStatus(ref), - "github.com/openshift/api/helm/v1beta1.ProjectHelmChartRepository": schema_openshift_api_helm_v1beta1_ProjectHelmChartRepository(ref), - "github.com/openshift/api/helm/v1beta1.ProjectHelmChartRepositoryList": schema_openshift_api_helm_v1beta1_ProjectHelmChartRepositoryList(ref), - "github.com/openshift/api/helm/v1beta1.ProjectHelmChartRepositorySpec": schema_openshift_api_helm_v1beta1_ProjectHelmChartRepositorySpec(ref), - "github.com/openshift/api/image/v1.DockerImageReference": schema_openshift_api_image_v1_DockerImageReference(ref), - "github.com/openshift/api/image/v1.Image": schema_openshift_api_image_v1_Image(ref), - "github.com/openshift/api/image/v1.ImageBlobReferences": schema_openshift_api_image_v1_ImageBlobReferences(ref), - "github.com/openshift/api/image/v1.ImageImportSpec": schema_openshift_api_image_v1_ImageImportSpec(ref), - "github.com/openshift/api/image/v1.ImageImportStatus": schema_openshift_api_image_v1_ImageImportStatus(ref), - "github.com/openshift/api/image/v1.ImageLayer": schema_openshift_api_image_v1_ImageLayer(ref), - "github.com/openshift/api/image/v1.ImageLayerData": schema_openshift_api_image_v1_ImageLayerData(ref), - "github.com/openshift/api/image/v1.ImageList": schema_openshift_api_image_v1_ImageList(ref), - "github.com/openshift/api/image/v1.ImageLookupPolicy": schema_openshift_api_image_v1_ImageLookupPolicy(ref), - "github.com/openshift/api/image/v1.ImageManifest": schema_openshift_api_image_v1_ImageManifest(ref), - "github.com/openshift/api/image/v1.ImageSignature": schema_openshift_api_image_v1_ImageSignature(ref), - "github.com/openshift/api/image/v1.ImageStream": schema_openshift_api_image_v1_ImageStream(ref), - "github.com/openshift/api/image/v1.ImageStreamImage": schema_openshift_api_image_v1_ImageStreamImage(ref), - "github.com/openshift/api/image/v1.ImageStreamImport": schema_openshift_api_image_v1_ImageStreamImport(ref), - "github.com/openshift/api/image/v1.ImageStreamImportSpec": schema_openshift_api_image_v1_ImageStreamImportSpec(ref), - "github.com/openshift/api/image/v1.ImageStreamImportStatus": schema_openshift_api_image_v1_ImageStreamImportStatus(ref), - "github.com/openshift/api/image/v1.ImageStreamLayers": schema_openshift_api_image_v1_ImageStreamLayers(ref), - "github.com/openshift/api/image/v1.ImageStreamList": schema_openshift_api_image_v1_ImageStreamList(ref), - "github.com/openshift/api/image/v1.ImageStreamMapping": schema_openshift_api_image_v1_ImageStreamMapping(ref), - "github.com/openshift/api/image/v1.ImageStreamSpec": schema_openshift_api_image_v1_ImageStreamSpec(ref), - "github.com/openshift/api/image/v1.ImageStreamStatus": schema_openshift_api_image_v1_ImageStreamStatus(ref), - "github.com/openshift/api/image/v1.ImageStreamTag": schema_openshift_api_image_v1_ImageStreamTag(ref), - "github.com/openshift/api/image/v1.ImageStreamTagList": schema_openshift_api_image_v1_ImageStreamTagList(ref), - "github.com/openshift/api/image/v1.ImageTag": schema_openshift_api_image_v1_ImageTag(ref), - "github.com/openshift/api/image/v1.ImageTagList": schema_openshift_api_image_v1_ImageTagList(ref), - "github.com/openshift/api/image/v1.NamedTagEventList": schema_openshift_api_image_v1_NamedTagEventList(ref), - "github.com/openshift/api/image/v1.RepositoryImportSpec": schema_openshift_api_image_v1_RepositoryImportSpec(ref), - "github.com/openshift/api/image/v1.RepositoryImportStatus": schema_openshift_api_image_v1_RepositoryImportStatus(ref), - "github.com/openshift/api/image/v1.SecretList": schema_openshift_api_image_v1_SecretList(ref), - "github.com/openshift/api/image/v1.SignatureCondition": schema_openshift_api_image_v1_SignatureCondition(ref), - "github.com/openshift/api/image/v1.SignatureGenericEntity": schema_openshift_api_image_v1_SignatureGenericEntity(ref), - "github.com/openshift/api/image/v1.SignatureIssuer": schema_openshift_api_image_v1_SignatureIssuer(ref), - "github.com/openshift/api/image/v1.SignatureSubject": schema_openshift_api_image_v1_SignatureSubject(ref), - "github.com/openshift/api/image/v1.TagEvent": schema_openshift_api_image_v1_TagEvent(ref), - "github.com/openshift/api/image/v1.TagEventCondition": schema_openshift_api_image_v1_TagEventCondition(ref), - "github.com/openshift/api/image/v1.TagImportPolicy": schema_openshift_api_image_v1_TagImportPolicy(ref), - "github.com/openshift/api/image/v1.TagReference": schema_openshift_api_image_v1_TagReference(ref), - "github.com/openshift/api/image/v1.TagReferencePolicy": schema_openshift_api_image_v1_TagReferencePolicy(ref), - "github.com/openshift/api/insights/v1.Custom": schema_openshift_api_insights_v1_Custom(ref), - "github.com/openshift/api/insights/v1.DataGather": schema_openshift_api_insights_v1_DataGather(ref), - "github.com/openshift/api/insights/v1.DataGatherList": schema_openshift_api_insights_v1_DataGatherList(ref), - "github.com/openshift/api/insights/v1.DataGatherSpec": schema_openshift_api_insights_v1_DataGatherSpec(ref), - "github.com/openshift/api/insights/v1.DataGatherStatus": schema_openshift_api_insights_v1_DataGatherStatus(ref), - "github.com/openshift/api/insights/v1.GathererConfig": schema_openshift_api_insights_v1_GathererConfig(ref), - "github.com/openshift/api/insights/v1.GathererStatus": schema_openshift_api_insights_v1_GathererStatus(ref), - "github.com/openshift/api/insights/v1.Gatherers": schema_openshift_api_insights_v1_Gatherers(ref), - "github.com/openshift/api/insights/v1.HealthCheck": schema_openshift_api_insights_v1_HealthCheck(ref), - "github.com/openshift/api/insights/v1.InsightsReport": schema_openshift_api_insights_v1_InsightsReport(ref), - "github.com/openshift/api/insights/v1.ObjectReference": schema_openshift_api_insights_v1_ObjectReference(ref), - "github.com/openshift/api/insights/v1.PersistentVolumeClaimReference": schema_openshift_api_insights_v1_PersistentVolumeClaimReference(ref), - "github.com/openshift/api/insights/v1.PersistentVolumeConfig": schema_openshift_api_insights_v1_PersistentVolumeConfig(ref), - "github.com/openshift/api/insights/v1.Storage": schema_openshift_api_insights_v1_Storage(ref), - "github.com/openshift/api/insights/v1alpha1.DataGather": schema_openshift_api_insights_v1alpha1_DataGather(ref), - "github.com/openshift/api/insights/v1alpha1.DataGatherList": schema_openshift_api_insights_v1alpha1_DataGatherList(ref), - "github.com/openshift/api/insights/v1alpha1.DataGatherSpec": schema_openshift_api_insights_v1alpha1_DataGatherSpec(ref), - "github.com/openshift/api/insights/v1alpha1.DataGatherStatus": schema_openshift_api_insights_v1alpha1_DataGatherStatus(ref), - "github.com/openshift/api/insights/v1alpha1.GathererConfig": schema_openshift_api_insights_v1alpha1_GathererConfig(ref), - "github.com/openshift/api/insights/v1alpha1.GathererStatus": schema_openshift_api_insights_v1alpha1_GathererStatus(ref), - "github.com/openshift/api/insights/v1alpha1.HealthCheck": schema_openshift_api_insights_v1alpha1_HealthCheck(ref), - "github.com/openshift/api/insights/v1alpha1.InsightsReport": schema_openshift_api_insights_v1alpha1_InsightsReport(ref), - "github.com/openshift/api/insights/v1alpha1.ObjectReference": schema_openshift_api_insights_v1alpha1_ObjectReference(ref), - "github.com/openshift/api/insights/v1alpha1.PersistentVolumeClaimReference": schema_openshift_api_insights_v1alpha1_PersistentVolumeClaimReference(ref), - "github.com/openshift/api/insights/v1alpha1.PersistentVolumeConfig": schema_openshift_api_insights_v1alpha1_PersistentVolumeConfig(ref), - "github.com/openshift/api/insights/v1alpha1.Storage": schema_openshift_api_insights_v1alpha1_Storage(ref), - "github.com/openshift/api/insights/v1alpha2.Custom": schema_openshift_api_insights_v1alpha2_Custom(ref), - "github.com/openshift/api/insights/v1alpha2.DataGather": schema_openshift_api_insights_v1alpha2_DataGather(ref), - "github.com/openshift/api/insights/v1alpha2.DataGatherList": schema_openshift_api_insights_v1alpha2_DataGatherList(ref), - "github.com/openshift/api/insights/v1alpha2.DataGatherSpec": schema_openshift_api_insights_v1alpha2_DataGatherSpec(ref), - "github.com/openshift/api/insights/v1alpha2.DataGatherStatus": schema_openshift_api_insights_v1alpha2_DataGatherStatus(ref), - "github.com/openshift/api/insights/v1alpha2.GathererConfig": schema_openshift_api_insights_v1alpha2_GathererConfig(ref), - "github.com/openshift/api/insights/v1alpha2.GathererStatus": schema_openshift_api_insights_v1alpha2_GathererStatus(ref), - "github.com/openshift/api/insights/v1alpha2.Gatherers": schema_openshift_api_insights_v1alpha2_Gatherers(ref), - "github.com/openshift/api/insights/v1alpha2.HealthCheck": schema_openshift_api_insights_v1alpha2_HealthCheck(ref), - "github.com/openshift/api/insights/v1alpha2.InsightsReport": schema_openshift_api_insights_v1alpha2_InsightsReport(ref), - "github.com/openshift/api/insights/v1alpha2.ObjectReference": schema_openshift_api_insights_v1alpha2_ObjectReference(ref), - "github.com/openshift/api/insights/v1alpha2.PersistentVolumeClaimReference": schema_openshift_api_insights_v1alpha2_PersistentVolumeClaimReference(ref), - "github.com/openshift/api/insights/v1alpha2.PersistentVolumeConfig": schema_openshift_api_insights_v1alpha2_PersistentVolumeConfig(ref), - "github.com/openshift/api/insights/v1alpha2.Storage": schema_openshift_api_insights_v1alpha2_Storage(ref), - "github.com/openshift/api/kubecontrolplane/v1.AggregatorConfig": schema_openshift_api_kubecontrolplane_v1_AggregatorConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.KubeAPIServerConfig": schema_openshift_api_kubecontrolplane_v1_KubeAPIServerConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.KubeAPIServerImagePolicyConfig": schema_openshift_api_kubecontrolplane_v1_KubeAPIServerImagePolicyConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.KubeAPIServerProjectConfig": schema_openshift_api_kubecontrolplane_v1_KubeAPIServerProjectConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.KubeControllerManagerConfig": schema_openshift_api_kubecontrolplane_v1_KubeControllerManagerConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.KubeControllerManagerProjectConfig": schema_openshift_api_kubecontrolplane_v1_KubeControllerManagerProjectConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.KubeletConnectionInfo": schema_openshift_api_kubecontrolplane_v1_KubeletConnectionInfo(ref), - "github.com/openshift/api/kubecontrolplane/v1.MasterAuthConfig": schema_openshift_api_kubecontrolplane_v1_MasterAuthConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.RequestHeaderAuthenticationOptions": schema_openshift_api_kubecontrolplane_v1_RequestHeaderAuthenticationOptions(ref), - "github.com/openshift/api/kubecontrolplane/v1.ServiceServingCert": schema_openshift_api_kubecontrolplane_v1_ServiceServingCert(ref), - "github.com/openshift/api/kubecontrolplane/v1.UserAgentDenyRule": schema_openshift_api_kubecontrolplane_v1_UserAgentDenyRule(ref), - "github.com/openshift/api/kubecontrolplane/v1.UserAgentMatchRule": schema_openshift_api_kubecontrolplane_v1_UserAgentMatchRule(ref), - "github.com/openshift/api/kubecontrolplane/v1.UserAgentMatchingConfig": schema_openshift_api_kubecontrolplane_v1_UserAgentMatchingConfig(ref), - "github.com/openshift/api/kubecontrolplane/v1.WebhookTokenAuthenticator": schema_openshift_api_kubecontrolplane_v1_WebhookTokenAuthenticator(ref), - "github.com/openshift/api/legacyconfig/v1.ActiveDirectoryConfig": schema_openshift_api_legacyconfig_v1_ActiveDirectoryConfig(ref), - "github.com/openshift/api/legacyconfig/v1.AdmissionConfig": schema_openshift_api_legacyconfig_v1_AdmissionConfig(ref), - "github.com/openshift/api/legacyconfig/v1.AdmissionPluginConfig": schema_openshift_api_legacyconfig_v1_AdmissionPluginConfig(ref), - "github.com/openshift/api/legacyconfig/v1.AggregatorConfig": schema_openshift_api_legacyconfig_v1_AggregatorConfig(ref), - "github.com/openshift/api/legacyconfig/v1.AllowAllPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_AllowAllPasswordIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.AuditConfig": schema_openshift_api_legacyconfig_v1_AuditConfig(ref), - "github.com/openshift/api/legacyconfig/v1.AugmentedActiveDirectoryConfig": schema_openshift_api_legacyconfig_v1_AugmentedActiveDirectoryConfig(ref), - "github.com/openshift/api/legacyconfig/v1.BasicAuthPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_BasicAuthPasswordIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.BuildDefaultsConfig": schema_openshift_api_legacyconfig_v1_BuildDefaultsConfig(ref), - "github.com/openshift/api/legacyconfig/v1.BuildOverridesConfig": schema_openshift_api_legacyconfig_v1_BuildOverridesConfig(ref), - "github.com/openshift/api/legacyconfig/v1.CertInfo": schema_openshift_api_legacyconfig_v1_CertInfo(ref), - "github.com/openshift/api/legacyconfig/v1.ClientConnectionOverrides": schema_openshift_api_legacyconfig_v1_ClientConnectionOverrides(ref), - "github.com/openshift/api/legacyconfig/v1.ClusterNetworkEntry": schema_openshift_api_legacyconfig_v1_ClusterNetworkEntry(ref), - "github.com/openshift/api/legacyconfig/v1.ControllerConfig": schema_openshift_api_legacyconfig_v1_ControllerConfig(ref), - "github.com/openshift/api/legacyconfig/v1.ControllerElectionConfig": schema_openshift_api_legacyconfig_v1_ControllerElectionConfig(ref), - "github.com/openshift/api/legacyconfig/v1.DNSConfig": schema_openshift_api_legacyconfig_v1_DNSConfig(ref), - "github.com/openshift/api/legacyconfig/v1.DefaultAdmissionConfig": schema_openshift_api_legacyconfig_v1_DefaultAdmissionConfig(ref), - "github.com/openshift/api/legacyconfig/v1.DenyAllPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_DenyAllPasswordIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.DockerConfig": schema_openshift_api_legacyconfig_v1_DockerConfig(ref), - "github.com/openshift/api/legacyconfig/v1.EtcdConfig": schema_openshift_api_legacyconfig_v1_EtcdConfig(ref), - "github.com/openshift/api/legacyconfig/v1.EtcdConnectionInfo": schema_openshift_api_legacyconfig_v1_EtcdConnectionInfo(ref), - "github.com/openshift/api/legacyconfig/v1.EtcdStorageConfig": schema_openshift_api_legacyconfig_v1_EtcdStorageConfig(ref), - "github.com/openshift/api/legacyconfig/v1.GitHubIdentityProvider": schema_openshift_api_legacyconfig_v1_GitHubIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.GitLabIdentityProvider": schema_openshift_api_legacyconfig_v1_GitLabIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.GoogleIdentityProvider": schema_openshift_api_legacyconfig_v1_GoogleIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.GrantConfig": schema_openshift_api_legacyconfig_v1_GrantConfig(ref), - "github.com/openshift/api/legacyconfig/v1.GroupResource": schema_openshift_api_legacyconfig_v1_GroupResource(ref), - "github.com/openshift/api/legacyconfig/v1.HTPasswdPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_HTPasswdPasswordIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.HTTPServingInfo": schema_openshift_api_legacyconfig_v1_HTTPServingInfo(ref), - "github.com/openshift/api/legacyconfig/v1.IdentityProvider": schema_openshift_api_legacyconfig_v1_IdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.ImageConfig": schema_openshift_api_legacyconfig_v1_ImageConfig(ref), - "github.com/openshift/api/legacyconfig/v1.ImagePolicyConfig": schema_openshift_api_legacyconfig_v1_ImagePolicyConfig(ref), - "github.com/openshift/api/legacyconfig/v1.JenkinsPipelineConfig": schema_openshift_api_legacyconfig_v1_JenkinsPipelineConfig(ref), - "github.com/openshift/api/legacyconfig/v1.KeystonePasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_KeystonePasswordIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.KubeletConnectionInfo": schema_openshift_api_legacyconfig_v1_KubeletConnectionInfo(ref), - "github.com/openshift/api/legacyconfig/v1.KubernetesMasterConfig": schema_openshift_api_legacyconfig_v1_KubernetesMasterConfig(ref), - "github.com/openshift/api/legacyconfig/v1.LDAPAttributeMapping": schema_openshift_api_legacyconfig_v1_LDAPAttributeMapping(ref), - "github.com/openshift/api/legacyconfig/v1.LDAPPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_LDAPPasswordIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.LDAPQuery": schema_openshift_api_legacyconfig_v1_LDAPQuery(ref), - "github.com/openshift/api/legacyconfig/v1.LDAPSyncConfig": schema_openshift_api_legacyconfig_v1_LDAPSyncConfig(ref), - "github.com/openshift/api/legacyconfig/v1.LocalQuota": schema_openshift_api_legacyconfig_v1_LocalQuota(ref), - "github.com/openshift/api/legacyconfig/v1.MasterAuthConfig": schema_openshift_api_legacyconfig_v1_MasterAuthConfig(ref), - "github.com/openshift/api/legacyconfig/v1.MasterClients": schema_openshift_api_legacyconfig_v1_MasterClients(ref), - "github.com/openshift/api/legacyconfig/v1.MasterConfig": schema_openshift_api_legacyconfig_v1_MasterConfig(ref), - "github.com/openshift/api/legacyconfig/v1.MasterNetworkConfig": schema_openshift_api_legacyconfig_v1_MasterNetworkConfig(ref), - "github.com/openshift/api/legacyconfig/v1.MasterVolumeConfig": schema_openshift_api_legacyconfig_v1_MasterVolumeConfig(ref), - "github.com/openshift/api/legacyconfig/v1.NamedCertificate": schema_openshift_api_legacyconfig_v1_NamedCertificate(ref), - "github.com/openshift/api/legacyconfig/v1.NodeAuthConfig": schema_openshift_api_legacyconfig_v1_NodeAuthConfig(ref), - "github.com/openshift/api/legacyconfig/v1.NodeConfig": schema_openshift_api_legacyconfig_v1_NodeConfig(ref), - "github.com/openshift/api/legacyconfig/v1.NodeNetworkConfig": schema_openshift_api_legacyconfig_v1_NodeNetworkConfig(ref), - "github.com/openshift/api/legacyconfig/v1.NodeVolumeConfig": schema_openshift_api_legacyconfig_v1_NodeVolumeConfig(ref), - "github.com/openshift/api/legacyconfig/v1.OAuthConfig": schema_openshift_api_legacyconfig_v1_OAuthConfig(ref), - "github.com/openshift/api/legacyconfig/v1.OAuthTemplates": schema_openshift_api_legacyconfig_v1_OAuthTemplates(ref), - "github.com/openshift/api/legacyconfig/v1.OpenIDClaims": schema_openshift_api_legacyconfig_v1_OpenIDClaims(ref), - "github.com/openshift/api/legacyconfig/v1.OpenIDIdentityProvider": schema_openshift_api_legacyconfig_v1_OpenIDIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.OpenIDURLs": schema_openshift_api_legacyconfig_v1_OpenIDURLs(ref), - "github.com/openshift/api/legacyconfig/v1.PodManifestConfig": schema_openshift_api_legacyconfig_v1_PodManifestConfig(ref), - "github.com/openshift/api/legacyconfig/v1.PolicyConfig": schema_openshift_api_legacyconfig_v1_PolicyConfig(ref), - "github.com/openshift/api/legacyconfig/v1.ProjectConfig": schema_openshift_api_legacyconfig_v1_ProjectConfig(ref), - "github.com/openshift/api/legacyconfig/v1.RFC2307Config": schema_openshift_api_legacyconfig_v1_RFC2307Config(ref), - "github.com/openshift/api/legacyconfig/v1.RegistryLocation": schema_openshift_api_legacyconfig_v1_RegistryLocation(ref), - "github.com/openshift/api/legacyconfig/v1.RemoteConnectionInfo": schema_openshift_api_legacyconfig_v1_RemoteConnectionInfo(ref), - "github.com/openshift/api/legacyconfig/v1.RequestHeaderAuthenticationOptions": schema_openshift_api_legacyconfig_v1_RequestHeaderAuthenticationOptions(ref), - "github.com/openshift/api/legacyconfig/v1.RequestHeaderIdentityProvider": schema_openshift_api_legacyconfig_v1_RequestHeaderIdentityProvider(ref), - "github.com/openshift/api/legacyconfig/v1.RoutingConfig": schema_openshift_api_legacyconfig_v1_RoutingConfig(ref), - "github.com/openshift/api/legacyconfig/v1.SecurityAllocator": schema_openshift_api_legacyconfig_v1_SecurityAllocator(ref), - "github.com/openshift/api/legacyconfig/v1.ServiceAccountConfig": schema_openshift_api_legacyconfig_v1_ServiceAccountConfig(ref), - "github.com/openshift/api/legacyconfig/v1.ServiceServingCert": schema_openshift_api_legacyconfig_v1_ServiceServingCert(ref), - "github.com/openshift/api/legacyconfig/v1.ServingInfo": schema_openshift_api_legacyconfig_v1_ServingInfo(ref), - "github.com/openshift/api/legacyconfig/v1.SessionConfig": schema_openshift_api_legacyconfig_v1_SessionConfig(ref), - "github.com/openshift/api/legacyconfig/v1.SessionSecret": schema_openshift_api_legacyconfig_v1_SessionSecret(ref), - "github.com/openshift/api/legacyconfig/v1.SessionSecrets": schema_openshift_api_legacyconfig_v1_SessionSecrets(ref), - "github.com/openshift/api/legacyconfig/v1.SourceStrategyDefaultsConfig": schema_openshift_api_legacyconfig_v1_SourceStrategyDefaultsConfig(ref), - "github.com/openshift/api/legacyconfig/v1.StringSource": schema_openshift_api_legacyconfig_v1_StringSource(ref), - "github.com/openshift/api/legacyconfig/v1.StringSourceSpec": schema_openshift_api_legacyconfig_v1_StringSourceSpec(ref), - "github.com/openshift/api/legacyconfig/v1.TokenConfig": schema_openshift_api_legacyconfig_v1_TokenConfig(ref), - "github.com/openshift/api/legacyconfig/v1.UserAgentDenyRule": schema_openshift_api_legacyconfig_v1_UserAgentDenyRule(ref), - "github.com/openshift/api/legacyconfig/v1.UserAgentMatchRule": schema_openshift_api_legacyconfig_v1_UserAgentMatchRule(ref), - "github.com/openshift/api/legacyconfig/v1.UserAgentMatchingConfig": schema_openshift_api_legacyconfig_v1_UserAgentMatchingConfig(ref), - "github.com/openshift/api/legacyconfig/v1.WebhookTokenAuthenticator": schema_openshift_api_legacyconfig_v1_WebhookTokenAuthenticator(ref), - "github.com/openshift/api/machine/v1.AWSFailureDomain": schema_openshift_api_machine_v1_AWSFailureDomain(ref), - "github.com/openshift/api/machine/v1.AWSFailureDomainPlacement": schema_openshift_api_machine_v1_AWSFailureDomainPlacement(ref), - "github.com/openshift/api/machine/v1.AWSResourceFilter": schema_openshift_api_machine_v1_AWSResourceFilter(ref), - "github.com/openshift/api/machine/v1.AWSResourceReference": schema_openshift_api_machine_v1_AWSResourceReference(ref), - "github.com/openshift/api/machine/v1.AlibabaCloudMachineProviderConfig": schema_openshift_api_machine_v1_AlibabaCloudMachineProviderConfig(ref), - "github.com/openshift/api/machine/v1.AlibabaCloudMachineProviderConfigList": schema_openshift_api_machine_v1_AlibabaCloudMachineProviderConfigList(ref), - "github.com/openshift/api/machine/v1.AlibabaCloudMachineProviderStatus": schema_openshift_api_machine_v1_AlibabaCloudMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1.AlibabaResourceReference": schema_openshift_api_machine_v1_AlibabaResourceReference(ref), - "github.com/openshift/api/machine/v1.AzureFailureDomain": schema_openshift_api_machine_v1_AzureFailureDomain(ref), - "github.com/openshift/api/machine/v1.BandwidthProperties": schema_openshift_api_machine_v1_BandwidthProperties(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSet": schema_openshift_api_machine_v1_ControlPlaneMachineSet(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSetList": schema_openshift_api_machine_v1_ControlPlaneMachineSetList(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSetSpec": schema_openshift_api_machine_v1_ControlPlaneMachineSetSpec(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSetStatus": schema_openshift_api_machine_v1_ControlPlaneMachineSetStatus(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSetStrategy": schema_openshift_api_machine_v1_ControlPlaneMachineSetStrategy(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSetTemplate": schema_openshift_api_machine_v1_ControlPlaneMachineSetTemplate(ref), - "github.com/openshift/api/machine/v1.ControlPlaneMachineSetTemplateObjectMeta": schema_openshift_api_machine_v1_ControlPlaneMachineSetTemplateObjectMeta(ref), - "github.com/openshift/api/machine/v1.DataDiskProperties": schema_openshift_api_machine_v1_DataDiskProperties(ref), - "github.com/openshift/api/machine/v1.FailureDomains": schema_openshift_api_machine_v1_FailureDomains(ref), - "github.com/openshift/api/machine/v1.GCPFailureDomain": schema_openshift_api_machine_v1_GCPFailureDomain(ref), - "github.com/openshift/api/machine/v1.LoadBalancerReference": schema_openshift_api_machine_v1_LoadBalancerReference(ref), - "github.com/openshift/api/machine/v1.NutanixCategory": schema_openshift_api_machine_v1_NutanixCategory(ref), - "github.com/openshift/api/machine/v1.NutanixFailureDomainReference": schema_openshift_api_machine_v1_NutanixFailureDomainReference(ref), - "github.com/openshift/api/machine/v1.NutanixGPU": schema_openshift_api_machine_v1_NutanixGPU(ref), - "github.com/openshift/api/machine/v1.NutanixMachineProviderConfig": schema_openshift_api_machine_v1_NutanixMachineProviderConfig(ref), - "github.com/openshift/api/machine/v1.NutanixMachineProviderStatus": schema_openshift_api_machine_v1_NutanixMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1.NutanixResourceIdentifier": schema_openshift_api_machine_v1_NutanixResourceIdentifier(ref), - "github.com/openshift/api/machine/v1.NutanixStorageResourceIdentifier": schema_openshift_api_machine_v1_NutanixStorageResourceIdentifier(ref), - "github.com/openshift/api/machine/v1.NutanixVMDisk": schema_openshift_api_machine_v1_NutanixVMDisk(ref), - "github.com/openshift/api/machine/v1.NutanixVMDiskDeviceProperties": schema_openshift_api_machine_v1_NutanixVMDiskDeviceProperties(ref), - "github.com/openshift/api/machine/v1.NutanixVMStorageConfig": schema_openshift_api_machine_v1_NutanixVMStorageConfig(ref), - "github.com/openshift/api/machine/v1.OpenShiftMachineV1Beta1MachineTemplate": schema_openshift_api_machine_v1_OpenShiftMachineV1Beta1MachineTemplate(ref), - "github.com/openshift/api/machine/v1.OpenStackFailureDomain": schema_openshift_api_machine_v1_OpenStackFailureDomain(ref), - "github.com/openshift/api/machine/v1.PowerVSMachineProviderConfig": schema_openshift_api_machine_v1_PowerVSMachineProviderConfig(ref), - "github.com/openshift/api/machine/v1.PowerVSMachineProviderStatus": schema_openshift_api_machine_v1_PowerVSMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1.PowerVSResource": schema_openshift_api_machine_v1_PowerVSResource(ref), - "github.com/openshift/api/machine/v1.PowerVSSecretReference": schema_openshift_api_machine_v1_PowerVSSecretReference(ref), - "github.com/openshift/api/machine/v1.RootVolume": schema_openshift_api_machine_v1_RootVolume(ref), - "github.com/openshift/api/machine/v1.SystemDiskProperties": schema_openshift_api_machine_v1_SystemDiskProperties(ref), - "github.com/openshift/api/machine/v1.Tag": schema_openshift_api_machine_v1_Tag(ref), - "github.com/openshift/api/machine/v1.VSphereFailureDomain": schema_openshift_api_machine_v1_VSphereFailureDomain(ref), - "github.com/openshift/api/machine/v1alpha1.AdditionalBlockDevice": schema_openshift_api_machine_v1alpha1_AdditionalBlockDevice(ref), - "github.com/openshift/api/machine/v1alpha1.AddressPair": schema_openshift_api_machine_v1alpha1_AddressPair(ref), - "github.com/openshift/api/machine/v1alpha1.BlockDeviceStorage": schema_openshift_api_machine_v1alpha1_BlockDeviceStorage(ref), - "github.com/openshift/api/machine/v1alpha1.BlockDeviceVolume": schema_openshift_api_machine_v1alpha1_BlockDeviceVolume(ref), - "github.com/openshift/api/machine/v1alpha1.Filter": schema_openshift_api_machine_v1alpha1_Filter(ref), - "github.com/openshift/api/machine/v1alpha1.FixedIPs": schema_openshift_api_machine_v1alpha1_FixedIPs(ref), - "github.com/openshift/api/machine/v1alpha1.NetworkParam": schema_openshift_api_machine_v1alpha1_NetworkParam(ref), - "github.com/openshift/api/machine/v1alpha1.OpenstackProviderSpec": schema_openshift_api_machine_v1alpha1_OpenstackProviderSpec(ref), - "github.com/openshift/api/machine/v1alpha1.PortOpts": schema_openshift_api_machine_v1alpha1_PortOpts(ref), - "github.com/openshift/api/machine/v1alpha1.RootVolume": schema_openshift_api_machine_v1alpha1_RootVolume(ref), - "github.com/openshift/api/machine/v1alpha1.SecurityGroupFilter": schema_openshift_api_machine_v1alpha1_SecurityGroupFilter(ref), - "github.com/openshift/api/machine/v1alpha1.SecurityGroupParam": schema_openshift_api_machine_v1alpha1_SecurityGroupParam(ref), - "github.com/openshift/api/machine/v1alpha1.SubnetFilter": schema_openshift_api_machine_v1alpha1_SubnetFilter(ref), - "github.com/openshift/api/machine/v1alpha1.SubnetParam": schema_openshift_api_machine_v1alpha1_SubnetParam(ref), - "github.com/openshift/api/machine/v1beta1.AWSMachineProviderConfig": schema_openshift_api_machine_v1beta1_AWSMachineProviderConfig(ref), - "github.com/openshift/api/machine/v1beta1.AWSMachineProviderConfigList": schema_openshift_api_machine_v1beta1_AWSMachineProviderConfigList(ref), - "github.com/openshift/api/machine/v1beta1.AWSMachineProviderStatus": schema_openshift_api_machine_v1beta1_AWSMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1beta1.AWSResourceReference": schema_openshift_api_machine_v1beta1_AWSResourceReference(ref), - "github.com/openshift/api/machine/v1beta1.AddressesFromPool": schema_openshift_api_machine_v1beta1_AddressesFromPool(ref), - "github.com/openshift/api/machine/v1beta1.AzureBootDiagnostics": schema_openshift_api_machine_v1beta1_AzureBootDiagnostics(ref), - "github.com/openshift/api/machine/v1beta1.AzureCustomerManagedBootDiagnostics": schema_openshift_api_machine_v1beta1_AzureCustomerManagedBootDiagnostics(ref), - "github.com/openshift/api/machine/v1beta1.AzureDiagnostics": schema_openshift_api_machine_v1beta1_AzureDiagnostics(ref), - "github.com/openshift/api/machine/v1beta1.AzureMachineProviderSpec": schema_openshift_api_machine_v1beta1_AzureMachineProviderSpec(ref), - "github.com/openshift/api/machine/v1beta1.AzureMachineProviderStatus": schema_openshift_api_machine_v1beta1_AzureMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1beta1.BlockDeviceMappingSpec": schema_openshift_api_machine_v1beta1_BlockDeviceMappingSpec(ref), - "github.com/openshift/api/machine/v1beta1.CPUOptions": schema_openshift_api_machine_v1beta1_CPUOptions(ref), - "github.com/openshift/api/machine/v1beta1.Condition": schema_openshift_api_machine_v1beta1_Condition(ref), - "github.com/openshift/api/machine/v1beta1.ConfidentialVM": schema_openshift_api_machine_v1beta1_ConfidentialVM(ref), - "github.com/openshift/api/machine/v1beta1.DataDisk": schema_openshift_api_machine_v1beta1_DataDisk(ref), - "github.com/openshift/api/machine/v1beta1.DataDiskManagedDiskParameters": schema_openshift_api_machine_v1beta1_DataDiskManagedDiskParameters(ref), - "github.com/openshift/api/machine/v1beta1.DedicatedHost": schema_openshift_api_machine_v1beta1_DedicatedHost(ref), - "github.com/openshift/api/machine/v1beta1.DedicatedHostStatus": schema_openshift_api_machine_v1beta1_DedicatedHostStatus(ref), - "github.com/openshift/api/machine/v1beta1.DiskEncryptionSetParameters": schema_openshift_api_machine_v1beta1_DiskEncryptionSetParameters(ref), - "github.com/openshift/api/machine/v1beta1.DiskSettings": schema_openshift_api_machine_v1beta1_DiskSettings(ref), - "github.com/openshift/api/machine/v1beta1.DynamicHostAllocationSpec": schema_openshift_api_machine_v1beta1_DynamicHostAllocationSpec(ref), - "github.com/openshift/api/machine/v1beta1.EBSBlockDeviceSpec": schema_openshift_api_machine_v1beta1_EBSBlockDeviceSpec(ref), - "github.com/openshift/api/machine/v1beta1.Filter": schema_openshift_api_machine_v1beta1_Filter(ref), - "github.com/openshift/api/machine/v1beta1.GCPDisk": schema_openshift_api_machine_v1beta1_GCPDisk(ref), - "github.com/openshift/api/machine/v1beta1.GCPEncryptionKeyReference": schema_openshift_api_machine_v1beta1_GCPEncryptionKeyReference(ref), - "github.com/openshift/api/machine/v1beta1.GCPGPUConfig": schema_openshift_api_machine_v1beta1_GCPGPUConfig(ref), - "github.com/openshift/api/machine/v1beta1.GCPKMSKeyReference": schema_openshift_api_machine_v1beta1_GCPKMSKeyReference(ref), - "github.com/openshift/api/machine/v1beta1.GCPMachineProviderSpec": schema_openshift_api_machine_v1beta1_GCPMachineProviderSpec(ref), - "github.com/openshift/api/machine/v1beta1.GCPMachineProviderStatus": schema_openshift_api_machine_v1beta1_GCPMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1beta1.GCPMetadata": schema_openshift_api_machine_v1beta1_GCPMetadata(ref), - "github.com/openshift/api/machine/v1beta1.GCPNetworkInterface": schema_openshift_api_machine_v1beta1_GCPNetworkInterface(ref), - "github.com/openshift/api/machine/v1beta1.GCPServiceAccount": schema_openshift_api_machine_v1beta1_GCPServiceAccount(ref), - "github.com/openshift/api/machine/v1beta1.GCPShieldedInstanceConfig": schema_openshift_api_machine_v1beta1_GCPShieldedInstanceConfig(ref), - "github.com/openshift/api/machine/v1beta1.HostPlacement": schema_openshift_api_machine_v1beta1_HostPlacement(ref), - "github.com/openshift/api/machine/v1beta1.Image": schema_openshift_api_machine_v1beta1_Image(ref), - "github.com/openshift/api/machine/v1beta1.LastOperation": schema_openshift_api_machine_v1beta1_LastOperation(ref), - "github.com/openshift/api/machine/v1beta1.LifecycleHook": schema_openshift_api_machine_v1beta1_LifecycleHook(ref), - "github.com/openshift/api/machine/v1beta1.LifecycleHooks": schema_openshift_api_machine_v1beta1_LifecycleHooks(ref), - "github.com/openshift/api/machine/v1beta1.LoadBalancerReference": schema_openshift_api_machine_v1beta1_LoadBalancerReference(ref), - "github.com/openshift/api/machine/v1beta1.Machine": schema_openshift_api_machine_v1beta1_Machine(ref), - "github.com/openshift/api/machine/v1beta1.MachineHealthCheck": schema_openshift_api_machine_v1beta1_MachineHealthCheck(ref), - "github.com/openshift/api/machine/v1beta1.MachineHealthCheckList": schema_openshift_api_machine_v1beta1_MachineHealthCheckList(ref), - "github.com/openshift/api/machine/v1beta1.MachineHealthCheckSpec": schema_openshift_api_machine_v1beta1_MachineHealthCheckSpec(ref), - "github.com/openshift/api/machine/v1beta1.MachineHealthCheckStatus": schema_openshift_api_machine_v1beta1_MachineHealthCheckStatus(ref), - "github.com/openshift/api/machine/v1beta1.MachineList": schema_openshift_api_machine_v1beta1_MachineList(ref), - "github.com/openshift/api/machine/v1beta1.MachineSet": schema_openshift_api_machine_v1beta1_MachineSet(ref), - "github.com/openshift/api/machine/v1beta1.MachineSetList": schema_openshift_api_machine_v1beta1_MachineSetList(ref), - "github.com/openshift/api/machine/v1beta1.MachineSetSpec": schema_openshift_api_machine_v1beta1_MachineSetSpec(ref), - "github.com/openshift/api/machine/v1beta1.MachineSetStatus": schema_openshift_api_machine_v1beta1_MachineSetStatus(ref), - "github.com/openshift/api/machine/v1beta1.MachineSpec": schema_openshift_api_machine_v1beta1_MachineSpec(ref), - "github.com/openshift/api/machine/v1beta1.MachineStatus": schema_openshift_api_machine_v1beta1_MachineStatus(ref), - "github.com/openshift/api/machine/v1beta1.MachineTemplateSpec": schema_openshift_api_machine_v1beta1_MachineTemplateSpec(ref), - "github.com/openshift/api/machine/v1beta1.MetadataServiceOptions": schema_openshift_api_machine_v1beta1_MetadataServiceOptions(ref), - "github.com/openshift/api/machine/v1beta1.NetworkDeviceSpec": schema_openshift_api_machine_v1beta1_NetworkDeviceSpec(ref), - "github.com/openshift/api/machine/v1beta1.NetworkSpec": schema_openshift_api_machine_v1beta1_NetworkSpec(ref), - "github.com/openshift/api/machine/v1beta1.OSDisk": schema_openshift_api_machine_v1beta1_OSDisk(ref), - "github.com/openshift/api/machine/v1beta1.OSDiskManagedDiskParameters": schema_openshift_api_machine_v1beta1_OSDiskManagedDiskParameters(ref), - "github.com/openshift/api/machine/v1beta1.ObjectMeta": schema_openshift_api_machine_v1beta1_ObjectMeta(ref), - "github.com/openshift/api/machine/v1beta1.Placement": schema_openshift_api_machine_v1beta1_Placement(ref), - "github.com/openshift/api/machine/v1beta1.ProviderSpec": schema_openshift_api_machine_v1beta1_ProviderSpec(ref), - "github.com/openshift/api/machine/v1beta1.ResourceManagerTag": schema_openshift_api_machine_v1beta1_ResourceManagerTag(ref), - "github.com/openshift/api/machine/v1beta1.SecurityProfile": schema_openshift_api_machine_v1beta1_SecurityProfile(ref), - "github.com/openshift/api/machine/v1beta1.SecuritySettings": schema_openshift_api_machine_v1beta1_SecuritySettings(ref), - "github.com/openshift/api/machine/v1beta1.SpotMarketOptions": schema_openshift_api_machine_v1beta1_SpotMarketOptions(ref), - "github.com/openshift/api/machine/v1beta1.SpotVMOptions": schema_openshift_api_machine_v1beta1_SpotVMOptions(ref), - "github.com/openshift/api/machine/v1beta1.TagSpecification": schema_openshift_api_machine_v1beta1_TagSpecification(ref), - "github.com/openshift/api/machine/v1beta1.TrustedLaunch": schema_openshift_api_machine_v1beta1_TrustedLaunch(ref), - "github.com/openshift/api/machine/v1beta1.UEFISettings": schema_openshift_api_machine_v1beta1_UEFISettings(ref), - "github.com/openshift/api/machine/v1beta1.UnhealthyCondition": schema_openshift_api_machine_v1beta1_UnhealthyCondition(ref), - "github.com/openshift/api/machine/v1beta1.VMDiskSecurityProfile": schema_openshift_api_machine_v1beta1_VMDiskSecurityProfile(ref), - "github.com/openshift/api/machine/v1beta1.VSphereDisk": schema_openshift_api_machine_v1beta1_VSphereDisk(ref), - "github.com/openshift/api/machine/v1beta1.VSphereMachineProviderSpec": schema_openshift_api_machine_v1beta1_VSphereMachineProviderSpec(ref), - "github.com/openshift/api/machine/v1beta1.VSphereMachineProviderStatus": schema_openshift_api_machine_v1beta1_VSphereMachineProviderStatus(ref), - "github.com/openshift/api/machine/v1beta1.Workspace": schema_openshift_api_machine_v1beta1_Workspace(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImage": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImage(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageBundleStatus": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageBundleStatus(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageList": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageList(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageRef": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageRef(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageSpec": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageSpec(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageStatus": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageStatus(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MCOObjectReference": schema_openshift_api_machineconfiguration_v1alpha1_MCOObjectReference(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNode": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNode(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeList": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeList(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeSpec": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeSpec(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeSpecMachineConfigVersion": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeSpecMachineConfigVersion(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatus": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeStatus(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatusMachineConfigVersion": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeStatusMachineConfigVersion(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatusPinnedImageSet": schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeStatusPinnedImageSet(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStream": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStream(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamList": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamList(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamSet": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamSet(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamSpec": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamSpec(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamStatus": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamStatus(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageRef": schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageRef(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSet": schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSet(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetList": schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSetList(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetSpec": schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSetSpec(ref), - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetStatus": schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSetStatus(ref), - "github.com/openshift/api/monitoring/v1.AlertRelabelConfig": schema_openshift_api_monitoring_v1_AlertRelabelConfig(ref), - "github.com/openshift/api/monitoring/v1.AlertRelabelConfigList": schema_openshift_api_monitoring_v1_AlertRelabelConfigList(ref), - "github.com/openshift/api/monitoring/v1.AlertRelabelConfigSpec": schema_openshift_api_monitoring_v1_AlertRelabelConfigSpec(ref), - "github.com/openshift/api/monitoring/v1.AlertRelabelConfigStatus": schema_openshift_api_monitoring_v1_AlertRelabelConfigStatus(ref), - "github.com/openshift/api/monitoring/v1.AlertingRule": schema_openshift_api_monitoring_v1_AlertingRule(ref), - "github.com/openshift/api/monitoring/v1.AlertingRuleList": schema_openshift_api_monitoring_v1_AlertingRuleList(ref), - "github.com/openshift/api/monitoring/v1.AlertingRuleSpec": schema_openshift_api_monitoring_v1_AlertingRuleSpec(ref), - "github.com/openshift/api/monitoring/v1.AlertingRuleStatus": schema_openshift_api_monitoring_v1_AlertingRuleStatus(ref), - "github.com/openshift/api/monitoring/v1.PrometheusRuleRef": schema_openshift_api_monitoring_v1_PrometheusRuleRef(ref), - "github.com/openshift/api/monitoring/v1.RelabelConfig": schema_openshift_api_monitoring_v1_RelabelConfig(ref), - "github.com/openshift/api/monitoring/v1.Rule": schema_openshift_api_monitoring_v1_Rule(ref), - "github.com/openshift/api/monitoring/v1.RuleGroup": schema_openshift_api_monitoring_v1_RuleGroup(ref), - "github.com/openshift/api/network/v1.ClusterNetwork": schema_openshift_api_network_v1_ClusterNetwork(ref), - "github.com/openshift/api/network/v1.ClusterNetworkEntry": schema_openshift_api_network_v1_ClusterNetworkEntry(ref), - "github.com/openshift/api/network/v1.ClusterNetworkList": schema_openshift_api_network_v1_ClusterNetworkList(ref), - "github.com/openshift/api/network/v1.EgressNetworkPolicy": schema_openshift_api_network_v1_EgressNetworkPolicy(ref), - "github.com/openshift/api/network/v1.EgressNetworkPolicyList": schema_openshift_api_network_v1_EgressNetworkPolicyList(ref), - "github.com/openshift/api/network/v1.EgressNetworkPolicyPeer": schema_openshift_api_network_v1_EgressNetworkPolicyPeer(ref), - "github.com/openshift/api/network/v1.EgressNetworkPolicyRule": schema_openshift_api_network_v1_EgressNetworkPolicyRule(ref), - "github.com/openshift/api/network/v1.EgressNetworkPolicySpec": schema_openshift_api_network_v1_EgressNetworkPolicySpec(ref), - "github.com/openshift/api/network/v1.HostSubnet": schema_openshift_api_network_v1_HostSubnet(ref), - "github.com/openshift/api/network/v1.HostSubnetList": schema_openshift_api_network_v1_HostSubnetList(ref), - "github.com/openshift/api/network/v1.NetNamespace": schema_openshift_api_network_v1_NetNamespace(ref), - "github.com/openshift/api/network/v1.NetNamespaceList": schema_openshift_api_network_v1_NetNamespaceList(ref), - "github.com/openshift/api/network/v1alpha1.DNSNameResolver": schema_openshift_api_network_v1alpha1_DNSNameResolver(ref), - "github.com/openshift/api/network/v1alpha1.DNSNameResolverList": schema_openshift_api_network_v1alpha1_DNSNameResolverList(ref), - "github.com/openshift/api/network/v1alpha1.DNSNameResolverResolvedAddress": schema_openshift_api_network_v1alpha1_DNSNameResolverResolvedAddress(ref), - "github.com/openshift/api/network/v1alpha1.DNSNameResolverResolvedName": schema_openshift_api_network_v1alpha1_DNSNameResolverResolvedName(ref), - "github.com/openshift/api/network/v1alpha1.DNSNameResolverSpec": schema_openshift_api_network_v1alpha1_DNSNameResolverSpec(ref), - "github.com/openshift/api/network/v1alpha1.DNSNameResolverStatus": schema_openshift_api_network_v1alpha1_DNSNameResolverStatus(ref), - "github.com/openshift/api/networkoperator/v1.EgressRouter": schema_openshift_api_networkoperator_v1_EgressRouter(ref), - "github.com/openshift/api/networkoperator/v1.EgressRouterSpec": schema_openshift_api_networkoperator_v1_EgressRouterSpec(ref), - "github.com/openshift/api/oauth/v1.ClusterRoleScopeRestriction": schema_openshift_api_oauth_v1_ClusterRoleScopeRestriction(ref), - "github.com/openshift/api/oauth/v1.OAuthAccessToken": schema_openshift_api_oauth_v1_OAuthAccessToken(ref), - "github.com/openshift/api/oauth/v1.OAuthAccessTokenList": schema_openshift_api_oauth_v1_OAuthAccessTokenList(ref), - "github.com/openshift/api/oauth/v1.OAuthAuthorizeToken": schema_openshift_api_oauth_v1_OAuthAuthorizeToken(ref), - "github.com/openshift/api/oauth/v1.OAuthAuthorizeTokenList": schema_openshift_api_oauth_v1_OAuthAuthorizeTokenList(ref), - "github.com/openshift/api/oauth/v1.OAuthClient": schema_openshift_api_oauth_v1_OAuthClient(ref), - "github.com/openshift/api/oauth/v1.OAuthClientAuthorization": schema_openshift_api_oauth_v1_OAuthClientAuthorization(ref), - "github.com/openshift/api/oauth/v1.OAuthClientAuthorizationList": schema_openshift_api_oauth_v1_OAuthClientAuthorizationList(ref), - "github.com/openshift/api/oauth/v1.OAuthClientList": schema_openshift_api_oauth_v1_OAuthClientList(ref), - "github.com/openshift/api/oauth/v1.OAuthRedirectReference": schema_openshift_api_oauth_v1_OAuthRedirectReference(ref), - "github.com/openshift/api/oauth/v1.RedirectReference": schema_openshift_api_oauth_v1_RedirectReference(ref), - "github.com/openshift/api/oauth/v1.ScopeRestriction": schema_openshift_api_oauth_v1_ScopeRestriction(ref), - "github.com/openshift/api/oauth/v1.UserOAuthAccessToken": schema_openshift_api_oauth_v1_UserOAuthAccessToken(ref), - "github.com/openshift/api/oauth/v1.UserOAuthAccessTokenList": schema_openshift_api_oauth_v1_UserOAuthAccessTokenList(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.APIServers": schema_openshift_api_openshiftcontrolplane_v1_APIServers(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.BuildControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_BuildControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.BuildDefaultsConfig": schema_openshift_api_openshiftcontrolplane_v1_BuildDefaultsConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.BuildOverridesConfig": schema_openshift_api_openshiftcontrolplane_v1_BuildOverridesConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ClusterNetworkEntry": schema_openshift_api_openshiftcontrolplane_v1_ClusterNetworkEntry(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.DeployerControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_DeployerControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.DockerPullSecretControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_DockerPullSecretControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.FrontProxyConfig": schema_openshift_api_openshiftcontrolplane_v1_FrontProxyConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ImageConfig": schema_openshift_api_openshiftcontrolplane_v1_ImageConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ImageImportControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_ImageImportControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ImagePolicyConfig": schema_openshift_api_openshiftcontrolplane_v1_ImagePolicyConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.IngressControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_IngressControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.JenkinsPipelineConfig": schema_openshift_api_openshiftcontrolplane_v1_JenkinsPipelineConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.NetworkControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_NetworkControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.OpenShiftAPIServerConfig": schema_openshift_api_openshiftcontrolplane_v1_OpenShiftAPIServerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.OpenShiftControllerManagerConfig": schema_openshift_api_openshiftcontrolplane_v1_OpenShiftControllerManagerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.PerGroupOptions": schema_openshift_api_openshiftcontrolplane_v1_PerGroupOptions(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ProjectConfig": schema_openshift_api_openshiftcontrolplane_v1_ProjectConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.RegistryLocation": schema_openshift_api_openshiftcontrolplane_v1_RegistryLocation(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ResourceQuotaControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_ResourceQuotaControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.RoutingConfig": schema_openshift_api_openshiftcontrolplane_v1_RoutingConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.SecurityAllocator": schema_openshift_api_openshiftcontrolplane_v1_SecurityAllocator(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ServiceAccountControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_ServiceAccountControllerConfig(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.ServiceServingCert": schema_openshift_api_openshiftcontrolplane_v1_ServiceServingCert(ref), - "github.com/openshift/api/openshiftcontrolplane/v1.SourceStrategyDefaultsConfig": schema_openshift_api_openshiftcontrolplane_v1_SourceStrategyDefaultsConfig(ref), - "github.com/openshift/api/operator/v1.AWSCSIDriverConfigSpec": schema_openshift_api_operator_v1_AWSCSIDriverConfigSpec(ref), - "github.com/openshift/api/operator/v1.AWSClassicLoadBalancerParameters": schema_openshift_api_operator_v1_AWSClassicLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.AWSEFSVolumeMetrics": schema_openshift_api_operator_v1_AWSEFSVolumeMetrics(ref), - "github.com/openshift/api/operator/v1.AWSEFSVolumeMetricsRecursiveWalkConfig": schema_openshift_api_operator_v1_AWSEFSVolumeMetricsRecursiveWalkConfig(ref), - "github.com/openshift/api/operator/v1.AWSLoadBalancerParameters": schema_openshift_api_operator_v1_AWSLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.AWSNetworkLoadBalancerParameters": schema_openshift_api_operator_v1_AWSNetworkLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.AWSSubnets": schema_openshift_api_operator_v1_AWSSubnets(ref), - "github.com/openshift/api/operator/v1.AccessLogging": schema_openshift_api_operator_v1_AccessLogging(ref), - "github.com/openshift/api/operator/v1.AddPage": schema_openshift_api_operator_v1_AddPage(ref), - "github.com/openshift/api/operator/v1.AdditionalNetworkDefinition": schema_openshift_api_operator_v1_AdditionalNetworkDefinition(ref), - "github.com/openshift/api/operator/v1.AdditionalRoutingCapabilities": schema_openshift_api_operator_v1_AdditionalRoutingCapabilities(ref), - "github.com/openshift/api/operator/v1.Authentication": schema_openshift_api_operator_v1_Authentication(ref), - "github.com/openshift/api/operator/v1.AuthenticationList": schema_openshift_api_operator_v1_AuthenticationList(ref), - "github.com/openshift/api/operator/v1.AuthenticationSpec": schema_openshift_api_operator_v1_AuthenticationSpec(ref), - "github.com/openshift/api/operator/v1.AuthenticationStatus": schema_openshift_api_operator_v1_AuthenticationStatus(ref), - "github.com/openshift/api/operator/v1.AzureCSIDriverConfigSpec": schema_openshift_api_operator_v1_AzureCSIDriverConfigSpec(ref), - "github.com/openshift/api/operator/v1.AzureDiskEncryptionSet": schema_openshift_api_operator_v1_AzureDiskEncryptionSet(ref), - "github.com/openshift/api/operator/v1.BootImageSkewEnforcementConfig": schema_openshift_api_operator_v1_BootImageSkewEnforcementConfig(ref), - "github.com/openshift/api/operator/v1.BootImageSkewEnforcementStatus": schema_openshift_api_operator_v1_BootImageSkewEnforcementStatus(ref), - "github.com/openshift/api/operator/v1.CSIDriverConfigSpec": schema_openshift_api_operator_v1_CSIDriverConfigSpec(ref), - "github.com/openshift/api/operator/v1.CSISnapshotController": schema_openshift_api_operator_v1_CSISnapshotController(ref), - "github.com/openshift/api/operator/v1.CSISnapshotControllerList": schema_openshift_api_operator_v1_CSISnapshotControllerList(ref), - "github.com/openshift/api/operator/v1.CSISnapshotControllerSpec": schema_openshift_api_operator_v1_CSISnapshotControllerSpec(ref), - "github.com/openshift/api/operator/v1.CSISnapshotControllerStatus": schema_openshift_api_operator_v1_CSISnapshotControllerStatus(ref), - "github.com/openshift/api/operator/v1.Capability": schema_openshift_api_operator_v1_Capability(ref), - "github.com/openshift/api/operator/v1.CapabilityVisibility": schema_openshift_api_operator_v1_CapabilityVisibility(ref), - "github.com/openshift/api/operator/v1.ClientTLS": schema_openshift_api_operator_v1_ClientTLS(ref), - "github.com/openshift/api/operator/v1.CloudCredential": schema_openshift_api_operator_v1_CloudCredential(ref), - "github.com/openshift/api/operator/v1.CloudCredentialList": schema_openshift_api_operator_v1_CloudCredentialList(ref), - "github.com/openshift/api/operator/v1.CloudCredentialSpec": schema_openshift_api_operator_v1_CloudCredentialSpec(ref), - "github.com/openshift/api/operator/v1.CloudCredentialStatus": schema_openshift_api_operator_v1_CloudCredentialStatus(ref), - "github.com/openshift/api/operator/v1.ClusterBootImageAutomatic": schema_openshift_api_operator_v1_ClusterBootImageAutomatic(ref), - "github.com/openshift/api/operator/v1.ClusterBootImageManual": schema_openshift_api_operator_v1_ClusterBootImageManual(ref), - "github.com/openshift/api/operator/v1.ClusterCSIDriver": schema_openshift_api_operator_v1_ClusterCSIDriver(ref), - "github.com/openshift/api/operator/v1.ClusterCSIDriverList": schema_openshift_api_operator_v1_ClusterCSIDriverList(ref), - "github.com/openshift/api/operator/v1.ClusterCSIDriverSpec": schema_openshift_api_operator_v1_ClusterCSIDriverSpec(ref), - "github.com/openshift/api/operator/v1.ClusterCSIDriverStatus": schema_openshift_api_operator_v1_ClusterCSIDriverStatus(ref), - "github.com/openshift/api/operator/v1.ClusterNetworkEntry": schema_openshift_api_operator_v1_ClusterNetworkEntry(ref), - "github.com/openshift/api/operator/v1.Config": schema_openshift_api_operator_v1_Config(ref), - "github.com/openshift/api/operator/v1.ConfigList": schema_openshift_api_operator_v1_ConfigList(ref), - "github.com/openshift/api/operator/v1.ConfigMapFileReference": schema_openshift_api_operator_v1_ConfigMapFileReference(ref), - "github.com/openshift/api/operator/v1.ConfigSpec": schema_openshift_api_operator_v1_ConfigSpec(ref), - "github.com/openshift/api/operator/v1.ConfigStatus": schema_openshift_api_operator_v1_ConfigStatus(ref), - "github.com/openshift/api/operator/v1.Console": schema_openshift_api_operator_v1_Console(ref), - "github.com/openshift/api/operator/v1.ConsoleConfigRoute": schema_openshift_api_operator_v1_ConsoleConfigRoute(ref), - "github.com/openshift/api/operator/v1.ConsoleCustomization": schema_openshift_api_operator_v1_ConsoleCustomization(ref), - "github.com/openshift/api/operator/v1.ConsoleList": schema_openshift_api_operator_v1_ConsoleList(ref), - "github.com/openshift/api/operator/v1.ConsoleProviders": schema_openshift_api_operator_v1_ConsoleProviders(ref), - "github.com/openshift/api/operator/v1.ConsoleSpec": schema_openshift_api_operator_v1_ConsoleSpec(ref), - "github.com/openshift/api/operator/v1.ConsoleStatus": schema_openshift_api_operator_v1_ConsoleStatus(ref), - "github.com/openshift/api/operator/v1.ContainerLoggingDestinationParameters": schema_openshift_api_operator_v1_ContainerLoggingDestinationParameters(ref), - "github.com/openshift/api/operator/v1.DNS": schema_openshift_api_operator_v1_DNS(ref), - "github.com/openshift/api/operator/v1.DNSCache": schema_openshift_api_operator_v1_DNSCache(ref), - "github.com/openshift/api/operator/v1.DNSList": schema_openshift_api_operator_v1_DNSList(ref), - "github.com/openshift/api/operator/v1.DNSNodePlacement": schema_openshift_api_operator_v1_DNSNodePlacement(ref), - "github.com/openshift/api/operator/v1.DNSOverTLSConfig": schema_openshift_api_operator_v1_DNSOverTLSConfig(ref), - "github.com/openshift/api/operator/v1.DNSSpec": schema_openshift_api_operator_v1_DNSSpec(ref), - "github.com/openshift/api/operator/v1.DNSStatus": schema_openshift_api_operator_v1_DNSStatus(ref), - "github.com/openshift/api/operator/v1.DNSTransportConfig": schema_openshift_api_operator_v1_DNSTransportConfig(ref), - "github.com/openshift/api/operator/v1.DefaultNetworkDefinition": schema_openshift_api_operator_v1_DefaultNetworkDefinition(ref), - "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogCategory": schema_openshift_api_operator_v1_DeveloperConsoleCatalogCategory(ref), - "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogCategoryMeta": schema_openshift_api_operator_v1_DeveloperConsoleCatalogCategoryMeta(ref), - "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogCustomization": schema_openshift_api_operator_v1_DeveloperConsoleCatalogCustomization(ref), - "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogTypes": schema_openshift_api_operator_v1_DeveloperConsoleCatalogTypes(ref), - "github.com/openshift/api/operator/v1.EgressIPConfig": schema_openshift_api_operator_v1_EgressIPConfig(ref), - "github.com/openshift/api/operator/v1.EndpointPublishingStrategy": schema_openshift_api_operator_v1_EndpointPublishingStrategy(ref), - "github.com/openshift/api/operator/v1.Etcd": schema_openshift_api_operator_v1_Etcd(ref), - "github.com/openshift/api/operator/v1.EtcdList": schema_openshift_api_operator_v1_EtcdList(ref), - "github.com/openshift/api/operator/v1.EtcdSpec": schema_openshift_api_operator_v1_EtcdSpec(ref), - "github.com/openshift/api/operator/v1.EtcdStatus": schema_openshift_api_operator_v1_EtcdStatus(ref), - "github.com/openshift/api/operator/v1.ExportNetworkFlows": schema_openshift_api_operator_v1_ExportNetworkFlows(ref), - "github.com/openshift/api/operator/v1.FeaturesMigration": schema_openshift_api_operator_v1_FeaturesMigration(ref), - "github.com/openshift/api/operator/v1.FileReferenceSource": schema_openshift_api_operator_v1_FileReferenceSource(ref), - "github.com/openshift/api/operator/v1.ForwardPlugin": schema_openshift_api_operator_v1_ForwardPlugin(ref), - "github.com/openshift/api/operator/v1.GCPCSIDriverConfigSpec": schema_openshift_api_operator_v1_GCPCSIDriverConfigSpec(ref), - "github.com/openshift/api/operator/v1.GCPKMSKeyReference": schema_openshift_api_operator_v1_GCPKMSKeyReference(ref), - "github.com/openshift/api/operator/v1.GCPLoadBalancerParameters": schema_openshift_api_operator_v1_GCPLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.GatewayConfig": schema_openshift_api_operator_v1_GatewayConfig(ref), - "github.com/openshift/api/operator/v1.GatherStatus": schema_openshift_api_operator_v1_GatherStatus(ref), - "github.com/openshift/api/operator/v1.GathererStatus": schema_openshift_api_operator_v1_GathererStatus(ref), - "github.com/openshift/api/operator/v1.GenerationStatus": schema_openshift_api_operator_v1_GenerationStatus(ref), - "github.com/openshift/api/operator/v1.HTTPCompressionPolicy": schema_openshift_api_operator_v1_HTTPCompressionPolicy(ref), - "github.com/openshift/api/operator/v1.HealthCheck": schema_openshift_api_operator_v1_HealthCheck(ref), - "github.com/openshift/api/operator/v1.HostNetworkStrategy": schema_openshift_api_operator_v1_HostNetworkStrategy(ref), - "github.com/openshift/api/operator/v1.HybridOverlayConfig": schema_openshift_api_operator_v1_HybridOverlayConfig(ref), - "github.com/openshift/api/operator/v1.IBMCloudCSIDriverConfigSpec": schema_openshift_api_operator_v1_IBMCloudCSIDriverConfigSpec(ref), - "github.com/openshift/api/operator/v1.IBMLoadBalancerParameters": schema_openshift_api_operator_v1_IBMLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.IPAMConfig": schema_openshift_api_operator_v1_IPAMConfig(ref), - "github.com/openshift/api/operator/v1.IPFIXConfig": schema_openshift_api_operator_v1_IPFIXConfig(ref), - "github.com/openshift/api/operator/v1.IPsecConfig": schema_openshift_api_operator_v1_IPsecConfig(ref), - "github.com/openshift/api/operator/v1.IPsecFullModeConfig": schema_openshift_api_operator_v1_IPsecFullModeConfig(ref), - "github.com/openshift/api/operator/v1.IPv4GatewayConfig": schema_openshift_api_operator_v1_IPv4GatewayConfig(ref), - "github.com/openshift/api/operator/v1.IPv4OVNKubernetesConfig": schema_openshift_api_operator_v1_IPv4OVNKubernetesConfig(ref), - "github.com/openshift/api/operator/v1.IPv6GatewayConfig": schema_openshift_api_operator_v1_IPv6GatewayConfig(ref), - "github.com/openshift/api/operator/v1.IPv6OVNKubernetesConfig": schema_openshift_api_operator_v1_IPv6OVNKubernetesConfig(ref), - "github.com/openshift/api/operator/v1.Ingress": schema_openshift_api_operator_v1_Ingress(ref), - "github.com/openshift/api/operator/v1.IngressController": schema_openshift_api_operator_v1_IngressController(ref), - "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPCookie": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPCookie(ref), - "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPCookieUnion": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPCookieUnion(ref), - "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPHeader": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPHeader(ref), - "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPHeaders": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPHeaders(ref), - "github.com/openshift/api/operator/v1.IngressControllerHTTPHeader": schema_openshift_api_operator_v1_IngressControllerHTTPHeader(ref), - "github.com/openshift/api/operator/v1.IngressControllerHTTPHeaderActionUnion": schema_openshift_api_operator_v1_IngressControllerHTTPHeaderActionUnion(ref), - "github.com/openshift/api/operator/v1.IngressControllerHTTPHeaderActions": schema_openshift_api_operator_v1_IngressControllerHTTPHeaderActions(ref), - "github.com/openshift/api/operator/v1.IngressControllerHTTPHeaders": schema_openshift_api_operator_v1_IngressControllerHTTPHeaders(ref), - "github.com/openshift/api/operator/v1.IngressControllerHTTPUniqueIdHeaderPolicy": schema_openshift_api_operator_v1_IngressControllerHTTPUniqueIdHeaderPolicy(ref), - "github.com/openshift/api/operator/v1.IngressControllerList": schema_openshift_api_operator_v1_IngressControllerList(ref), - "github.com/openshift/api/operator/v1.IngressControllerLogging": schema_openshift_api_operator_v1_IngressControllerLogging(ref), - "github.com/openshift/api/operator/v1.IngressControllerSetHTTPHeader": schema_openshift_api_operator_v1_IngressControllerSetHTTPHeader(ref), - "github.com/openshift/api/operator/v1.IngressControllerSpec": schema_openshift_api_operator_v1_IngressControllerSpec(ref), - "github.com/openshift/api/operator/v1.IngressControllerStatus": schema_openshift_api_operator_v1_IngressControllerStatus(ref), - "github.com/openshift/api/operator/v1.IngressControllerTuningOptions": schema_openshift_api_operator_v1_IngressControllerTuningOptions(ref), - "github.com/openshift/api/operator/v1.InsightsOperator": schema_openshift_api_operator_v1_InsightsOperator(ref), - "github.com/openshift/api/operator/v1.InsightsOperatorList": schema_openshift_api_operator_v1_InsightsOperatorList(ref), - "github.com/openshift/api/operator/v1.InsightsOperatorSpec": schema_openshift_api_operator_v1_InsightsOperatorSpec(ref), - "github.com/openshift/api/operator/v1.InsightsOperatorStatus": schema_openshift_api_operator_v1_InsightsOperatorStatus(ref), - "github.com/openshift/api/operator/v1.InsightsReport": schema_openshift_api_operator_v1_InsightsReport(ref), - "github.com/openshift/api/operator/v1.IrreconcilableValidationOverrides": schema_openshift_api_operator_v1_IrreconcilableValidationOverrides(ref), - "github.com/openshift/api/operator/v1.KubeAPIServer": schema_openshift_api_operator_v1_KubeAPIServer(ref), - "github.com/openshift/api/operator/v1.KubeAPIServerList": schema_openshift_api_operator_v1_KubeAPIServerList(ref), - "github.com/openshift/api/operator/v1.KubeAPIServerSpec": schema_openshift_api_operator_v1_KubeAPIServerSpec(ref), - "github.com/openshift/api/operator/v1.KubeAPIServerStatus": schema_openshift_api_operator_v1_KubeAPIServerStatus(ref), - "github.com/openshift/api/operator/v1.KubeControllerManager": schema_openshift_api_operator_v1_KubeControllerManager(ref), - "github.com/openshift/api/operator/v1.KubeControllerManagerList": schema_openshift_api_operator_v1_KubeControllerManagerList(ref), - "github.com/openshift/api/operator/v1.KubeControllerManagerSpec": schema_openshift_api_operator_v1_KubeControllerManagerSpec(ref), - "github.com/openshift/api/operator/v1.KubeControllerManagerStatus": schema_openshift_api_operator_v1_KubeControllerManagerStatus(ref), - "github.com/openshift/api/operator/v1.KubeScheduler": schema_openshift_api_operator_v1_KubeScheduler(ref), - "github.com/openshift/api/operator/v1.KubeSchedulerList": schema_openshift_api_operator_v1_KubeSchedulerList(ref), - "github.com/openshift/api/operator/v1.KubeSchedulerSpec": schema_openshift_api_operator_v1_KubeSchedulerSpec(ref), - "github.com/openshift/api/operator/v1.KubeSchedulerStatus": schema_openshift_api_operator_v1_KubeSchedulerStatus(ref), - "github.com/openshift/api/operator/v1.KubeStorageVersionMigrator": schema_openshift_api_operator_v1_KubeStorageVersionMigrator(ref), - "github.com/openshift/api/operator/v1.KubeStorageVersionMigratorList": schema_openshift_api_operator_v1_KubeStorageVersionMigratorList(ref), - "github.com/openshift/api/operator/v1.KubeStorageVersionMigratorSpec": schema_openshift_api_operator_v1_KubeStorageVersionMigratorSpec(ref), - "github.com/openshift/api/operator/v1.KubeStorageVersionMigratorStatus": schema_openshift_api_operator_v1_KubeStorageVersionMigratorStatus(ref), - "github.com/openshift/api/operator/v1.LoadBalancerStrategy": schema_openshift_api_operator_v1_LoadBalancerStrategy(ref), - "github.com/openshift/api/operator/v1.LoggingDestination": schema_openshift_api_operator_v1_LoggingDestination(ref), - "github.com/openshift/api/operator/v1.Logo": schema_openshift_api_operator_v1_Logo(ref), - "github.com/openshift/api/operator/v1.MTUMigration": schema_openshift_api_operator_v1_MTUMigration(ref), - "github.com/openshift/api/operator/v1.MTUMigrationValues": schema_openshift_api_operator_v1_MTUMigrationValues(ref), - "github.com/openshift/api/operator/v1.MachineConfiguration": schema_openshift_api_operator_v1_MachineConfiguration(ref), - "github.com/openshift/api/operator/v1.MachineConfigurationList": schema_openshift_api_operator_v1_MachineConfigurationList(ref), - "github.com/openshift/api/operator/v1.MachineConfigurationSpec": schema_openshift_api_operator_v1_MachineConfigurationSpec(ref), - "github.com/openshift/api/operator/v1.MachineConfigurationStatus": schema_openshift_api_operator_v1_MachineConfigurationStatus(ref), - "github.com/openshift/api/operator/v1.MachineManager": schema_openshift_api_operator_v1_MachineManager(ref), - "github.com/openshift/api/operator/v1.MachineManagerSelector": schema_openshift_api_operator_v1_MachineManagerSelector(ref), - "github.com/openshift/api/operator/v1.ManagedBootImages": schema_openshift_api_operator_v1_ManagedBootImages(ref), - "github.com/openshift/api/operator/v1.MyOperatorResource": schema_openshift_api_operator_v1_MyOperatorResource(ref), - "github.com/openshift/api/operator/v1.MyOperatorResourceSpec": schema_openshift_api_operator_v1_MyOperatorResourceSpec(ref), - "github.com/openshift/api/operator/v1.MyOperatorResourceStatus": schema_openshift_api_operator_v1_MyOperatorResourceStatus(ref), - "github.com/openshift/api/operator/v1.NetFlowConfig": schema_openshift_api_operator_v1_NetFlowConfig(ref), - "github.com/openshift/api/operator/v1.Network": schema_openshift_api_operator_v1_Network(ref), - "github.com/openshift/api/operator/v1.NetworkList": schema_openshift_api_operator_v1_NetworkList(ref), - "github.com/openshift/api/operator/v1.NetworkMigration": schema_openshift_api_operator_v1_NetworkMigration(ref), - "github.com/openshift/api/operator/v1.NetworkSpec": schema_openshift_api_operator_v1_NetworkSpec(ref), - "github.com/openshift/api/operator/v1.NetworkStatus": schema_openshift_api_operator_v1_NetworkStatus(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyClusterStatus": schema_openshift_api_operator_v1_NodeDisruptionPolicyClusterStatus(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyConfig": schema_openshift_api_operator_v1_NodeDisruptionPolicyConfig(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecAction": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecAction(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecFile": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecFile(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecSSHKey": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecSSHKey(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecUnit": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecUnit(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatus": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatus(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusAction": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusAction(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusFile": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusFile(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusSSHKey": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusSSHKey(ref), - "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusUnit": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusUnit(ref), - "github.com/openshift/api/operator/v1.NodePlacement": schema_openshift_api_operator_v1_NodePlacement(ref), - "github.com/openshift/api/operator/v1.NodePortStrategy": schema_openshift_api_operator_v1_NodePortStrategy(ref), - "github.com/openshift/api/operator/v1.NodeStatus": schema_openshift_api_operator_v1_NodeStatus(ref), - "github.com/openshift/api/operator/v1.OAuthAPIServerStatus": schema_openshift_api_operator_v1_OAuthAPIServerStatus(ref), - "github.com/openshift/api/operator/v1.OLM": schema_openshift_api_operator_v1_OLM(ref), - "github.com/openshift/api/operator/v1.OLMList": schema_openshift_api_operator_v1_OLMList(ref), - "github.com/openshift/api/operator/v1.OLMSpec": schema_openshift_api_operator_v1_OLMSpec(ref), - "github.com/openshift/api/operator/v1.OLMStatus": schema_openshift_api_operator_v1_OLMStatus(ref), - "github.com/openshift/api/operator/v1.OVNKubernetesConfig": schema_openshift_api_operator_v1_OVNKubernetesConfig(ref), - "github.com/openshift/api/operator/v1.OpenShiftAPIServer": schema_openshift_api_operator_v1_OpenShiftAPIServer(ref), - "github.com/openshift/api/operator/v1.OpenShiftAPIServerList": schema_openshift_api_operator_v1_OpenShiftAPIServerList(ref), - "github.com/openshift/api/operator/v1.OpenShiftAPIServerSpec": schema_openshift_api_operator_v1_OpenShiftAPIServerSpec(ref), - "github.com/openshift/api/operator/v1.OpenShiftAPIServerStatus": schema_openshift_api_operator_v1_OpenShiftAPIServerStatus(ref), - "github.com/openshift/api/operator/v1.OpenShiftControllerManager": schema_openshift_api_operator_v1_OpenShiftControllerManager(ref), - "github.com/openshift/api/operator/v1.OpenShiftControllerManagerList": schema_openshift_api_operator_v1_OpenShiftControllerManagerList(ref), - "github.com/openshift/api/operator/v1.OpenShiftControllerManagerSpec": schema_openshift_api_operator_v1_OpenShiftControllerManagerSpec(ref), - "github.com/openshift/api/operator/v1.OpenShiftControllerManagerStatus": schema_openshift_api_operator_v1_OpenShiftControllerManagerStatus(ref), - "github.com/openshift/api/operator/v1.OpenShiftSDNConfig": schema_openshift_api_operator_v1_OpenShiftSDNConfig(ref), - "github.com/openshift/api/operator/v1.OpenStackLoadBalancerParameters": schema_openshift_api_operator_v1_OpenStackLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.OperatorCondition": schema_openshift_api_operator_v1_OperatorCondition(ref), - "github.com/openshift/api/operator/v1.OperatorSpec": schema_openshift_api_operator_v1_OperatorSpec(ref), - "github.com/openshift/api/operator/v1.OperatorStatus": schema_openshift_api_operator_v1_OperatorStatus(ref), - "github.com/openshift/api/operator/v1.PartialSelector": schema_openshift_api_operator_v1_PartialSelector(ref), - "github.com/openshift/api/operator/v1.Perspective": schema_openshift_api_operator_v1_Perspective(ref), - "github.com/openshift/api/operator/v1.PerspectiveVisibility": schema_openshift_api_operator_v1_PerspectiveVisibility(ref), - "github.com/openshift/api/operator/v1.PinnedResourceReference": schema_openshift_api_operator_v1_PinnedResourceReference(ref), - "github.com/openshift/api/operator/v1.PolicyAuditConfig": schema_openshift_api_operator_v1_PolicyAuditConfig(ref), - "github.com/openshift/api/operator/v1.PrivateStrategy": schema_openshift_api_operator_v1_PrivateStrategy(ref), - "github.com/openshift/api/operator/v1.ProjectAccess": schema_openshift_api_operator_v1_ProjectAccess(ref), - "github.com/openshift/api/operator/v1.ProviderLoadBalancerParameters": schema_openshift_api_operator_v1_ProviderLoadBalancerParameters(ref), - "github.com/openshift/api/operator/v1.ProxyConfig": schema_openshift_api_operator_v1_ProxyConfig(ref), - "github.com/openshift/api/operator/v1.QuickStarts": schema_openshift_api_operator_v1_QuickStarts(ref), - "github.com/openshift/api/operator/v1.ReloadService": schema_openshift_api_operator_v1_ReloadService(ref), - "github.com/openshift/api/operator/v1.ResourceAttributesAccessReview": schema_openshift_api_operator_v1_ResourceAttributesAccessReview(ref), - "github.com/openshift/api/operator/v1.RestartService": schema_openshift_api_operator_v1_RestartService(ref), - "github.com/openshift/api/operator/v1.RouteAdmissionPolicy": schema_openshift_api_operator_v1_RouteAdmissionPolicy(ref), - "github.com/openshift/api/operator/v1.SFlowConfig": schema_openshift_api_operator_v1_SFlowConfig(ref), - "github.com/openshift/api/operator/v1.Server": schema_openshift_api_operator_v1_Server(ref), - "github.com/openshift/api/operator/v1.ServiceAccountIssuerStatus": schema_openshift_api_operator_v1_ServiceAccountIssuerStatus(ref), - "github.com/openshift/api/operator/v1.ServiceCA": schema_openshift_api_operator_v1_ServiceCA(ref), - "github.com/openshift/api/operator/v1.ServiceCAList": schema_openshift_api_operator_v1_ServiceCAList(ref), - "github.com/openshift/api/operator/v1.ServiceCASpec": schema_openshift_api_operator_v1_ServiceCASpec(ref), - "github.com/openshift/api/operator/v1.ServiceCAStatus": schema_openshift_api_operator_v1_ServiceCAStatus(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogAPIServer": schema_openshift_api_operator_v1_ServiceCatalogAPIServer(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogAPIServerList": schema_openshift_api_operator_v1_ServiceCatalogAPIServerList(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogAPIServerSpec": schema_openshift_api_operator_v1_ServiceCatalogAPIServerSpec(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogAPIServerStatus": schema_openshift_api_operator_v1_ServiceCatalogAPIServerStatus(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogControllerManager": schema_openshift_api_operator_v1_ServiceCatalogControllerManager(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogControllerManagerList": schema_openshift_api_operator_v1_ServiceCatalogControllerManagerList(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogControllerManagerSpec": schema_openshift_api_operator_v1_ServiceCatalogControllerManagerSpec(ref), - "github.com/openshift/api/operator/v1.ServiceCatalogControllerManagerStatus": schema_openshift_api_operator_v1_ServiceCatalogControllerManagerStatus(ref), - "github.com/openshift/api/operator/v1.SimpleMacvlanConfig": schema_openshift_api_operator_v1_SimpleMacvlanConfig(ref), - "github.com/openshift/api/operator/v1.StaticIPAMAddresses": schema_openshift_api_operator_v1_StaticIPAMAddresses(ref), - "github.com/openshift/api/operator/v1.StaticIPAMConfig": schema_openshift_api_operator_v1_StaticIPAMConfig(ref), - "github.com/openshift/api/operator/v1.StaticIPAMDNS": schema_openshift_api_operator_v1_StaticIPAMDNS(ref), - "github.com/openshift/api/operator/v1.StaticIPAMRoutes": schema_openshift_api_operator_v1_StaticIPAMRoutes(ref), - "github.com/openshift/api/operator/v1.StaticPodOperatorSpec": schema_openshift_api_operator_v1_StaticPodOperatorSpec(ref), - "github.com/openshift/api/operator/v1.StaticPodOperatorStatus": schema_openshift_api_operator_v1_StaticPodOperatorStatus(ref), - "github.com/openshift/api/operator/v1.StatuspageProvider": schema_openshift_api_operator_v1_StatuspageProvider(ref), - "github.com/openshift/api/operator/v1.Storage": schema_openshift_api_operator_v1_Storage(ref), - "github.com/openshift/api/operator/v1.StorageList": schema_openshift_api_operator_v1_StorageList(ref), - "github.com/openshift/api/operator/v1.StorageSpec": schema_openshift_api_operator_v1_StorageSpec(ref), - "github.com/openshift/api/operator/v1.StorageStatus": schema_openshift_api_operator_v1_StorageStatus(ref), - "github.com/openshift/api/operator/v1.SyslogLoggingDestinationParameters": schema_openshift_api_operator_v1_SyslogLoggingDestinationParameters(ref), - "github.com/openshift/api/operator/v1.Theme": schema_openshift_api_operator_v1_Theme(ref), - "github.com/openshift/api/operator/v1.Upstream": schema_openshift_api_operator_v1_Upstream(ref), - "github.com/openshift/api/operator/v1.UpstreamResolvers": schema_openshift_api_operator_v1_UpstreamResolvers(ref), - "github.com/openshift/api/operator/v1.VSphereCSIDriverConfigSpec": schema_openshift_api_operator_v1_VSphereCSIDriverConfigSpec(ref), - "github.com/openshift/api/operator/v1alpha1.BackupJobReference": schema_openshift_api_operator_v1alpha1_BackupJobReference(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPI": schema_openshift_api_operator_v1alpha1_ClusterAPI(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponent": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponent(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponentImage": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponentImage(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerRevision": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevision(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPIList": schema_openshift_api_operator_v1alpha1_ClusterAPIList(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPISpec": schema_openshift_api_operator_v1alpha1_ClusterAPISpec(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterAPIStatus": schema_openshift_api_operator_v1alpha1_ClusterAPIStatus(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperator": schema_openshift_api_operator_v1alpha1_ClusterVersionOperator(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperatorList": schema_openshift_api_operator_v1alpha1_ClusterVersionOperatorList(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperatorSpec": schema_openshift_api_operator_v1alpha1_ClusterVersionOperatorSpec(ref), - "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperatorStatus": schema_openshift_api_operator_v1alpha1_ClusterVersionOperatorStatus(ref), - "github.com/openshift/api/operator/v1alpha1.DelegatedAuthentication": schema_openshift_api_operator_v1alpha1_DelegatedAuthentication(ref), - "github.com/openshift/api/operator/v1alpha1.DelegatedAuthorization": schema_openshift_api_operator_v1alpha1_DelegatedAuthorization(ref), - "github.com/openshift/api/operator/v1alpha1.EtcdBackup": schema_openshift_api_operator_v1alpha1_EtcdBackup(ref), - "github.com/openshift/api/operator/v1alpha1.EtcdBackupList": schema_openshift_api_operator_v1alpha1_EtcdBackupList(ref), - "github.com/openshift/api/operator/v1alpha1.EtcdBackupSpec": schema_openshift_api_operator_v1alpha1_EtcdBackupSpec(ref), - "github.com/openshift/api/operator/v1alpha1.EtcdBackupStatus": schema_openshift_api_operator_v1alpha1_EtcdBackupStatus(ref), - "github.com/openshift/api/operator/v1alpha1.GenerationHistory": schema_openshift_api_operator_v1alpha1_GenerationHistory(ref), - "github.com/openshift/api/operator/v1alpha1.GenericOperatorConfig": schema_openshift_api_operator_v1alpha1_GenericOperatorConfig(ref), - "github.com/openshift/api/operator/v1alpha1.ImageContentSourcePolicy": schema_openshift_api_operator_v1alpha1_ImageContentSourcePolicy(ref), - "github.com/openshift/api/operator/v1alpha1.ImageContentSourcePolicyList": schema_openshift_api_operator_v1alpha1_ImageContentSourcePolicyList(ref), - "github.com/openshift/api/operator/v1alpha1.ImageContentSourcePolicySpec": schema_openshift_api_operator_v1alpha1_ImageContentSourcePolicySpec(ref), - "github.com/openshift/api/operator/v1alpha1.LoggingConfig": schema_openshift_api_operator_v1alpha1_LoggingConfig(ref), - "github.com/openshift/api/operator/v1alpha1.NodeStatus": schema_openshift_api_operator_v1alpha1_NodeStatus(ref), - "github.com/openshift/api/operator/v1alpha1.OLM": schema_openshift_api_operator_v1alpha1_OLM(ref), - "github.com/openshift/api/operator/v1alpha1.OLMList": schema_openshift_api_operator_v1alpha1_OLMList(ref), - "github.com/openshift/api/operator/v1alpha1.OLMSpec": schema_openshift_api_operator_v1alpha1_OLMSpec(ref), - "github.com/openshift/api/operator/v1alpha1.OLMStatus": schema_openshift_api_operator_v1alpha1_OLMStatus(ref), - "github.com/openshift/api/operator/v1alpha1.OperatorCondition": schema_openshift_api_operator_v1alpha1_OperatorCondition(ref), - "github.com/openshift/api/operator/v1alpha1.OperatorSpec": schema_openshift_api_operator_v1alpha1_OperatorSpec(ref), - "github.com/openshift/api/operator/v1alpha1.OperatorStatus": schema_openshift_api_operator_v1alpha1_OperatorStatus(ref), - "github.com/openshift/api/operator/v1alpha1.RepositoryDigestMirrors": schema_openshift_api_operator_v1alpha1_RepositoryDigestMirrors(ref), - "github.com/openshift/api/operator/v1alpha1.StaticPodOperatorStatus": schema_openshift_api_operator_v1alpha1_StaticPodOperatorStatus(ref), - "github.com/openshift/api/operator/v1alpha1.VersionAvailability": schema_openshift_api_operator_v1alpha1_VersionAvailability(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.LogEntry": schema_openshift_api_operatorcontrolplane_v1alpha1_LogEntry(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.OutageEntry": schema_openshift_api_operatorcontrolplane_v1alpha1_OutageEntry(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheck": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheck(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckCondition": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckCondition(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckList": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckList(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckSpec": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckSpec(ref), - "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckStatus": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckStatus(ref), - "github.com/openshift/api/operatoringress/v1.DNSRecord": schema_openshift_api_operatoringress_v1_DNSRecord(ref), - "github.com/openshift/api/operatoringress/v1.DNSRecordList": schema_openshift_api_operatoringress_v1_DNSRecordList(ref), - "github.com/openshift/api/operatoringress/v1.DNSRecordSpec": schema_openshift_api_operatoringress_v1_DNSRecordSpec(ref), - "github.com/openshift/api/operatoringress/v1.DNSRecordStatus": schema_openshift_api_operatoringress_v1_DNSRecordStatus(ref), - "github.com/openshift/api/operatoringress/v1.DNSZoneCondition": schema_openshift_api_operatoringress_v1_DNSZoneCondition(ref), - "github.com/openshift/api/operatoringress/v1.DNSZoneStatus": schema_openshift_api_operatoringress_v1_DNSZoneStatus(ref), - "github.com/openshift/api/osin/v1.AllowAllPasswordIdentityProvider": schema_openshift_api_osin_v1_AllowAllPasswordIdentityProvider(ref), - "github.com/openshift/api/osin/v1.BasicAuthPasswordIdentityProvider": schema_openshift_api_osin_v1_BasicAuthPasswordIdentityProvider(ref), - "github.com/openshift/api/osin/v1.DenyAllPasswordIdentityProvider": schema_openshift_api_osin_v1_DenyAllPasswordIdentityProvider(ref), - "github.com/openshift/api/osin/v1.GitHubIdentityProvider": schema_openshift_api_osin_v1_GitHubIdentityProvider(ref), - "github.com/openshift/api/osin/v1.GitLabIdentityProvider": schema_openshift_api_osin_v1_GitLabIdentityProvider(ref), - "github.com/openshift/api/osin/v1.GoogleIdentityProvider": schema_openshift_api_osin_v1_GoogleIdentityProvider(ref), - "github.com/openshift/api/osin/v1.GrantConfig": schema_openshift_api_osin_v1_GrantConfig(ref), - "github.com/openshift/api/osin/v1.HTPasswdPasswordIdentityProvider": schema_openshift_api_osin_v1_HTPasswdPasswordIdentityProvider(ref), - "github.com/openshift/api/osin/v1.IdentityProvider": schema_openshift_api_osin_v1_IdentityProvider(ref), - "github.com/openshift/api/osin/v1.KeystonePasswordIdentityProvider": schema_openshift_api_osin_v1_KeystonePasswordIdentityProvider(ref), - "github.com/openshift/api/osin/v1.LDAPAttributeMapping": schema_openshift_api_osin_v1_LDAPAttributeMapping(ref), - "github.com/openshift/api/osin/v1.LDAPPasswordIdentityProvider": schema_openshift_api_osin_v1_LDAPPasswordIdentityProvider(ref), - "github.com/openshift/api/osin/v1.OAuthConfig": schema_openshift_api_osin_v1_OAuthConfig(ref), - "github.com/openshift/api/osin/v1.OAuthTemplates": schema_openshift_api_osin_v1_OAuthTemplates(ref), - "github.com/openshift/api/osin/v1.OpenIDClaims": schema_openshift_api_osin_v1_OpenIDClaims(ref), - "github.com/openshift/api/osin/v1.OpenIDIdentityProvider": schema_openshift_api_osin_v1_OpenIDIdentityProvider(ref), - "github.com/openshift/api/osin/v1.OpenIDURLs": schema_openshift_api_osin_v1_OpenIDURLs(ref), - "github.com/openshift/api/osin/v1.OsinServerConfig": schema_openshift_api_osin_v1_OsinServerConfig(ref), - "github.com/openshift/api/osin/v1.RequestHeaderIdentityProvider": schema_openshift_api_osin_v1_RequestHeaderIdentityProvider(ref), - "github.com/openshift/api/osin/v1.SessionConfig": schema_openshift_api_osin_v1_SessionConfig(ref), - "github.com/openshift/api/osin/v1.SessionSecret": schema_openshift_api_osin_v1_SessionSecret(ref), - "github.com/openshift/api/osin/v1.SessionSecrets": schema_openshift_api_osin_v1_SessionSecrets(ref), - "github.com/openshift/api/osin/v1.TokenConfig": schema_openshift_api_osin_v1_TokenConfig(ref), - "github.com/openshift/api/project/v1.Project": schema_openshift_api_project_v1_Project(ref), - "github.com/openshift/api/project/v1.ProjectList": schema_openshift_api_project_v1_ProjectList(ref), - "github.com/openshift/api/project/v1.ProjectRequest": schema_openshift_api_project_v1_ProjectRequest(ref), - "github.com/openshift/api/project/v1.ProjectSpec": schema_openshift_api_project_v1_ProjectSpec(ref), - "github.com/openshift/api/project/v1.ProjectStatus": schema_openshift_api_project_v1_ProjectStatus(ref), - "github.com/openshift/api/quota/v1.AppliedClusterResourceQuota": schema_openshift_api_quota_v1_AppliedClusterResourceQuota(ref), - "github.com/openshift/api/quota/v1.AppliedClusterResourceQuotaList": schema_openshift_api_quota_v1_AppliedClusterResourceQuotaList(ref), - "github.com/openshift/api/quota/v1.ClusterResourceQuota": schema_openshift_api_quota_v1_ClusterResourceQuota(ref), - "github.com/openshift/api/quota/v1.ClusterResourceQuotaList": schema_openshift_api_quota_v1_ClusterResourceQuotaList(ref), - "github.com/openshift/api/quota/v1.ClusterResourceQuotaSelector": schema_openshift_api_quota_v1_ClusterResourceQuotaSelector(ref), - "github.com/openshift/api/quota/v1.ClusterResourceQuotaSpec": schema_openshift_api_quota_v1_ClusterResourceQuotaSpec(ref), - "github.com/openshift/api/quota/v1.ClusterResourceQuotaStatus": schema_openshift_api_quota_v1_ClusterResourceQuotaStatus(ref), - "github.com/openshift/api/quota/v1.ResourceQuotaStatusByNamespace": schema_openshift_api_quota_v1_ResourceQuotaStatusByNamespace(ref), - "github.com/openshift/api/route/v1.LocalObjectReference": schema_openshift_api_route_v1_LocalObjectReference(ref), - "github.com/openshift/api/route/v1.Route": schema_openshift_api_route_v1_Route(ref), - "github.com/openshift/api/route/v1.RouteHTTPHeader": schema_openshift_api_route_v1_RouteHTTPHeader(ref), - "github.com/openshift/api/route/v1.RouteHTTPHeaderActionUnion": schema_openshift_api_route_v1_RouteHTTPHeaderActionUnion(ref), - "github.com/openshift/api/route/v1.RouteHTTPHeaderActions": schema_openshift_api_route_v1_RouteHTTPHeaderActions(ref), - "github.com/openshift/api/route/v1.RouteHTTPHeaders": schema_openshift_api_route_v1_RouteHTTPHeaders(ref), - "github.com/openshift/api/route/v1.RouteIngress": schema_openshift_api_route_v1_RouteIngress(ref), - "github.com/openshift/api/route/v1.RouteIngressCondition": schema_openshift_api_route_v1_RouteIngressCondition(ref), - "github.com/openshift/api/route/v1.RouteList": schema_openshift_api_route_v1_RouteList(ref), - "github.com/openshift/api/route/v1.RoutePort": schema_openshift_api_route_v1_RoutePort(ref), - "github.com/openshift/api/route/v1.RouteSetHTTPHeader": schema_openshift_api_route_v1_RouteSetHTTPHeader(ref), - "github.com/openshift/api/route/v1.RouteSpec": schema_openshift_api_route_v1_RouteSpec(ref), - "github.com/openshift/api/route/v1.RouteStatus": schema_openshift_api_route_v1_RouteStatus(ref), - "github.com/openshift/api/route/v1.RouteTargetReference": schema_openshift_api_route_v1_RouteTargetReference(ref), - "github.com/openshift/api/route/v1.RouterShard": schema_openshift_api_route_v1_RouterShard(ref), - "github.com/openshift/api/route/v1.TLSConfig": schema_openshift_api_route_v1_TLSConfig(ref), - "github.com/openshift/api/samples/v1.Config": schema_openshift_api_samples_v1_Config(ref), - "github.com/openshift/api/samples/v1.ConfigCondition": schema_openshift_api_samples_v1_ConfigCondition(ref), - "github.com/openshift/api/samples/v1.ConfigList": schema_openshift_api_samples_v1_ConfigList(ref), - "github.com/openshift/api/samples/v1.ConfigSpec": schema_openshift_api_samples_v1_ConfigSpec(ref), - "github.com/openshift/api/samples/v1.ConfigStatus": schema_openshift_api_samples_v1_ConfigStatus(ref), - "github.com/openshift/api/security/v1.AllowedFlexVolume": schema_openshift_api_security_v1_AllowedFlexVolume(ref), - "github.com/openshift/api/security/v1.FSGroupStrategyOptions": schema_openshift_api_security_v1_FSGroupStrategyOptions(ref), - "github.com/openshift/api/security/v1.IDRange": schema_openshift_api_security_v1_IDRange(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicyReview": schema_openshift_api_security_v1_PodSecurityPolicyReview(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicyReviewSpec": schema_openshift_api_security_v1_PodSecurityPolicyReviewSpec(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicyReviewStatus": schema_openshift_api_security_v1_PodSecurityPolicyReviewStatus(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicySelfSubjectReview": schema_openshift_api_security_v1_PodSecurityPolicySelfSubjectReview(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicySelfSubjectReviewSpec": schema_openshift_api_security_v1_PodSecurityPolicySelfSubjectReviewSpec(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicySubjectReview": schema_openshift_api_security_v1_PodSecurityPolicySubjectReview(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicySubjectReviewSpec": schema_openshift_api_security_v1_PodSecurityPolicySubjectReviewSpec(ref), - "github.com/openshift/api/security/v1.PodSecurityPolicySubjectReviewStatus": schema_openshift_api_security_v1_PodSecurityPolicySubjectReviewStatus(ref), - "github.com/openshift/api/security/v1.RangeAllocation": schema_openshift_api_security_v1_RangeAllocation(ref), - "github.com/openshift/api/security/v1.RangeAllocationList": schema_openshift_api_security_v1_RangeAllocationList(ref), - "github.com/openshift/api/security/v1.RunAsUserStrategyOptions": schema_openshift_api_security_v1_RunAsUserStrategyOptions(ref), - "github.com/openshift/api/security/v1.SELinuxContextStrategyOptions": schema_openshift_api_security_v1_SELinuxContextStrategyOptions(ref), - "github.com/openshift/api/security/v1.SecurityContextConstraints": schema_openshift_api_security_v1_SecurityContextConstraints(ref), - "github.com/openshift/api/security/v1.SecurityContextConstraintsList": schema_openshift_api_security_v1_SecurityContextConstraintsList(ref), - "github.com/openshift/api/security/v1.ServiceAccountPodSecurityPolicyReviewStatus": schema_openshift_api_security_v1_ServiceAccountPodSecurityPolicyReviewStatus(ref), - "github.com/openshift/api/security/v1.SupplementalGroupsStrategyOptions": schema_openshift_api_security_v1_SupplementalGroupsStrategyOptions(ref), - "github.com/openshift/api/securityinternal/v1.RangeAllocation": schema_openshift_api_securityinternal_v1_RangeAllocation(ref), - "github.com/openshift/api/securityinternal/v1.RangeAllocationList": schema_openshift_api_securityinternal_v1_RangeAllocationList(ref), - "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfig": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfig(ref), - "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfigList": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfigList(ref), - "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfigSpec": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfigSpec(ref), - "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfigStatus": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfigStatus(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMap": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMap(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapList": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapList(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapReference": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapReference(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapSpec": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapSpec(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapStatus": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapStatus(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedSecret": schema_openshift_api_sharedresource_v1alpha1_SharedSecret(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretList": schema_openshift_api_sharedresource_v1alpha1_SharedSecretList(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretReference": schema_openshift_api_sharedresource_v1alpha1_SharedSecretReference(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretSpec": schema_openshift_api_sharedresource_v1alpha1_SharedSecretSpec(ref), - "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretStatus": schema_openshift_api_sharedresource_v1alpha1_SharedSecretStatus(ref), - "github.com/openshift/api/template/v1.BrokerTemplateInstance": schema_openshift_api_template_v1_BrokerTemplateInstance(ref), - "github.com/openshift/api/template/v1.BrokerTemplateInstanceList": schema_openshift_api_template_v1_BrokerTemplateInstanceList(ref), - "github.com/openshift/api/template/v1.BrokerTemplateInstanceSpec": schema_openshift_api_template_v1_BrokerTemplateInstanceSpec(ref), - "github.com/openshift/api/template/v1.Parameter": schema_openshift_api_template_v1_Parameter(ref), - "github.com/openshift/api/template/v1.Template": schema_openshift_api_template_v1_Template(ref), - "github.com/openshift/api/template/v1.TemplateInstance": schema_openshift_api_template_v1_TemplateInstance(ref), - "github.com/openshift/api/template/v1.TemplateInstanceCondition": schema_openshift_api_template_v1_TemplateInstanceCondition(ref), - "github.com/openshift/api/template/v1.TemplateInstanceList": schema_openshift_api_template_v1_TemplateInstanceList(ref), - "github.com/openshift/api/template/v1.TemplateInstanceObject": schema_openshift_api_template_v1_TemplateInstanceObject(ref), - "github.com/openshift/api/template/v1.TemplateInstanceRequester": schema_openshift_api_template_v1_TemplateInstanceRequester(ref), - "github.com/openshift/api/template/v1.TemplateInstanceSpec": schema_openshift_api_template_v1_TemplateInstanceSpec(ref), - "github.com/openshift/api/template/v1.TemplateInstanceStatus": schema_openshift_api_template_v1_TemplateInstanceStatus(ref), - "github.com/openshift/api/template/v1.TemplateList": schema_openshift_api_template_v1_TemplateList(ref), - "github.com/openshift/api/user/v1.Group": schema_openshift_api_user_v1_Group(ref), - "github.com/openshift/api/user/v1.GroupList": schema_openshift_api_user_v1_GroupList(ref), - "github.com/openshift/api/user/v1.Identity": schema_openshift_api_user_v1_Identity(ref), - "github.com/openshift/api/user/v1.IdentityList": schema_openshift_api_user_v1_IdentityList(ref), - "github.com/openshift/api/user/v1.User": schema_openshift_api_user_v1_User(ref), - "github.com/openshift/api/user/v1.UserIdentityMapping": schema_openshift_api_user_v1_UserIdentityMapping(ref), - "github.com/openshift/api/user/v1.UserList": schema_openshift_api_user_v1_UserList(ref), - v1.AuditAnnotation{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_AuditAnnotation(ref), - v1.ExpressionWarning{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ExpressionWarning(ref), - v1.MatchCondition{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MatchCondition(ref), - v1.MatchResources{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MatchResources(ref), - v1.MutatingWebhook{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MutatingWebhook(ref), - v1.MutatingWebhookConfiguration{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MutatingWebhookConfiguration(ref), - v1.MutatingWebhookConfigurationList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MutatingWebhookConfigurationList(ref), - v1.NamedRuleWithOperations{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_NamedRuleWithOperations(ref), - v1.ParamKind{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ParamKind(ref), - v1.ParamRef{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ParamRef(ref), - v1.Rule{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_Rule(ref), - v1.RuleWithOperations{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_RuleWithOperations(ref), - v1.ServiceReference{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ServiceReference(ref), - v1.TypeChecking{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_TypeChecking(ref), - v1.ValidatingAdmissionPolicy{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicy(ref), - v1.ValidatingAdmissionPolicyBinding{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyBinding(ref), - v1.ValidatingAdmissionPolicyBindingList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyBindingList(ref), - v1.ValidatingAdmissionPolicyBindingSpec{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyBindingSpec(ref), - v1.ValidatingAdmissionPolicyList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyList(ref), - v1.ValidatingAdmissionPolicySpec{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicySpec(ref), - v1.ValidatingAdmissionPolicyStatus{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyStatus(ref), - v1.ValidatingWebhook{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingWebhook(ref), - v1.ValidatingWebhookConfiguration{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingWebhookConfiguration(ref), - v1.ValidatingWebhookConfigurationList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingWebhookConfigurationList(ref), - v1.Validation{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_Validation(ref), - v1.Variable{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_Variable(ref), - v1.WebhookClientConfig{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_WebhookClientConfig(ref), - authorizationv1.FieldSelectorAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_FieldSelectorAttributes(ref), - authorizationv1.LabelSelectorAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_LabelSelectorAttributes(ref), - authorizationv1.LocalSubjectAccessReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_LocalSubjectAccessReview(ref), - authorizationv1.NonResourceAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_NonResourceAttributes(ref), - authorizationv1.NonResourceRule{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_NonResourceRule(ref), - authorizationv1.ResourceAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_ResourceAttributes(ref), - authorizationv1.ResourceRule{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_ResourceRule(ref), - authorizationv1.SelfSubjectAccessReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectAccessReview(ref), - authorizationv1.SelfSubjectAccessReviewSpec{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectAccessReviewSpec(ref), - authorizationv1.SelfSubjectRulesReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectRulesReview(ref), - authorizationv1.SelfSubjectRulesReviewSpec{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectRulesReviewSpec(ref), - authorizationv1.SubjectAccessReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectAccessReview(ref), - authorizationv1.SubjectAccessReviewSpec{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectAccessReviewSpec(ref), - authorizationv1.SubjectAccessReviewStatus{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectAccessReviewStatus(ref), - authorizationv1.SubjectRulesReviewStatus{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectRulesReviewStatus(ref), - corev1.AWSElasticBlockStoreVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AWSElasticBlockStoreVolumeSource(ref), - corev1.Affinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Affinity(ref), - corev1.AppArmorProfile{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AppArmorProfile(ref), - corev1.AttachedVolume{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AttachedVolume(ref), - corev1.AvoidPods{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AvoidPods(ref), - corev1.AzureDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AzureDiskVolumeSource(ref), - corev1.AzureFilePersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AzureFilePersistentVolumeSource(ref), - corev1.AzureFileVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AzureFileVolumeSource(ref), - corev1.Binding{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Binding(ref), - corev1.CSIPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CSIPersistentVolumeSource(ref), - corev1.CSIVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CSIVolumeSource(ref), - corev1.Capabilities{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Capabilities(ref), - corev1.CephFSPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CephFSPersistentVolumeSource(ref), - corev1.CephFSVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CephFSVolumeSource(ref), - corev1.CinderPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CinderPersistentVolumeSource(ref), - corev1.CinderVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CinderVolumeSource(ref), - corev1.ClientIPConfig{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ClientIPConfig(ref), - corev1.ClusterTrustBundleProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ClusterTrustBundleProjection(ref), - corev1.ComponentCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ComponentCondition(ref), - corev1.ComponentStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ComponentStatus(ref), - corev1.ComponentStatusList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ComponentStatusList(ref), - corev1.ConfigMap{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMap(ref), - corev1.ConfigMapEnvSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapEnvSource(ref), - corev1.ConfigMapKeySelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapKeySelector(ref), - corev1.ConfigMapList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapList(ref), - corev1.ConfigMapNodeConfigSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapNodeConfigSource(ref), - corev1.ConfigMapProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapProjection(ref), - corev1.ConfigMapVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapVolumeSource(ref), - corev1.Container{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Container(ref), - corev1.ContainerExtendedResourceRequest{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerExtendedResourceRequest(ref), - corev1.ContainerImage{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerImage(ref), - corev1.ContainerPort{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerPort(ref), - corev1.ContainerResizePolicy{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerResizePolicy(ref), - corev1.ContainerRestartRule{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerRestartRule(ref), - corev1.ContainerRestartRuleOnExitCodes{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerRestartRuleOnExitCodes(ref), - corev1.ContainerState{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerState(ref), - corev1.ContainerStateRunning{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStateRunning(ref), - corev1.ContainerStateTerminated{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStateTerminated(ref), - corev1.ContainerStateWaiting{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStateWaiting(ref), - corev1.ContainerStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStatus(ref), - corev1.ContainerUser{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerUser(ref), - corev1.DaemonEndpoint{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DaemonEndpoint(ref), - corev1.DownwardAPIProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DownwardAPIProjection(ref), - corev1.DownwardAPIVolumeFile{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DownwardAPIVolumeFile(ref), - corev1.DownwardAPIVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DownwardAPIVolumeSource(ref), - corev1.EmptyDirVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EmptyDirVolumeSource(ref), - corev1.EndpointAddress{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointAddress(ref), - corev1.EndpointPort{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointPort(ref), - corev1.EndpointSubset{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointSubset(ref), - corev1.Endpoints{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Endpoints(ref), - corev1.EndpointsList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointsList(ref), - corev1.EnvFromSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EnvFromSource(ref), - corev1.EnvVar{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EnvVar(ref), - corev1.EnvVarSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EnvVarSource(ref), - corev1.EphemeralContainer{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EphemeralContainer(ref), - corev1.EphemeralContainerCommon{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EphemeralContainerCommon(ref), - corev1.EphemeralVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EphemeralVolumeSource(ref), - corev1.Event{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Event(ref), - corev1.EventList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EventList(ref), - corev1.EventSeries{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EventSeries(ref), - corev1.EventSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EventSource(ref), - corev1.ExecAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ExecAction(ref), - corev1.FCVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FCVolumeSource(ref), - corev1.FileKeySelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FileKeySelector(ref), - corev1.FlexPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FlexPersistentVolumeSource(ref), - corev1.FlexVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FlexVolumeSource(ref), - corev1.FlockerVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FlockerVolumeSource(ref), - corev1.GCEPersistentDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GCEPersistentDiskVolumeSource(ref), - corev1.GRPCAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GRPCAction(ref), - corev1.GitRepoVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GitRepoVolumeSource(ref), - corev1.GlusterfsPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GlusterfsPersistentVolumeSource(ref), - corev1.GlusterfsVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GlusterfsVolumeSource(ref), - corev1.HTTPGetAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HTTPGetAction(ref), - corev1.HTTPHeader{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HTTPHeader(ref), - corev1.HostAlias{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HostAlias(ref), - corev1.HostIP{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HostIP(ref), - corev1.HostPathVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HostPathVolumeSource(ref), - corev1.ISCSIPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ISCSIPersistentVolumeSource(ref), - corev1.ISCSIVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ISCSIVolumeSource(ref), - corev1.ImageVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ImageVolumeSource(ref), - corev1.KeyToPath{}.OpenAPIModelName(): schema_k8sio_api_core_v1_KeyToPath(ref), - corev1.Lifecycle{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Lifecycle(ref), - corev1.LifecycleHandler{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LifecycleHandler(ref), - corev1.LimitRange{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRange(ref), - corev1.LimitRangeItem{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRangeItem(ref), - corev1.LimitRangeList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRangeList(ref), - corev1.LimitRangeSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRangeSpec(ref), - corev1.LinuxContainerUser{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LinuxContainerUser(ref), - corev1.List{}.OpenAPIModelName(): schema_k8sio_api_core_v1_List(ref), - corev1.LoadBalancerIngress{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LoadBalancerIngress(ref), - corev1.LoadBalancerStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LoadBalancerStatus(ref), - corev1.LocalObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LocalObjectReference(ref), - corev1.LocalVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LocalVolumeSource(ref), - corev1.ModifyVolumeStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ModifyVolumeStatus(ref), - corev1.NFSVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NFSVolumeSource(ref), - corev1.Namespace{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Namespace(ref), - corev1.NamespaceCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceCondition(ref), - corev1.NamespaceList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceList(ref), - corev1.NamespaceSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceSpec(ref), - corev1.NamespaceStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceStatus(ref), - corev1.Node{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Node(ref), - corev1.NodeAddress{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeAddress(ref), - corev1.NodeAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeAffinity(ref), - corev1.NodeCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeCondition(ref), - corev1.NodeConfigSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeConfigSource(ref), - corev1.NodeConfigStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeConfigStatus(ref), - corev1.NodeDaemonEndpoints{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeDaemonEndpoints(ref), - corev1.NodeFeatures{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeFeatures(ref), - corev1.NodeList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeList(ref), - corev1.NodeProxyOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeProxyOptions(ref), - corev1.NodeRuntimeHandler{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeRuntimeHandler(ref), - corev1.NodeRuntimeHandlerFeatures{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeRuntimeHandlerFeatures(ref), - corev1.NodeSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSelector(ref), - corev1.NodeSelectorRequirement{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSelectorRequirement(ref), - corev1.NodeSelectorTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSelectorTerm(ref), - corev1.NodeSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSpec(ref), - corev1.NodeStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeStatus(ref), - corev1.NodeSwapStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSwapStatus(ref), - corev1.NodeSystemInfo{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSystemInfo(ref), - corev1.ObjectFieldSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ObjectFieldSelector(ref), - corev1.ObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ObjectReference(ref), - corev1.PersistentVolume{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolume(ref), - corev1.PersistentVolumeClaim{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaim(ref), - corev1.PersistentVolumeClaimCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimCondition(ref), - corev1.PersistentVolumeClaimList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimList(ref), - corev1.PersistentVolumeClaimSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimSpec(ref), - corev1.PersistentVolumeClaimStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimStatus(ref), - corev1.PersistentVolumeClaimTemplate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimTemplate(ref), - corev1.PersistentVolumeClaimVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimVolumeSource(ref), - corev1.PersistentVolumeList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeList(ref), - corev1.PersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeSource(ref), - corev1.PersistentVolumeSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeSpec(ref), - corev1.PersistentVolumeStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeStatus(ref), - corev1.PhotonPersistentDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PhotonPersistentDiskVolumeSource(ref), - corev1.Pod{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Pod(ref), - corev1.PodAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAffinity(ref), - corev1.PodAffinityTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAffinityTerm(ref), - corev1.PodAntiAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAntiAffinity(ref), - corev1.PodAttachOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAttachOptions(ref), - corev1.PodCertificateProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodCertificateProjection(ref), - corev1.PodCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodCondition(ref), - corev1.PodDNSConfig{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodDNSConfig(ref), - corev1.PodDNSConfigOption{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodDNSConfigOption(ref), - corev1.PodExecOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodExecOptions(ref), - corev1.PodExtendedResourceClaimStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodExtendedResourceClaimStatus(ref), - corev1.PodIP{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodIP(ref), - corev1.PodList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodList(ref), - corev1.PodLogOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodLogOptions(ref), - corev1.PodOS{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodOS(ref), - corev1.PodPortForwardOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodPortForwardOptions(ref), - corev1.PodProxyOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodProxyOptions(ref), - corev1.PodReadinessGate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodReadinessGate(ref), - corev1.PodResourceClaim{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodResourceClaim(ref), - corev1.PodResourceClaimStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodResourceClaimStatus(ref), - corev1.PodSchedulingGate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSchedulingGate(ref), - corev1.PodSecurityContext{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSecurityContext(ref), - corev1.PodSignature{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSignature(ref), - corev1.PodSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSpec(ref), - corev1.PodStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodStatus(ref), - corev1.PodStatusResult{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodStatusResult(ref), - corev1.PodTemplate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodTemplate(ref), - corev1.PodTemplateList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodTemplateList(ref), - corev1.PodTemplateSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodTemplateSpec(ref), - corev1.PortStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PortStatus(ref), - corev1.PortworxVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PortworxVolumeSource(ref), - corev1.PreferAvoidPodsEntry{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PreferAvoidPodsEntry(ref), - corev1.PreferredSchedulingTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PreferredSchedulingTerm(ref), - corev1.Probe{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Probe(ref), - corev1.ProbeHandler{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ProbeHandler(ref), - corev1.ProjectedVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ProjectedVolumeSource(ref), - corev1.QuobyteVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_QuobyteVolumeSource(ref), - corev1.RBDPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_RBDPersistentVolumeSource(ref), - corev1.RBDVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_RBDVolumeSource(ref), - corev1.RangeAllocation{}.OpenAPIModelName(): schema_k8sio_api_core_v1_RangeAllocation(ref), - corev1.ReplicationController{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationController(ref), - corev1.ReplicationControllerCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerCondition(ref), - corev1.ReplicationControllerList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerList(ref), - corev1.ReplicationControllerSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerSpec(ref), - corev1.ReplicationControllerStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerStatus(ref), - corev1.ResourceClaim{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceClaim(ref), - corev1.ResourceFieldSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceFieldSelector(ref), - corev1.ResourceHealth{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceHealth(ref), - corev1.ResourceQuota{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuota(ref), - corev1.ResourceQuotaList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuotaList(ref), - corev1.ResourceQuotaSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuotaSpec(ref), - corev1.ResourceQuotaStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuotaStatus(ref), - corev1.ResourceRequirements{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceRequirements(ref), - corev1.ResourceStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceStatus(ref), - corev1.SELinuxOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SELinuxOptions(ref), - corev1.ScaleIOPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScaleIOPersistentVolumeSource(ref), - corev1.ScaleIOVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScaleIOVolumeSource(ref), - corev1.ScopeSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScopeSelector(ref), - corev1.ScopedResourceSelectorRequirement{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScopedResourceSelectorRequirement(ref), - corev1.SeccompProfile{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SeccompProfile(ref), - corev1.Secret{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Secret(ref), - corev1.SecretEnvSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretEnvSource(ref), - corev1.SecretKeySelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretKeySelector(ref), - corev1.SecretList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretList(ref), - corev1.SecretProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretProjection(ref), - corev1.SecretReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretReference(ref), - corev1.SecretVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretVolumeSource(ref), - corev1.SecurityContext{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecurityContext(ref), - corev1.SerializedReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SerializedReference(ref), - corev1.Service{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Service(ref), - corev1.ServiceAccount{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceAccount(ref), - corev1.ServiceAccountList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceAccountList(ref), - corev1.ServiceAccountTokenProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceAccountTokenProjection(ref), - corev1.ServiceList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceList(ref), - corev1.ServicePort{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServicePort(ref), - corev1.ServiceProxyOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceProxyOptions(ref), - corev1.ServiceSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceSpec(ref), - corev1.ServiceStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceStatus(ref), - corev1.SessionAffinityConfig{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SessionAffinityConfig(ref), - corev1.SleepAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SleepAction(ref), - corev1.StorageOSPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_StorageOSPersistentVolumeSource(ref), - corev1.StorageOSVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_StorageOSVolumeSource(ref), - corev1.Sysctl{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Sysctl(ref), - corev1.TCPSocketAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TCPSocketAction(ref), - corev1.Taint{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Taint(ref), - corev1.Toleration{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Toleration(ref), - corev1.TopologySelectorLabelRequirement{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TopologySelectorLabelRequirement(ref), - corev1.TopologySelectorTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TopologySelectorTerm(ref), - corev1.TopologySpreadConstraint{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TopologySpreadConstraint(ref), - corev1.TypedLocalObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TypedLocalObjectReference(ref), - corev1.TypedObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TypedObjectReference(ref), - corev1.Volume{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Volume(ref), - corev1.VolumeDevice{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeDevice(ref), - corev1.VolumeMount{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeMount(ref), - corev1.VolumeMountStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeMountStatus(ref), - corev1.VolumeNodeAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeNodeAffinity(ref), - corev1.VolumeProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeProjection(ref), - corev1.VolumeResourceRequirements{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeResourceRequirements(ref), - corev1.VolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeSource(ref), - corev1.VsphereVirtualDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VsphereVirtualDiskVolumeSource(ref), - corev1.WeightedPodAffinityTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_WeightedPodAffinityTerm(ref), - corev1.WindowsSecurityContextOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_WindowsSecurityContextOptions(ref), - corev1.WorkloadReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_WorkloadReference(ref), - rbacv1.AggregationRule{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_AggregationRule(ref), - rbacv1.ClusterRole{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRole(ref), - rbacv1.ClusterRoleBinding{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRoleBinding(ref), - rbacv1.ClusterRoleBindingList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRoleBindingList(ref), - rbacv1.ClusterRoleList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRoleList(ref), - rbacv1.PolicyRule{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_PolicyRule(ref), - rbacv1.Role{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_Role(ref), - rbacv1.RoleBinding{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleBinding(ref), - rbacv1.RoleBindingList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleBindingList(ref), - rbacv1.RoleList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleList(ref), - rbacv1.RoleRef{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleRef(ref), - rbacv1.Subject{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_Subject(ref), - resource.Quantity{}.OpenAPIModelName(): schema_apimachinery_pkg_api_resource_Quantity(ref), - metav1.APIGroup{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIGroup(ref), - metav1.APIGroupList{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIGroupList(ref), - metav1.APIResource{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIResource(ref), - metav1.APIResourceList{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIResourceList(ref), - metav1.APIVersions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIVersions(ref), - metav1.ApplyOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ApplyOptions(ref), - metav1.Condition{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Condition(ref), - metav1.CreateOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_CreateOptions(ref), - metav1.DeleteOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_DeleteOptions(ref), - metav1.Duration{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Duration(ref), - metav1.FieldSelectorRequirement{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_FieldSelectorRequirement(ref), - metav1.FieldsV1{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_FieldsV1(ref), - metav1.GetOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GetOptions(ref), - metav1.GroupKind{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupKind(ref), - metav1.GroupResource{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupResource(ref), - metav1.GroupVersion{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersion(ref), - metav1.GroupVersionForDiscovery{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersionForDiscovery(ref), - metav1.GroupVersionKind{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersionKind(ref), - metav1.GroupVersionResource{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersionResource(ref), - metav1.InternalEvent{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_InternalEvent(ref), - metav1.LabelSelector{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_LabelSelector(ref), - metav1.LabelSelectorRequirement{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_LabelSelectorRequirement(ref), - metav1.List{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_List(ref), - metav1.ListMeta{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ListMeta(ref), - metav1.ListOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ListOptions(ref), - metav1.ManagedFieldsEntry{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ManagedFieldsEntry(ref), - metav1.MicroTime{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_MicroTime(ref), - metav1.ObjectMeta{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ObjectMeta(ref), - metav1.OwnerReference{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_OwnerReference(ref), - metav1.PartialObjectMetadata{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_PartialObjectMetadata(ref), - metav1.PartialObjectMetadataList{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_PartialObjectMetadataList(ref), - metav1.Patch{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Patch(ref), - metav1.PatchOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_PatchOptions(ref), - metav1.Preconditions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Preconditions(ref), - metav1.RootPaths{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_RootPaths(ref), - metav1.ServerAddressByClientCIDR{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ServerAddressByClientCIDR(ref), - metav1.Status{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Status(ref), - metav1.StatusCause{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_StatusCause(ref), - metav1.StatusDetails{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_StatusDetails(ref), - metav1.Table{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Table(ref), - metav1.TableColumnDefinition{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableColumnDefinition(ref), - metav1.TableOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableOptions(ref), - metav1.TableRow{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableRow(ref), - metav1.TableRowCondition{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableRowCondition(ref), - metav1.Time{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Time(ref), - metav1.Timestamp{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Timestamp(ref), - metav1.TypeMeta{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TypeMeta(ref), - metav1.UpdateOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_UpdateOptions(ref), - metav1.WatchEvent{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_WatchEvent(ref), - runtime.RawExtension{}.OpenAPIModelName(): schema_k8sio_apimachinery_pkg_runtime_RawExtension(ref), - runtime.TypeMeta{}.OpenAPIModelName(): schema_k8sio_apimachinery_pkg_runtime_TypeMeta(ref), - runtime.Unknown{}.OpenAPIModelName(): schema_k8sio_apimachinery_pkg_runtime_Unknown(ref), - intstr.IntOrString{}.OpenAPIModelName(): schema_apimachinery_pkg_util_intstr_IntOrString(ref), + "github.com/openshift/api/apiextensions/v1alpha1.APIExcludedField": schema_openshift_api_apiextensions_v1alpha1_APIExcludedField(ref), + "github.com/openshift/api/apiextensions/v1alpha1.APIVersions": schema_openshift_api_apiextensions_v1alpha1_APIVersions(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CRDData": schema_openshift_api_apiextensions_v1alpha1_CRDData(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirement": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirement(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirementList": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirementList(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirementSpec": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirementSpec(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CompatibilityRequirementStatus": schema_openshift_api_apiextensions_v1alpha1_CompatibilityRequirementStatus(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CompatibilitySchema": schema_openshift_api_apiextensions_v1alpha1_CompatibilitySchema(ref), + "github.com/openshift/api/apiextensions/v1alpha1.CustomResourceDefinitionSchemaValidation": schema_openshift_api_apiextensions_v1alpha1_CustomResourceDefinitionSchemaValidation(ref), + "github.com/openshift/api/apiextensions/v1alpha1.ObjectSchemaValidation": schema_openshift_api_apiextensions_v1alpha1_ObjectSchemaValidation(ref), + "github.com/openshift/api/apiextensions/v1alpha1.ObservedCRD": schema_openshift_api_apiextensions_v1alpha1_ObservedCRD(ref), + "github.com/openshift/api/apiserver/v1.APIRequestCount": schema_openshift_api_apiserver_v1_APIRequestCount(ref), + "github.com/openshift/api/apiserver/v1.APIRequestCountList": schema_openshift_api_apiserver_v1_APIRequestCountList(ref), + "github.com/openshift/api/apiserver/v1.APIRequestCountSpec": schema_openshift_api_apiserver_v1_APIRequestCountSpec(ref), + "github.com/openshift/api/apiserver/v1.APIRequestCountStatus": schema_openshift_api_apiserver_v1_APIRequestCountStatus(ref), + "github.com/openshift/api/apiserver/v1.PerNodeAPIRequestLog": schema_openshift_api_apiserver_v1_PerNodeAPIRequestLog(ref), + "github.com/openshift/api/apiserver/v1.PerResourceAPIRequestLog": schema_openshift_api_apiserver_v1_PerResourceAPIRequestLog(ref), + "github.com/openshift/api/apiserver/v1.PerUserAPIRequestCount": schema_openshift_api_apiserver_v1_PerUserAPIRequestCount(ref), + "github.com/openshift/api/apiserver/v1.PerVerbAPIRequestCount": schema_openshift_api_apiserver_v1_PerVerbAPIRequestCount(ref), + "github.com/openshift/api/apps/v1.CustomDeploymentStrategyParams": schema_openshift_api_apps_v1_CustomDeploymentStrategyParams(ref), + "github.com/openshift/api/apps/v1.DeploymentCause": schema_openshift_api_apps_v1_DeploymentCause(ref), + "github.com/openshift/api/apps/v1.DeploymentCauseImageTrigger": schema_openshift_api_apps_v1_DeploymentCauseImageTrigger(ref), + "github.com/openshift/api/apps/v1.DeploymentCondition": schema_openshift_api_apps_v1_DeploymentCondition(ref), + "github.com/openshift/api/apps/v1.DeploymentConfig": schema_openshift_api_apps_v1_DeploymentConfig(ref), + "github.com/openshift/api/apps/v1.DeploymentConfigList": schema_openshift_api_apps_v1_DeploymentConfigList(ref), + "github.com/openshift/api/apps/v1.DeploymentConfigRollback": schema_openshift_api_apps_v1_DeploymentConfigRollback(ref), + "github.com/openshift/api/apps/v1.DeploymentConfigRollbackSpec": schema_openshift_api_apps_v1_DeploymentConfigRollbackSpec(ref), + "github.com/openshift/api/apps/v1.DeploymentConfigSpec": schema_openshift_api_apps_v1_DeploymentConfigSpec(ref), + "github.com/openshift/api/apps/v1.DeploymentConfigStatus": schema_openshift_api_apps_v1_DeploymentConfigStatus(ref), + "github.com/openshift/api/apps/v1.DeploymentDetails": schema_openshift_api_apps_v1_DeploymentDetails(ref), + "github.com/openshift/api/apps/v1.DeploymentLog": schema_openshift_api_apps_v1_DeploymentLog(ref), + "github.com/openshift/api/apps/v1.DeploymentLogOptions": schema_openshift_api_apps_v1_DeploymentLogOptions(ref), + "github.com/openshift/api/apps/v1.DeploymentRequest": schema_openshift_api_apps_v1_DeploymentRequest(ref), + "github.com/openshift/api/apps/v1.DeploymentStrategy": schema_openshift_api_apps_v1_DeploymentStrategy(ref), + "github.com/openshift/api/apps/v1.DeploymentTriggerImageChangeParams": schema_openshift_api_apps_v1_DeploymentTriggerImageChangeParams(ref), + "github.com/openshift/api/apps/v1.DeploymentTriggerPolicy": schema_openshift_api_apps_v1_DeploymentTriggerPolicy(ref), + "github.com/openshift/api/apps/v1.ExecNewPodHook": schema_openshift_api_apps_v1_ExecNewPodHook(ref), + "github.com/openshift/api/apps/v1.LifecycleHook": schema_openshift_api_apps_v1_LifecycleHook(ref), + "github.com/openshift/api/apps/v1.RecreateDeploymentStrategyParams": schema_openshift_api_apps_v1_RecreateDeploymentStrategyParams(ref), + "github.com/openshift/api/apps/v1.RollingDeploymentStrategyParams": schema_openshift_api_apps_v1_RollingDeploymentStrategyParams(ref), + "github.com/openshift/api/apps/v1.TagImageHook": schema_openshift_api_apps_v1_TagImageHook(ref), + "github.com/openshift/api/authorization/v1.Action": schema_openshift_api_authorization_v1_Action(ref), + "github.com/openshift/api/authorization/v1.ClusterRole": schema_openshift_api_authorization_v1_ClusterRole(ref), + "github.com/openshift/api/authorization/v1.ClusterRoleBinding": schema_openshift_api_authorization_v1_ClusterRoleBinding(ref), + "github.com/openshift/api/authorization/v1.ClusterRoleBindingList": schema_openshift_api_authorization_v1_ClusterRoleBindingList(ref), + "github.com/openshift/api/authorization/v1.ClusterRoleList": schema_openshift_api_authorization_v1_ClusterRoleList(ref), + "github.com/openshift/api/authorization/v1.GroupRestriction": schema_openshift_api_authorization_v1_GroupRestriction(ref), + "github.com/openshift/api/authorization/v1.IsPersonalSubjectAccessReview": schema_openshift_api_authorization_v1_IsPersonalSubjectAccessReview(ref), + "github.com/openshift/api/authorization/v1.LocalResourceAccessReview": schema_openshift_api_authorization_v1_LocalResourceAccessReview(ref), + "github.com/openshift/api/authorization/v1.LocalSubjectAccessReview": schema_openshift_api_authorization_v1_LocalSubjectAccessReview(ref), + "github.com/openshift/api/authorization/v1.NamedClusterRole": schema_openshift_api_authorization_v1_NamedClusterRole(ref), + "github.com/openshift/api/authorization/v1.NamedClusterRoleBinding": schema_openshift_api_authorization_v1_NamedClusterRoleBinding(ref), + "github.com/openshift/api/authorization/v1.NamedRole": schema_openshift_api_authorization_v1_NamedRole(ref), + "github.com/openshift/api/authorization/v1.NamedRoleBinding": schema_openshift_api_authorization_v1_NamedRoleBinding(ref), + "github.com/openshift/api/authorization/v1.PolicyRule": schema_openshift_api_authorization_v1_PolicyRule(ref), + "github.com/openshift/api/authorization/v1.ResourceAccessReview": schema_openshift_api_authorization_v1_ResourceAccessReview(ref), + "github.com/openshift/api/authorization/v1.ResourceAccessReviewResponse": schema_openshift_api_authorization_v1_ResourceAccessReviewResponse(ref), + "github.com/openshift/api/authorization/v1.Role": schema_openshift_api_authorization_v1_Role(ref), + "github.com/openshift/api/authorization/v1.RoleBinding": schema_openshift_api_authorization_v1_RoleBinding(ref), + "github.com/openshift/api/authorization/v1.RoleBindingList": schema_openshift_api_authorization_v1_RoleBindingList(ref), + "github.com/openshift/api/authorization/v1.RoleBindingRestriction": schema_openshift_api_authorization_v1_RoleBindingRestriction(ref), + "github.com/openshift/api/authorization/v1.RoleBindingRestrictionList": schema_openshift_api_authorization_v1_RoleBindingRestrictionList(ref), + "github.com/openshift/api/authorization/v1.RoleBindingRestrictionSpec": schema_openshift_api_authorization_v1_RoleBindingRestrictionSpec(ref), + "github.com/openshift/api/authorization/v1.RoleList": schema_openshift_api_authorization_v1_RoleList(ref), + "github.com/openshift/api/authorization/v1.SelfSubjectRulesReview": schema_openshift_api_authorization_v1_SelfSubjectRulesReview(ref), + "github.com/openshift/api/authorization/v1.SelfSubjectRulesReviewSpec": schema_openshift_api_authorization_v1_SelfSubjectRulesReviewSpec(ref), + "github.com/openshift/api/authorization/v1.ServiceAccountReference": schema_openshift_api_authorization_v1_ServiceAccountReference(ref), + "github.com/openshift/api/authorization/v1.ServiceAccountRestriction": schema_openshift_api_authorization_v1_ServiceAccountRestriction(ref), + "github.com/openshift/api/authorization/v1.SubjectAccessReview": schema_openshift_api_authorization_v1_SubjectAccessReview(ref), + "github.com/openshift/api/authorization/v1.SubjectAccessReviewResponse": schema_openshift_api_authorization_v1_SubjectAccessReviewResponse(ref), + "github.com/openshift/api/authorization/v1.SubjectRulesReview": schema_openshift_api_authorization_v1_SubjectRulesReview(ref), + "github.com/openshift/api/authorization/v1.SubjectRulesReviewSpec": schema_openshift_api_authorization_v1_SubjectRulesReviewSpec(ref), + "github.com/openshift/api/authorization/v1.SubjectRulesReviewStatus": schema_openshift_api_authorization_v1_SubjectRulesReviewStatus(ref), + "github.com/openshift/api/authorization/v1.UserRestriction": schema_openshift_api_authorization_v1_UserRestriction(ref), + "github.com/openshift/api/build/v1.BinaryBuildRequestOptions": schema_openshift_api_build_v1_BinaryBuildRequestOptions(ref), + "github.com/openshift/api/build/v1.BinaryBuildSource": schema_openshift_api_build_v1_BinaryBuildSource(ref), + "github.com/openshift/api/build/v1.BitbucketWebHookCause": schema_openshift_api_build_v1_BitbucketWebHookCause(ref), + "github.com/openshift/api/build/v1.Build": schema_openshift_api_build_v1_Build(ref), + "github.com/openshift/api/build/v1.BuildCondition": schema_openshift_api_build_v1_BuildCondition(ref), + "github.com/openshift/api/build/v1.BuildConfig": schema_openshift_api_build_v1_BuildConfig(ref), + "github.com/openshift/api/build/v1.BuildConfigList": schema_openshift_api_build_v1_BuildConfigList(ref), + "github.com/openshift/api/build/v1.BuildConfigSpec": schema_openshift_api_build_v1_BuildConfigSpec(ref), + "github.com/openshift/api/build/v1.BuildConfigStatus": schema_openshift_api_build_v1_BuildConfigStatus(ref), + "github.com/openshift/api/build/v1.BuildList": schema_openshift_api_build_v1_BuildList(ref), + "github.com/openshift/api/build/v1.BuildLog": schema_openshift_api_build_v1_BuildLog(ref), + "github.com/openshift/api/build/v1.BuildLogOptions": schema_openshift_api_build_v1_BuildLogOptions(ref), + "github.com/openshift/api/build/v1.BuildOutput": schema_openshift_api_build_v1_BuildOutput(ref), + "github.com/openshift/api/build/v1.BuildPostCommitSpec": schema_openshift_api_build_v1_BuildPostCommitSpec(ref), + "github.com/openshift/api/build/v1.BuildRequest": schema_openshift_api_build_v1_BuildRequest(ref), + "github.com/openshift/api/build/v1.BuildSource": schema_openshift_api_build_v1_BuildSource(ref), + "github.com/openshift/api/build/v1.BuildSpec": schema_openshift_api_build_v1_BuildSpec(ref), + "github.com/openshift/api/build/v1.BuildStatus": schema_openshift_api_build_v1_BuildStatus(ref), + "github.com/openshift/api/build/v1.BuildStatusOutput": schema_openshift_api_build_v1_BuildStatusOutput(ref), + "github.com/openshift/api/build/v1.BuildStatusOutputTo": schema_openshift_api_build_v1_BuildStatusOutputTo(ref), + "github.com/openshift/api/build/v1.BuildStrategy": schema_openshift_api_build_v1_BuildStrategy(ref), + "github.com/openshift/api/build/v1.BuildTriggerCause": schema_openshift_api_build_v1_BuildTriggerCause(ref), + "github.com/openshift/api/build/v1.BuildTriggerPolicy": schema_openshift_api_build_v1_BuildTriggerPolicy(ref), + "github.com/openshift/api/build/v1.BuildVolume": schema_openshift_api_build_v1_BuildVolume(ref), + "github.com/openshift/api/build/v1.BuildVolumeMount": schema_openshift_api_build_v1_BuildVolumeMount(ref), + "github.com/openshift/api/build/v1.BuildVolumeSource": schema_openshift_api_build_v1_BuildVolumeSource(ref), + "github.com/openshift/api/build/v1.CommonSpec": schema_openshift_api_build_v1_CommonSpec(ref), + "github.com/openshift/api/build/v1.CommonWebHookCause": schema_openshift_api_build_v1_CommonWebHookCause(ref), + "github.com/openshift/api/build/v1.ConfigMapBuildSource": schema_openshift_api_build_v1_ConfigMapBuildSource(ref), + "github.com/openshift/api/build/v1.CustomBuildStrategy": schema_openshift_api_build_v1_CustomBuildStrategy(ref), + "github.com/openshift/api/build/v1.DockerBuildStrategy": schema_openshift_api_build_v1_DockerBuildStrategy(ref), + "github.com/openshift/api/build/v1.DockerStrategyOptions": schema_openshift_api_build_v1_DockerStrategyOptions(ref), + "github.com/openshift/api/build/v1.GenericWebHookCause": schema_openshift_api_build_v1_GenericWebHookCause(ref), + "github.com/openshift/api/build/v1.GenericWebHookEvent": schema_openshift_api_build_v1_GenericWebHookEvent(ref), + "github.com/openshift/api/build/v1.GitBuildSource": schema_openshift_api_build_v1_GitBuildSource(ref), + "github.com/openshift/api/build/v1.GitHubWebHookCause": schema_openshift_api_build_v1_GitHubWebHookCause(ref), + "github.com/openshift/api/build/v1.GitInfo": schema_openshift_api_build_v1_GitInfo(ref), + "github.com/openshift/api/build/v1.GitLabWebHookCause": schema_openshift_api_build_v1_GitLabWebHookCause(ref), + "github.com/openshift/api/build/v1.GitRefInfo": schema_openshift_api_build_v1_GitRefInfo(ref), + "github.com/openshift/api/build/v1.GitSourceRevision": schema_openshift_api_build_v1_GitSourceRevision(ref), + "github.com/openshift/api/build/v1.ImageChangeCause": schema_openshift_api_build_v1_ImageChangeCause(ref), + "github.com/openshift/api/build/v1.ImageChangeTrigger": schema_openshift_api_build_v1_ImageChangeTrigger(ref), + "github.com/openshift/api/build/v1.ImageChangeTriggerStatus": schema_openshift_api_build_v1_ImageChangeTriggerStatus(ref), + "github.com/openshift/api/build/v1.ImageLabel": schema_openshift_api_build_v1_ImageLabel(ref), + "github.com/openshift/api/build/v1.ImageSource": schema_openshift_api_build_v1_ImageSource(ref), + "github.com/openshift/api/build/v1.ImageSourcePath": schema_openshift_api_build_v1_ImageSourcePath(ref), + "github.com/openshift/api/build/v1.ImageStreamTagReference": schema_openshift_api_build_v1_ImageStreamTagReference(ref), + "github.com/openshift/api/build/v1.JenkinsPipelineBuildStrategy": schema_openshift_api_build_v1_JenkinsPipelineBuildStrategy(ref), + "github.com/openshift/api/build/v1.ProxyConfig": schema_openshift_api_build_v1_ProxyConfig(ref), + "github.com/openshift/api/build/v1.SecretBuildSource": schema_openshift_api_build_v1_SecretBuildSource(ref), + "github.com/openshift/api/build/v1.SecretLocalReference": schema_openshift_api_build_v1_SecretLocalReference(ref), + "github.com/openshift/api/build/v1.SecretSpec": schema_openshift_api_build_v1_SecretSpec(ref), + "github.com/openshift/api/build/v1.SourceBuildStrategy": schema_openshift_api_build_v1_SourceBuildStrategy(ref), + "github.com/openshift/api/build/v1.SourceControlUser": schema_openshift_api_build_v1_SourceControlUser(ref), + "github.com/openshift/api/build/v1.SourceRevision": schema_openshift_api_build_v1_SourceRevision(ref), + "github.com/openshift/api/build/v1.SourceStrategyOptions": schema_openshift_api_build_v1_SourceStrategyOptions(ref), + "github.com/openshift/api/build/v1.StageInfo": schema_openshift_api_build_v1_StageInfo(ref), + "github.com/openshift/api/build/v1.StepInfo": schema_openshift_api_build_v1_StepInfo(ref), + "github.com/openshift/api/build/v1.WebHookTrigger": schema_openshift_api_build_v1_WebHookTrigger(ref), + "github.com/openshift/api/cloudnetwork/v1.CloudPrivateIPConfig": schema_openshift_api_cloudnetwork_v1_CloudPrivateIPConfig(ref), + "github.com/openshift/api/cloudnetwork/v1.CloudPrivateIPConfigSpec": schema_openshift_api_cloudnetwork_v1_CloudPrivateIPConfigSpec(ref), + "github.com/openshift/api/cloudnetwork/v1.CloudPrivateIPConfigStatus": schema_openshift_api_cloudnetwork_v1_CloudPrivateIPConfigStatus(ref), + "github.com/openshift/api/config/v1.APIServer": schema_openshift_api_config_v1_APIServer(ref), + "github.com/openshift/api/config/v1.APIServerEncryption": schema_openshift_api_config_v1_APIServerEncryption(ref), + "github.com/openshift/api/config/v1.APIServerList": schema_openshift_api_config_v1_APIServerList(ref), + "github.com/openshift/api/config/v1.APIServerNamedServingCert": schema_openshift_api_config_v1_APIServerNamedServingCert(ref), + "github.com/openshift/api/config/v1.APIServerServingCerts": schema_openshift_api_config_v1_APIServerServingCerts(ref), + "github.com/openshift/api/config/v1.APIServerSpec": schema_openshift_api_config_v1_APIServerSpec(ref), + "github.com/openshift/api/config/v1.APIServerStatus": schema_openshift_api_config_v1_APIServerStatus(ref), + "github.com/openshift/api/config/v1.AWSDNSSpec": schema_openshift_api_config_v1_AWSDNSSpec(ref), + "github.com/openshift/api/config/v1.AWSIngressSpec": schema_openshift_api_config_v1_AWSIngressSpec(ref), + "github.com/openshift/api/config/v1.AWSKMSConfig": schema_openshift_api_config_v1_AWSKMSConfig(ref), + "github.com/openshift/api/config/v1.AWSPlatformSpec": schema_openshift_api_config_v1_AWSPlatformSpec(ref), + "github.com/openshift/api/config/v1.AWSPlatformStatus": schema_openshift_api_config_v1_AWSPlatformStatus(ref), + "github.com/openshift/api/config/v1.AWSResourceTag": schema_openshift_api_config_v1_AWSResourceTag(ref), + "github.com/openshift/api/config/v1.AWSServiceEndpoint": schema_openshift_api_config_v1_AWSServiceEndpoint(ref), + "github.com/openshift/api/config/v1.AcceptRisk": schema_openshift_api_config_v1_AcceptRisk(ref), + "github.com/openshift/api/config/v1.AdmissionConfig": schema_openshift_api_config_v1_AdmissionConfig(ref), + "github.com/openshift/api/config/v1.AdmissionPluginConfig": schema_openshift_api_config_v1_AdmissionPluginConfig(ref), + "github.com/openshift/api/config/v1.AlibabaCloudPlatformSpec": schema_openshift_api_config_v1_AlibabaCloudPlatformSpec(ref), + "github.com/openshift/api/config/v1.AlibabaCloudPlatformStatus": schema_openshift_api_config_v1_AlibabaCloudPlatformStatus(ref), + "github.com/openshift/api/config/v1.AlibabaCloudResourceTag": schema_openshift_api_config_v1_AlibabaCloudResourceTag(ref), + "github.com/openshift/api/config/v1.Audit": schema_openshift_api_config_v1_Audit(ref), + "github.com/openshift/api/config/v1.AuditConfig": schema_openshift_api_config_v1_AuditConfig(ref), + "github.com/openshift/api/config/v1.AuditCustomRule": schema_openshift_api_config_v1_AuditCustomRule(ref), + "github.com/openshift/api/config/v1.Authentication": schema_openshift_api_config_v1_Authentication(ref), + "github.com/openshift/api/config/v1.AuthenticationList": schema_openshift_api_config_v1_AuthenticationList(ref), + "github.com/openshift/api/config/v1.AuthenticationSpec": schema_openshift_api_config_v1_AuthenticationSpec(ref), + "github.com/openshift/api/config/v1.AuthenticationStatus": schema_openshift_api_config_v1_AuthenticationStatus(ref), + "github.com/openshift/api/config/v1.AzurePlatformSpec": schema_openshift_api_config_v1_AzurePlatformSpec(ref), + "github.com/openshift/api/config/v1.AzurePlatformStatus": schema_openshift_api_config_v1_AzurePlatformStatus(ref), + "github.com/openshift/api/config/v1.AzureResourceTag": schema_openshift_api_config_v1_AzureResourceTag(ref), + "github.com/openshift/api/config/v1.BareMetalPlatformLoadBalancer": schema_openshift_api_config_v1_BareMetalPlatformLoadBalancer(ref), + "github.com/openshift/api/config/v1.BareMetalPlatformSpec": schema_openshift_api_config_v1_BareMetalPlatformSpec(ref), + "github.com/openshift/api/config/v1.BareMetalPlatformStatus": schema_openshift_api_config_v1_BareMetalPlatformStatus(ref), + "github.com/openshift/api/config/v1.BasicAuthIdentityProvider": schema_openshift_api_config_v1_BasicAuthIdentityProvider(ref), + "github.com/openshift/api/config/v1.Build": schema_openshift_api_config_v1_Build(ref), + "github.com/openshift/api/config/v1.BuildDefaults": schema_openshift_api_config_v1_BuildDefaults(ref), + "github.com/openshift/api/config/v1.BuildList": schema_openshift_api_config_v1_BuildList(ref), + "github.com/openshift/api/config/v1.BuildOverrides": schema_openshift_api_config_v1_BuildOverrides(ref), + "github.com/openshift/api/config/v1.BuildSpec": schema_openshift_api_config_v1_BuildSpec(ref), + "github.com/openshift/api/config/v1.CertInfo": schema_openshift_api_config_v1_CertInfo(ref), + "github.com/openshift/api/config/v1.ClientConnectionOverrides": schema_openshift_api_config_v1_ClientConnectionOverrides(ref), + "github.com/openshift/api/config/v1.CloudControllerManagerStatus": schema_openshift_api_config_v1_CloudControllerManagerStatus(ref), + "github.com/openshift/api/config/v1.CloudLoadBalancerConfig": schema_openshift_api_config_v1_CloudLoadBalancerConfig(ref), + "github.com/openshift/api/config/v1.CloudLoadBalancerIPs": schema_openshift_api_config_v1_CloudLoadBalancerIPs(ref), + "github.com/openshift/api/config/v1.ClusterCondition": schema_openshift_api_config_v1_ClusterCondition(ref), + "github.com/openshift/api/config/v1.ClusterImagePolicy": schema_openshift_api_config_v1_ClusterImagePolicy(ref), + "github.com/openshift/api/config/v1.ClusterImagePolicyList": schema_openshift_api_config_v1_ClusterImagePolicyList(ref), + "github.com/openshift/api/config/v1.ClusterImagePolicySpec": schema_openshift_api_config_v1_ClusterImagePolicySpec(ref), + "github.com/openshift/api/config/v1.ClusterImagePolicyStatus": schema_openshift_api_config_v1_ClusterImagePolicyStatus(ref), + "github.com/openshift/api/config/v1.ClusterNetworkEntry": schema_openshift_api_config_v1_ClusterNetworkEntry(ref), + "github.com/openshift/api/config/v1.ClusterOperator": schema_openshift_api_config_v1_ClusterOperator(ref), + "github.com/openshift/api/config/v1.ClusterOperatorList": schema_openshift_api_config_v1_ClusterOperatorList(ref), + "github.com/openshift/api/config/v1.ClusterOperatorSpec": schema_openshift_api_config_v1_ClusterOperatorSpec(ref), + "github.com/openshift/api/config/v1.ClusterOperatorStatus": schema_openshift_api_config_v1_ClusterOperatorStatus(ref), + "github.com/openshift/api/config/v1.ClusterOperatorStatusCondition": schema_openshift_api_config_v1_ClusterOperatorStatusCondition(ref), + "github.com/openshift/api/config/v1.ClusterVersion": schema_openshift_api_config_v1_ClusterVersion(ref), + "github.com/openshift/api/config/v1.ClusterVersionCapabilitiesSpec": schema_openshift_api_config_v1_ClusterVersionCapabilitiesSpec(ref), + "github.com/openshift/api/config/v1.ClusterVersionCapabilitiesStatus": schema_openshift_api_config_v1_ClusterVersionCapabilitiesStatus(ref), + "github.com/openshift/api/config/v1.ClusterVersionList": schema_openshift_api_config_v1_ClusterVersionList(ref), + "github.com/openshift/api/config/v1.ClusterVersionSpec": schema_openshift_api_config_v1_ClusterVersionSpec(ref), + "github.com/openshift/api/config/v1.ClusterVersionStatus": schema_openshift_api_config_v1_ClusterVersionStatus(ref), + "github.com/openshift/api/config/v1.ComponentOverride": schema_openshift_api_config_v1_ComponentOverride(ref), + "github.com/openshift/api/config/v1.ComponentRouteSpec": schema_openshift_api_config_v1_ComponentRouteSpec(ref), + "github.com/openshift/api/config/v1.ComponentRouteStatus": schema_openshift_api_config_v1_ComponentRouteStatus(ref), + "github.com/openshift/api/config/v1.ConditionalUpdate": schema_openshift_api_config_v1_ConditionalUpdate(ref), + "github.com/openshift/api/config/v1.ConditionalUpdateRisk": schema_openshift_api_config_v1_ConditionalUpdateRisk(ref), + "github.com/openshift/api/config/v1.ConfigMapFileReference": schema_openshift_api_config_v1_ConfigMapFileReference(ref), + "github.com/openshift/api/config/v1.ConfigMapNameReference": schema_openshift_api_config_v1_ConfigMapNameReference(ref), + "github.com/openshift/api/config/v1.Console": schema_openshift_api_config_v1_Console(ref), + "github.com/openshift/api/config/v1.ConsoleAuthentication": schema_openshift_api_config_v1_ConsoleAuthentication(ref), + "github.com/openshift/api/config/v1.ConsoleList": schema_openshift_api_config_v1_ConsoleList(ref), + "github.com/openshift/api/config/v1.ConsoleSpec": schema_openshift_api_config_v1_ConsoleSpec(ref), + "github.com/openshift/api/config/v1.ConsoleStatus": schema_openshift_api_config_v1_ConsoleStatus(ref), + "github.com/openshift/api/config/v1.Custom": schema_openshift_api_config_v1_Custom(ref), + "github.com/openshift/api/config/v1.CustomFeatureGates": schema_openshift_api_config_v1_CustomFeatureGates(ref), + "github.com/openshift/api/config/v1.CustomTLSProfile": schema_openshift_api_config_v1_CustomTLSProfile(ref), + "github.com/openshift/api/config/v1.DNS": schema_openshift_api_config_v1_DNS(ref), + "github.com/openshift/api/config/v1.DNSList": schema_openshift_api_config_v1_DNSList(ref), + "github.com/openshift/api/config/v1.DNSPlatformSpec": schema_openshift_api_config_v1_DNSPlatformSpec(ref), + "github.com/openshift/api/config/v1.DNSSpec": schema_openshift_api_config_v1_DNSSpec(ref), + "github.com/openshift/api/config/v1.DNSStatus": schema_openshift_api_config_v1_DNSStatus(ref), + "github.com/openshift/api/config/v1.DNSZone": schema_openshift_api_config_v1_DNSZone(ref), + "github.com/openshift/api/config/v1.DelegatedAuthentication": schema_openshift_api_config_v1_DelegatedAuthentication(ref), + "github.com/openshift/api/config/v1.DelegatedAuthorization": schema_openshift_api_config_v1_DelegatedAuthorization(ref), + "github.com/openshift/api/config/v1.DeprecatedWebhookTokenAuthenticator": schema_openshift_api_config_v1_DeprecatedWebhookTokenAuthenticator(ref), + "github.com/openshift/api/config/v1.EquinixMetalPlatformSpec": schema_openshift_api_config_v1_EquinixMetalPlatformSpec(ref), + "github.com/openshift/api/config/v1.EquinixMetalPlatformStatus": schema_openshift_api_config_v1_EquinixMetalPlatformStatus(ref), + "github.com/openshift/api/config/v1.EtcdConnectionInfo": schema_openshift_api_config_v1_EtcdConnectionInfo(ref), + "github.com/openshift/api/config/v1.EtcdStorageConfig": schema_openshift_api_config_v1_EtcdStorageConfig(ref), + "github.com/openshift/api/config/v1.ExternalIPConfig": schema_openshift_api_config_v1_ExternalIPConfig(ref), + "github.com/openshift/api/config/v1.ExternalIPPolicy": schema_openshift_api_config_v1_ExternalIPPolicy(ref), + "github.com/openshift/api/config/v1.ExternalPlatformSpec": schema_openshift_api_config_v1_ExternalPlatformSpec(ref), + "github.com/openshift/api/config/v1.ExternalPlatformStatus": schema_openshift_api_config_v1_ExternalPlatformStatus(ref), + "github.com/openshift/api/config/v1.ExtraMapping": schema_openshift_api_config_v1_ExtraMapping(ref), + "github.com/openshift/api/config/v1.FeatureGate": schema_openshift_api_config_v1_FeatureGate(ref), + "github.com/openshift/api/config/v1.FeatureGateAttributes": schema_openshift_api_config_v1_FeatureGateAttributes(ref), + "github.com/openshift/api/config/v1.FeatureGateDetails": schema_openshift_api_config_v1_FeatureGateDetails(ref), + "github.com/openshift/api/config/v1.FeatureGateList": schema_openshift_api_config_v1_FeatureGateList(ref), + "github.com/openshift/api/config/v1.FeatureGateSelection": schema_openshift_api_config_v1_FeatureGateSelection(ref), + "github.com/openshift/api/config/v1.FeatureGateSpec": schema_openshift_api_config_v1_FeatureGateSpec(ref), + "github.com/openshift/api/config/v1.FeatureGateStatus": schema_openshift_api_config_v1_FeatureGateStatus(ref), + "github.com/openshift/api/config/v1.FeatureGateTests": schema_openshift_api_config_v1_FeatureGateTests(ref), + "github.com/openshift/api/config/v1.GCPPlatformSpec": schema_openshift_api_config_v1_GCPPlatformSpec(ref), + "github.com/openshift/api/config/v1.GCPPlatformStatus": schema_openshift_api_config_v1_GCPPlatformStatus(ref), + "github.com/openshift/api/config/v1.GCPResourceLabel": schema_openshift_api_config_v1_GCPResourceLabel(ref), + "github.com/openshift/api/config/v1.GCPResourceTag": schema_openshift_api_config_v1_GCPResourceTag(ref), + "github.com/openshift/api/config/v1.GatherConfig": schema_openshift_api_config_v1_GatherConfig(ref), + "github.com/openshift/api/config/v1.GathererConfig": schema_openshift_api_config_v1_GathererConfig(ref), + "github.com/openshift/api/config/v1.Gatherers": schema_openshift_api_config_v1_Gatherers(ref), + "github.com/openshift/api/config/v1.GenericAPIServerConfig": schema_openshift_api_config_v1_GenericAPIServerConfig(ref), + "github.com/openshift/api/config/v1.GenericControllerConfig": schema_openshift_api_config_v1_GenericControllerConfig(ref), + "github.com/openshift/api/config/v1.GitHubIdentityProvider": schema_openshift_api_config_v1_GitHubIdentityProvider(ref), + "github.com/openshift/api/config/v1.GitLabIdentityProvider": schema_openshift_api_config_v1_GitLabIdentityProvider(ref), + "github.com/openshift/api/config/v1.GoogleIdentityProvider": schema_openshift_api_config_v1_GoogleIdentityProvider(ref), + "github.com/openshift/api/config/v1.HTPasswdIdentityProvider": schema_openshift_api_config_v1_HTPasswdIdentityProvider(ref), + "github.com/openshift/api/config/v1.HTTPServingInfo": schema_openshift_api_config_v1_HTTPServingInfo(ref), + "github.com/openshift/api/config/v1.HubSource": schema_openshift_api_config_v1_HubSource(ref), + "github.com/openshift/api/config/v1.HubSourceStatus": schema_openshift_api_config_v1_HubSourceStatus(ref), + "github.com/openshift/api/config/v1.IBMCloudPlatformSpec": schema_openshift_api_config_v1_IBMCloudPlatformSpec(ref), + "github.com/openshift/api/config/v1.IBMCloudPlatformStatus": schema_openshift_api_config_v1_IBMCloudPlatformStatus(ref), + "github.com/openshift/api/config/v1.IBMCloudServiceEndpoint": schema_openshift_api_config_v1_IBMCloudServiceEndpoint(ref), + "github.com/openshift/api/config/v1.IdentityProvider": schema_openshift_api_config_v1_IdentityProvider(ref), + "github.com/openshift/api/config/v1.IdentityProviderConfig": schema_openshift_api_config_v1_IdentityProviderConfig(ref), + "github.com/openshift/api/config/v1.Image": schema_openshift_api_config_v1_Image(ref), + "github.com/openshift/api/config/v1.ImageContentPolicy": schema_openshift_api_config_v1_ImageContentPolicy(ref), + "github.com/openshift/api/config/v1.ImageContentPolicyList": schema_openshift_api_config_v1_ImageContentPolicyList(ref), + "github.com/openshift/api/config/v1.ImageContentPolicySpec": schema_openshift_api_config_v1_ImageContentPolicySpec(ref), + "github.com/openshift/api/config/v1.ImageDigestMirrorSet": schema_openshift_api_config_v1_ImageDigestMirrorSet(ref), + "github.com/openshift/api/config/v1.ImageDigestMirrorSetList": schema_openshift_api_config_v1_ImageDigestMirrorSetList(ref), + "github.com/openshift/api/config/v1.ImageDigestMirrorSetSpec": schema_openshift_api_config_v1_ImageDigestMirrorSetSpec(ref), + "github.com/openshift/api/config/v1.ImageDigestMirrorSetStatus": schema_openshift_api_config_v1_ImageDigestMirrorSetStatus(ref), + "github.com/openshift/api/config/v1.ImageDigestMirrors": schema_openshift_api_config_v1_ImageDigestMirrors(ref), + "github.com/openshift/api/config/v1.ImageLabel": schema_openshift_api_config_v1_ImageLabel(ref), + "github.com/openshift/api/config/v1.ImageList": schema_openshift_api_config_v1_ImageList(ref), + "github.com/openshift/api/config/v1.ImagePolicy": schema_openshift_api_config_v1_ImagePolicy(ref), + "github.com/openshift/api/config/v1.ImagePolicyFulcioCAWithRekorRootOfTrust": schema_openshift_api_config_v1_ImagePolicyFulcioCAWithRekorRootOfTrust(ref), + "github.com/openshift/api/config/v1.ImagePolicyList": schema_openshift_api_config_v1_ImagePolicyList(ref), + "github.com/openshift/api/config/v1.ImagePolicyPKIRootOfTrust": schema_openshift_api_config_v1_ImagePolicyPKIRootOfTrust(ref), + "github.com/openshift/api/config/v1.ImagePolicyPublicKeyRootOfTrust": schema_openshift_api_config_v1_ImagePolicyPublicKeyRootOfTrust(ref), + "github.com/openshift/api/config/v1.ImagePolicySpec": schema_openshift_api_config_v1_ImagePolicySpec(ref), + "github.com/openshift/api/config/v1.ImagePolicyStatus": schema_openshift_api_config_v1_ImagePolicyStatus(ref), + "github.com/openshift/api/config/v1.ImageSigstoreVerificationPolicy": schema_openshift_api_config_v1_ImageSigstoreVerificationPolicy(ref), + "github.com/openshift/api/config/v1.ImageSpec": schema_openshift_api_config_v1_ImageSpec(ref), + "github.com/openshift/api/config/v1.ImageStatus": schema_openshift_api_config_v1_ImageStatus(ref), + "github.com/openshift/api/config/v1.ImageTagMirrorSet": schema_openshift_api_config_v1_ImageTagMirrorSet(ref), + "github.com/openshift/api/config/v1.ImageTagMirrorSetList": schema_openshift_api_config_v1_ImageTagMirrorSetList(ref), + "github.com/openshift/api/config/v1.ImageTagMirrorSetSpec": schema_openshift_api_config_v1_ImageTagMirrorSetSpec(ref), + "github.com/openshift/api/config/v1.ImageTagMirrorSetStatus": schema_openshift_api_config_v1_ImageTagMirrorSetStatus(ref), + "github.com/openshift/api/config/v1.ImageTagMirrors": schema_openshift_api_config_v1_ImageTagMirrors(ref), + "github.com/openshift/api/config/v1.Infrastructure": schema_openshift_api_config_v1_Infrastructure(ref), + "github.com/openshift/api/config/v1.InfrastructureList": schema_openshift_api_config_v1_InfrastructureList(ref), + "github.com/openshift/api/config/v1.InfrastructureSpec": schema_openshift_api_config_v1_InfrastructureSpec(ref), + "github.com/openshift/api/config/v1.InfrastructureStatus": schema_openshift_api_config_v1_InfrastructureStatus(ref), + "github.com/openshift/api/config/v1.Ingress": schema_openshift_api_config_v1_Ingress(ref), + "github.com/openshift/api/config/v1.IngressList": schema_openshift_api_config_v1_IngressList(ref), + "github.com/openshift/api/config/v1.IngressPlatformSpec": schema_openshift_api_config_v1_IngressPlatformSpec(ref), + "github.com/openshift/api/config/v1.IngressSpec": schema_openshift_api_config_v1_IngressSpec(ref), + "github.com/openshift/api/config/v1.IngressStatus": schema_openshift_api_config_v1_IngressStatus(ref), + "github.com/openshift/api/config/v1.InsightsDataGather": schema_openshift_api_config_v1_InsightsDataGather(ref), + "github.com/openshift/api/config/v1.InsightsDataGatherList": schema_openshift_api_config_v1_InsightsDataGatherList(ref), + "github.com/openshift/api/config/v1.InsightsDataGatherSpec": schema_openshift_api_config_v1_InsightsDataGatherSpec(ref), + "github.com/openshift/api/config/v1.IntermediateTLSProfile": schema_openshift_api_config_v1_IntermediateTLSProfile(ref), + "github.com/openshift/api/config/v1.KMSConfig": schema_openshift_api_config_v1_KMSConfig(ref), + "github.com/openshift/api/config/v1.KeystoneIdentityProvider": schema_openshift_api_config_v1_KeystoneIdentityProvider(ref), + "github.com/openshift/api/config/v1.KubeClientConfig": schema_openshift_api_config_v1_KubeClientConfig(ref), + "github.com/openshift/api/config/v1.KubevirtPlatformSpec": schema_openshift_api_config_v1_KubevirtPlatformSpec(ref), + "github.com/openshift/api/config/v1.KubevirtPlatformStatus": schema_openshift_api_config_v1_KubevirtPlatformStatus(ref), + "github.com/openshift/api/config/v1.LDAPAttributeMapping": schema_openshift_api_config_v1_LDAPAttributeMapping(ref), + "github.com/openshift/api/config/v1.LDAPIdentityProvider": schema_openshift_api_config_v1_LDAPIdentityProvider(ref), + "github.com/openshift/api/config/v1.LeaderElection": schema_openshift_api_config_v1_LeaderElection(ref), + "github.com/openshift/api/config/v1.LoadBalancer": schema_openshift_api_config_v1_LoadBalancer(ref), + "github.com/openshift/api/config/v1.MTUMigration": schema_openshift_api_config_v1_MTUMigration(ref), + "github.com/openshift/api/config/v1.MTUMigrationValues": schema_openshift_api_config_v1_MTUMigrationValues(ref), + "github.com/openshift/api/config/v1.MaxAgePolicy": schema_openshift_api_config_v1_MaxAgePolicy(ref), + "github.com/openshift/api/config/v1.ModernTLSProfile": schema_openshift_api_config_v1_ModernTLSProfile(ref), + "github.com/openshift/api/config/v1.NamedCertificate": schema_openshift_api_config_v1_NamedCertificate(ref), + "github.com/openshift/api/config/v1.Network": schema_openshift_api_config_v1_Network(ref), + "github.com/openshift/api/config/v1.NetworkDiagnostics": schema_openshift_api_config_v1_NetworkDiagnostics(ref), + "github.com/openshift/api/config/v1.NetworkDiagnosticsSourcePlacement": schema_openshift_api_config_v1_NetworkDiagnosticsSourcePlacement(ref), + "github.com/openshift/api/config/v1.NetworkDiagnosticsTargetPlacement": schema_openshift_api_config_v1_NetworkDiagnosticsTargetPlacement(ref), + "github.com/openshift/api/config/v1.NetworkList": schema_openshift_api_config_v1_NetworkList(ref), + "github.com/openshift/api/config/v1.NetworkMigration": schema_openshift_api_config_v1_NetworkMigration(ref), + "github.com/openshift/api/config/v1.NetworkSpec": schema_openshift_api_config_v1_NetworkSpec(ref), + "github.com/openshift/api/config/v1.NetworkStatus": schema_openshift_api_config_v1_NetworkStatus(ref), + "github.com/openshift/api/config/v1.Node": schema_openshift_api_config_v1_Node(ref), + "github.com/openshift/api/config/v1.NodeList": schema_openshift_api_config_v1_NodeList(ref), + "github.com/openshift/api/config/v1.NodeSpec": schema_openshift_api_config_v1_NodeSpec(ref), + "github.com/openshift/api/config/v1.NodeStatus": schema_openshift_api_config_v1_NodeStatus(ref), + "github.com/openshift/api/config/v1.NutanixFailureDomain": schema_openshift_api_config_v1_NutanixFailureDomain(ref), + "github.com/openshift/api/config/v1.NutanixPlatformLoadBalancer": schema_openshift_api_config_v1_NutanixPlatformLoadBalancer(ref), + "github.com/openshift/api/config/v1.NutanixPlatformSpec": schema_openshift_api_config_v1_NutanixPlatformSpec(ref), + "github.com/openshift/api/config/v1.NutanixPlatformStatus": schema_openshift_api_config_v1_NutanixPlatformStatus(ref), + "github.com/openshift/api/config/v1.NutanixPrismElementEndpoint": schema_openshift_api_config_v1_NutanixPrismElementEndpoint(ref), + "github.com/openshift/api/config/v1.NutanixPrismEndpoint": schema_openshift_api_config_v1_NutanixPrismEndpoint(ref), + "github.com/openshift/api/config/v1.NutanixResourceIdentifier": schema_openshift_api_config_v1_NutanixResourceIdentifier(ref), + "github.com/openshift/api/config/v1.OAuth": schema_openshift_api_config_v1_OAuth(ref), + "github.com/openshift/api/config/v1.OAuthList": schema_openshift_api_config_v1_OAuthList(ref), + "github.com/openshift/api/config/v1.OAuthRemoteConnectionInfo": schema_openshift_api_config_v1_OAuthRemoteConnectionInfo(ref), + "github.com/openshift/api/config/v1.OAuthSpec": schema_openshift_api_config_v1_OAuthSpec(ref), + "github.com/openshift/api/config/v1.OAuthStatus": schema_openshift_api_config_v1_OAuthStatus(ref), + "github.com/openshift/api/config/v1.OAuthTemplates": schema_openshift_api_config_v1_OAuthTemplates(ref), + "github.com/openshift/api/config/v1.OIDCClientConfig": schema_openshift_api_config_v1_OIDCClientConfig(ref), + "github.com/openshift/api/config/v1.OIDCClientReference": schema_openshift_api_config_v1_OIDCClientReference(ref), + "github.com/openshift/api/config/v1.OIDCClientStatus": schema_openshift_api_config_v1_OIDCClientStatus(ref), + "github.com/openshift/api/config/v1.OIDCProvider": schema_openshift_api_config_v1_OIDCProvider(ref), + "github.com/openshift/api/config/v1.ObjectReference": schema_openshift_api_config_v1_ObjectReference(ref), + "github.com/openshift/api/config/v1.OldTLSProfile": schema_openshift_api_config_v1_OldTLSProfile(ref), + "github.com/openshift/api/config/v1.OpenIDClaims": schema_openshift_api_config_v1_OpenIDClaims(ref), + "github.com/openshift/api/config/v1.OpenIDIdentityProvider": schema_openshift_api_config_v1_OpenIDIdentityProvider(ref), + "github.com/openshift/api/config/v1.OpenStackPlatformLoadBalancer": schema_openshift_api_config_v1_OpenStackPlatformLoadBalancer(ref), + "github.com/openshift/api/config/v1.OpenStackPlatformSpec": schema_openshift_api_config_v1_OpenStackPlatformSpec(ref), + "github.com/openshift/api/config/v1.OpenStackPlatformStatus": schema_openshift_api_config_v1_OpenStackPlatformStatus(ref), + "github.com/openshift/api/config/v1.OperandVersion": schema_openshift_api_config_v1_OperandVersion(ref), + "github.com/openshift/api/config/v1.OperatorHub": schema_openshift_api_config_v1_OperatorHub(ref), + "github.com/openshift/api/config/v1.OperatorHubList": schema_openshift_api_config_v1_OperatorHubList(ref), + "github.com/openshift/api/config/v1.OperatorHubSpec": schema_openshift_api_config_v1_OperatorHubSpec(ref), + "github.com/openshift/api/config/v1.OperatorHubStatus": schema_openshift_api_config_v1_OperatorHubStatus(ref), + "github.com/openshift/api/config/v1.OvirtPlatformLoadBalancer": schema_openshift_api_config_v1_OvirtPlatformLoadBalancer(ref), + "github.com/openshift/api/config/v1.OvirtPlatformSpec": schema_openshift_api_config_v1_OvirtPlatformSpec(ref), + "github.com/openshift/api/config/v1.OvirtPlatformStatus": schema_openshift_api_config_v1_OvirtPlatformStatus(ref), + "github.com/openshift/api/config/v1.PKICertificateSubject": schema_openshift_api_config_v1_PKICertificateSubject(ref), + "github.com/openshift/api/config/v1.PersistentVolumeClaimReference": schema_openshift_api_config_v1_PersistentVolumeClaimReference(ref), + "github.com/openshift/api/config/v1.PersistentVolumeConfig": schema_openshift_api_config_v1_PersistentVolumeConfig(ref), + "github.com/openshift/api/config/v1.PlatformSpec": schema_openshift_api_config_v1_PlatformSpec(ref), + "github.com/openshift/api/config/v1.PlatformStatus": schema_openshift_api_config_v1_PlatformStatus(ref), + "github.com/openshift/api/config/v1.PolicyFulcioSubject": schema_openshift_api_config_v1_PolicyFulcioSubject(ref), + "github.com/openshift/api/config/v1.PolicyIdentity": schema_openshift_api_config_v1_PolicyIdentity(ref), + "github.com/openshift/api/config/v1.PolicyMatchExactRepository": schema_openshift_api_config_v1_PolicyMatchExactRepository(ref), + "github.com/openshift/api/config/v1.PolicyMatchRemapIdentity": schema_openshift_api_config_v1_PolicyMatchRemapIdentity(ref), + "github.com/openshift/api/config/v1.PolicyRootOfTrust": schema_openshift_api_config_v1_PolicyRootOfTrust(ref), + "github.com/openshift/api/config/v1.PowerVSPlatformSpec": schema_openshift_api_config_v1_PowerVSPlatformSpec(ref), + "github.com/openshift/api/config/v1.PowerVSPlatformStatus": schema_openshift_api_config_v1_PowerVSPlatformStatus(ref), + "github.com/openshift/api/config/v1.PowerVSServiceEndpoint": schema_openshift_api_config_v1_PowerVSServiceEndpoint(ref), + "github.com/openshift/api/config/v1.PrefixedClaimMapping": schema_openshift_api_config_v1_PrefixedClaimMapping(ref), + "github.com/openshift/api/config/v1.ProfileCustomizations": schema_openshift_api_config_v1_ProfileCustomizations(ref), + "github.com/openshift/api/config/v1.Project": schema_openshift_api_config_v1_Project(ref), + "github.com/openshift/api/config/v1.ProjectList": schema_openshift_api_config_v1_ProjectList(ref), + "github.com/openshift/api/config/v1.ProjectSpec": schema_openshift_api_config_v1_ProjectSpec(ref), + "github.com/openshift/api/config/v1.ProjectStatus": schema_openshift_api_config_v1_ProjectStatus(ref), + "github.com/openshift/api/config/v1.PromQLClusterCondition": schema_openshift_api_config_v1_PromQLClusterCondition(ref), + "github.com/openshift/api/config/v1.Proxy": schema_openshift_api_config_v1_Proxy(ref), + "github.com/openshift/api/config/v1.ProxyList": schema_openshift_api_config_v1_ProxyList(ref), + "github.com/openshift/api/config/v1.ProxySpec": schema_openshift_api_config_v1_ProxySpec(ref), + "github.com/openshift/api/config/v1.ProxyStatus": schema_openshift_api_config_v1_ProxyStatus(ref), + "github.com/openshift/api/config/v1.RegistryLocation": schema_openshift_api_config_v1_RegistryLocation(ref), + "github.com/openshift/api/config/v1.RegistrySources": schema_openshift_api_config_v1_RegistrySources(ref), + "github.com/openshift/api/config/v1.Release": schema_openshift_api_config_v1_Release(ref), + "github.com/openshift/api/config/v1.RemoteConnectionInfo": schema_openshift_api_config_v1_RemoteConnectionInfo(ref), + "github.com/openshift/api/config/v1.RepositoryDigestMirrors": schema_openshift_api_config_v1_RepositoryDigestMirrors(ref), + "github.com/openshift/api/config/v1.RequestHeaderIdentityProvider": schema_openshift_api_config_v1_RequestHeaderIdentityProvider(ref), + "github.com/openshift/api/config/v1.RequiredHSTSPolicy": schema_openshift_api_config_v1_RequiredHSTSPolicy(ref), + "github.com/openshift/api/config/v1.Scheduler": schema_openshift_api_config_v1_Scheduler(ref), + "github.com/openshift/api/config/v1.SchedulerList": schema_openshift_api_config_v1_SchedulerList(ref), + "github.com/openshift/api/config/v1.SchedulerSpec": schema_openshift_api_config_v1_SchedulerSpec(ref), + "github.com/openshift/api/config/v1.SchedulerStatus": schema_openshift_api_config_v1_SchedulerStatus(ref), + "github.com/openshift/api/config/v1.SecretNameReference": schema_openshift_api_config_v1_SecretNameReference(ref), + "github.com/openshift/api/config/v1.ServingInfo": schema_openshift_api_config_v1_ServingInfo(ref), + "github.com/openshift/api/config/v1.SignatureStore": schema_openshift_api_config_v1_SignatureStore(ref), + "github.com/openshift/api/config/v1.Storage": schema_openshift_api_config_v1_Storage(ref), + "github.com/openshift/api/config/v1.StringSource": schema_openshift_api_config_v1_StringSource(ref), + "github.com/openshift/api/config/v1.StringSourceSpec": schema_openshift_api_config_v1_StringSourceSpec(ref), + "github.com/openshift/api/config/v1.TLSProfileSpec": schema_openshift_api_config_v1_TLSProfileSpec(ref), + "github.com/openshift/api/config/v1.TLSSecurityProfile": schema_openshift_api_config_v1_TLSSecurityProfile(ref), + "github.com/openshift/api/config/v1.TemplateReference": schema_openshift_api_config_v1_TemplateReference(ref), + "github.com/openshift/api/config/v1.TestDetails": schema_openshift_api_config_v1_TestDetails(ref), + "github.com/openshift/api/config/v1.TestReporting": schema_openshift_api_config_v1_TestReporting(ref), + "github.com/openshift/api/config/v1.TestReportingSpec": schema_openshift_api_config_v1_TestReportingSpec(ref), + "github.com/openshift/api/config/v1.TestReportingStatus": schema_openshift_api_config_v1_TestReportingStatus(ref), + "github.com/openshift/api/config/v1.TokenClaimMapping": schema_openshift_api_config_v1_TokenClaimMapping(ref), + "github.com/openshift/api/config/v1.TokenClaimMappings": schema_openshift_api_config_v1_TokenClaimMappings(ref), + "github.com/openshift/api/config/v1.TokenClaimOrExpressionMapping": schema_openshift_api_config_v1_TokenClaimOrExpressionMapping(ref), + "github.com/openshift/api/config/v1.TokenClaimValidationCELRule": schema_openshift_api_config_v1_TokenClaimValidationCELRule(ref), + "github.com/openshift/api/config/v1.TokenClaimValidationRule": schema_openshift_api_config_v1_TokenClaimValidationRule(ref), + "github.com/openshift/api/config/v1.TokenConfig": schema_openshift_api_config_v1_TokenConfig(ref), + "github.com/openshift/api/config/v1.TokenIssuer": schema_openshift_api_config_v1_TokenIssuer(ref), + "github.com/openshift/api/config/v1.TokenRequiredClaim": schema_openshift_api_config_v1_TokenRequiredClaim(ref), + "github.com/openshift/api/config/v1.TokenUserValidationRule": schema_openshift_api_config_v1_TokenUserValidationRule(ref), + "github.com/openshift/api/config/v1.Update": schema_openshift_api_config_v1_Update(ref), + "github.com/openshift/api/config/v1.UpdateHistory": schema_openshift_api_config_v1_UpdateHistory(ref), + "github.com/openshift/api/config/v1.UsernameClaimMapping": schema_openshift_api_config_v1_UsernameClaimMapping(ref), + "github.com/openshift/api/config/v1.UsernamePrefix": schema_openshift_api_config_v1_UsernamePrefix(ref), + "github.com/openshift/api/config/v1.VSphereFailureDomainHostGroup": schema_openshift_api_config_v1_VSphereFailureDomainHostGroup(ref), + "github.com/openshift/api/config/v1.VSphereFailureDomainRegionAffinity": schema_openshift_api_config_v1_VSphereFailureDomainRegionAffinity(ref), + "github.com/openshift/api/config/v1.VSphereFailureDomainZoneAffinity": schema_openshift_api_config_v1_VSphereFailureDomainZoneAffinity(ref), + "github.com/openshift/api/config/v1.VSpherePlatformFailureDomainSpec": schema_openshift_api_config_v1_VSpherePlatformFailureDomainSpec(ref), + "github.com/openshift/api/config/v1.VSpherePlatformLoadBalancer": schema_openshift_api_config_v1_VSpherePlatformLoadBalancer(ref), + "github.com/openshift/api/config/v1.VSpherePlatformNodeNetworking": schema_openshift_api_config_v1_VSpherePlatformNodeNetworking(ref), + "github.com/openshift/api/config/v1.VSpherePlatformNodeNetworkingSpec": schema_openshift_api_config_v1_VSpherePlatformNodeNetworkingSpec(ref), + "github.com/openshift/api/config/v1.VSpherePlatformSpec": schema_openshift_api_config_v1_VSpherePlatformSpec(ref), + "github.com/openshift/api/config/v1.VSpherePlatformStatus": schema_openshift_api_config_v1_VSpherePlatformStatus(ref), + "github.com/openshift/api/config/v1.VSpherePlatformTopology": schema_openshift_api_config_v1_VSpherePlatformTopology(ref), + "github.com/openshift/api/config/v1.VSpherePlatformVCenterSpec": schema_openshift_api_config_v1_VSpherePlatformVCenterSpec(ref), + "github.com/openshift/api/config/v1.WebhookTokenAuthenticator": schema_openshift_api_config_v1_WebhookTokenAuthenticator(ref), + "github.com/openshift/api/config/v1alpha1.AdditionalAlertmanagerConfig": schema_openshift_api_config_v1alpha1_AdditionalAlertmanagerConfig(ref), + "github.com/openshift/api/config/v1alpha1.AlertmanagerConfig": schema_openshift_api_config_v1alpha1_AlertmanagerConfig(ref), + "github.com/openshift/api/config/v1alpha1.AlertmanagerCustomConfig": schema_openshift_api_config_v1alpha1_AlertmanagerCustomConfig(ref), + "github.com/openshift/api/config/v1alpha1.Audit": schema_openshift_api_config_v1alpha1_Audit(ref), + "github.com/openshift/api/config/v1alpha1.AuthorizationConfig": schema_openshift_api_config_v1alpha1_AuthorizationConfig(ref), + "github.com/openshift/api/config/v1alpha1.Backup": schema_openshift_api_config_v1alpha1_Backup(ref), + "github.com/openshift/api/config/v1alpha1.BackupList": schema_openshift_api_config_v1alpha1_BackupList(ref), + "github.com/openshift/api/config/v1alpha1.BackupSpec": schema_openshift_api_config_v1alpha1_BackupSpec(ref), + "github.com/openshift/api/config/v1alpha1.BackupStatus": schema_openshift_api_config_v1alpha1_BackupStatus(ref), + "github.com/openshift/api/config/v1alpha1.BasicAuth": schema_openshift_api_config_v1alpha1_BasicAuth(ref), + "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfig": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfig(ref), + "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigList": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigList(ref), + "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigSpec": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigSpec(ref), + "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigStatus": schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigStatus(ref), + "github.com/openshift/api/config/v1alpha1.CertificateConfig": schema_openshift_api_config_v1alpha1_CertificateConfig(ref), + "github.com/openshift/api/config/v1alpha1.ClusterMonitoring": schema_openshift_api_config_v1alpha1_ClusterMonitoring(ref), + "github.com/openshift/api/config/v1alpha1.ClusterMonitoringList": schema_openshift_api_config_v1alpha1_ClusterMonitoringList(ref), + "github.com/openshift/api/config/v1alpha1.ClusterMonitoringSpec": schema_openshift_api_config_v1alpha1_ClusterMonitoringSpec(ref), + "github.com/openshift/api/config/v1alpha1.ClusterMonitoringStatus": schema_openshift_api_config_v1alpha1_ClusterMonitoringStatus(ref), + "github.com/openshift/api/config/v1alpha1.ContainerResource": schema_openshift_api_config_v1alpha1_ContainerResource(ref), + "github.com/openshift/api/config/v1alpha1.CustomPKIPolicy": schema_openshift_api_config_v1alpha1_CustomPKIPolicy(ref), + "github.com/openshift/api/config/v1alpha1.DefaultCertificateConfig": schema_openshift_api_config_v1alpha1_DefaultCertificateConfig(ref), + "github.com/openshift/api/config/v1alpha1.DropEqualActionConfig": schema_openshift_api_config_v1alpha1_DropEqualActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.ECDSAKeyConfig": schema_openshift_api_config_v1alpha1_ECDSAKeyConfig(ref), + "github.com/openshift/api/config/v1alpha1.EtcdBackupSpec": schema_openshift_api_config_v1alpha1_EtcdBackupSpec(ref), + "github.com/openshift/api/config/v1alpha1.GatherConfig": schema_openshift_api_config_v1alpha1_GatherConfig(ref), + "github.com/openshift/api/config/v1alpha1.HashModActionConfig": schema_openshift_api_config_v1alpha1_HashModActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.InsightsDataGather": schema_openshift_api_config_v1alpha1_InsightsDataGather(ref), + "github.com/openshift/api/config/v1alpha1.InsightsDataGatherList": schema_openshift_api_config_v1alpha1_InsightsDataGatherList(ref), + "github.com/openshift/api/config/v1alpha1.InsightsDataGatherSpec": schema_openshift_api_config_v1alpha1_InsightsDataGatherSpec(ref), + "github.com/openshift/api/config/v1alpha1.InsightsDataGatherStatus": schema_openshift_api_config_v1alpha1_InsightsDataGatherStatus(ref), + "github.com/openshift/api/config/v1alpha1.KeepEqualActionConfig": schema_openshift_api_config_v1alpha1_KeepEqualActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.KeyConfig": schema_openshift_api_config_v1alpha1_KeyConfig(ref), + "github.com/openshift/api/config/v1alpha1.Label": schema_openshift_api_config_v1alpha1_Label(ref), + "github.com/openshift/api/config/v1alpha1.LabelMapActionConfig": schema_openshift_api_config_v1alpha1_LabelMapActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.LowercaseActionConfig": schema_openshift_api_config_v1alpha1_LowercaseActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.MetadataConfig": schema_openshift_api_config_v1alpha1_MetadataConfig(ref), + "github.com/openshift/api/config/v1alpha1.MetadataConfigCustom": schema_openshift_api_config_v1alpha1_MetadataConfigCustom(ref), + "github.com/openshift/api/config/v1alpha1.MetricsServerConfig": schema_openshift_api_config_v1alpha1_MetricsServerConfig(ref), + "github.com/openshift/api/config/v1alpha1.OAuth2": schema_openshift_api_config_v1alpha1_OAuth2(ref), + "github.com/openshift/api/config/v1alpha1.OAuth2EndpointParam": schema_openshift_api_config_v1alpha1_OAuth2EndpointParam(ref), + "github.com/openshift/api/config/v1alpha1.OpenShiftStateMetricsConfig": schema_openshift_api_config_v1alpha1_OpenShiftStateMetricsConfig(ref), + "github.com/openshift/api/config/v1alpha1.PKI": schema_openshift_api_config_v1alpha1_PKI(ref), + "github.com/openshift/api/config/v1alpha1.PKICertificateManagement": schema_openshift_api_config_v1alpha1_PKICertificateManagement(ref), + "github.com/openshift/api/config/v1alpha1.PKIList": schema_openshift_api_config_v1alpha1_PKIList(ref), + "github.com/openshift/api/config/v1alpha1.PKIProfile": schema_openshift_api_config_v1alpha1_PKIProfile(ref), + "github.com/openshift/api/config/v1alpha1.PKISpec": schema_openshift_api_config_v1alpha1_PKISpec(ref), + "github.com/openshift/api/config/v1alpha1.PersistentVolumeClaimReference": schema_openshift_api_config_v1alpha1_PersistentVolumeClaimReference(ref), + "github.com/openshift/api/config/v1alpha1.PersistentVolumeConfig": schema_openshift_api_config_v1alpha1_PersistentVolumeConfig(ref), + "github.com/openshift/api/config/v1alpha1.PrometheusConfig": schema_openshift_api_config_v1alpha1_PrometheusConfig(ref), + "github.com/openshift/api/config/v1alpha1.PrometheusOperatorAdmissionWebhookConfig": schema_openshift_api_config_v1alpha1_PrometheusOperatorAdmissionWebhookConfig(ref), + "github.com/openshift/api/config/v1alpha1.PrometheusOperatorConfig": schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref), + "github.com/openshift/api/config/v1alpha1.PrometheusRemoteWriteHeader": schema_openshift_api_config_v1alpha1_PrometheusRemoteWriteHeader(ref), + "github.com/openshift/api/config/v1alpha1.QueueConfig": schema_openshift_api_config_v1alpha1_QueueConfig(ref), + "github.com/openshift/api/config/v1alpha1.RSAKeyConfig": schema_openshift_api_config_v1alpha1_RSAKeyConfig(ref), + "github.com/openshift/api/config/v1alpha1.RelabelActionConfig": schema_openshift_api_config_v1alpha1_RelabelActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.RelabelConfig": schema_openshift_api_config_v1alpha1_RelabelConfig(ref), + "github.com/openshift/api/config/v1alpha1.RemoteWriteAuthorization": schema_openshift_api_config_v1alpha1_RemoteWriteAuthorization(ref), + "github.com/openshift/api/config/v1alpha1.RemoteWriteSpec": schema_openshift_api_config_v1alpha1_RemoteWriteSpec(ref), + "github.com/openshift/api/config/v1alpha1.ReplaceActionConfig": schema_openshift_api_config_v1alpha1_ReplaceActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.Retention": schema_openshift_api_config_v1alpha1_Retention(ref), + "github.com/openshift/api/config/v1alpha1.RetentionNumberConfig": schema_openshift_api_config_v1alpha1_RetentionNumberConfig(ref), + "github.com/openshift/api/config/v1alpha1.RetentionPolicy": schema_openshift_api_config_v1alpha1_RetentionPolicy(ref), + "github.com/openshift/api/config/v1alpha1.RetentionSizeConfig": schema_openshift_api_config_v1alpha1_RetentionSizeConfig(ref), + "github.com/openshift/api/config/v1alpha1.SecretKeySelector": schema_openshift_api_config_v1alpha1_SecretKeySelector(ref), + "github.com/openshift/api/config/v1alpha1.Sigv4": schema_openshift_api_config_v1alpha1_Sigv4(ref), + "github.com/openshift/api/config/v1alpha1.Storage": schema_openshift_api_config_v1alpha1_Storage(ref), + "github.com/openshift/api/config/v1alpha1.TLSConfig": schema_openshift_api_config_v1alpha1_TLSConfig(ref), + "github.com/openshift/api/config/v1alpha1.TelemeterClientConfig": schema_openshift_api_config_v1alpha1_TelemeterClientConfig(ref), + "github.com/openshift/api/config/v1alpha1.ThanosQuerierConfig": schema_openshift_api_config_v1alpha1_ThanosQuerierConfig(ref), + "github.com/openshift/api/config/v1alpha1.UppercaseActionConfig": schema_openshift_api_config_v1alpha1_UppercaseActionConfig(ref), + "github.com/openshift/api/config/v1alpha1.UserDefinedMonitoring": schema_openshift_api_config_v1alpha1_UserDefinedMonitoring(ref), + "github.com/openshift/api/config/v1alpha2.Custom": schema_openshift_api_config_v1alpha2_Custom(ref), + "github.com/openshift/api/config/v1alpha2.GatherConfig": schema_openshift_api_config_v1alpha2_GatherConfig(ref), + "github.com/openshift/api/config/v1alpha2.GathererConfig": schema_openshift_api_config_v1alpha2_GathererConfig(ref), + "github.com/openshift/api/config/v1alpha2.Gatherers": schema_openshift_api_config_v1alpha2_Gatherers(ref), + "github.com/openshift/api/config/v1alpha2.InsightsDataGather": schema_openshift_api_config_v1alpha2_InsightsDataGather(ref), + "github.com/openshift/api/config/v1alpha2.InsightsDataGatherList": schema_openshift_api_config_v1alpha2_InsightsDataGatherList(ref), + "github.com/openshift/api/config/v1alpha2.InsightsDataGatherSpec": schema_openshift_api_config_v1alpha2_InsightsDataGatherSpec(ref), + "github.com/openshift/api/config/v1alpha2.InsightsDataGatherStatus": schema_openshift_api_config_v1alpha2_InsightsDataGatherStatus(ref), + "github.com/openshift/api/config/v1alpha2.PersistentVolumeClaimReference": schema_openshift_api_config_v1alpha2_PersistentVolumeClaimReference(ref), + "github.com/openshift/api/config/v1alpha2.PersistentVolumeConfig": schema_openshift_api_config_v1alpha2_PersistentVolumeConfig(ref), + "github.com/openshift/api/config/v1alpha2.Storage": schema_openshift_api_config_v1alpha2_Storage(ref), + "github.com/openshift/api/console/v1.ApplicationMenuSpec": schema_openshift_api_console_v1_ApplicationMenuSpec(ref), + "github.com/openshift/api/console/v1.CLIDownloadLink": schema_openshift_api_console_v1_CLIDownloadLink(ref), + "github.com/openshift/api/console/v1.ConsoleCLIDownload": schema_openshift_api_console_v1_ConsoleCLIDownload(ref), + "github.com/openshift/api/console/v1.ConsoleCLIDownloadList": schema_openshift_api_console_v1_ConsoleCLIDownloadList(ref), + "github.com/openshift/api/console/v1.ConsoleCLIDownloadSpec": schema_openshift_api_console_v1_ConsoleCLIDownloadSpec(ref), + "github.com/openshift/api/console/v1.ConsoleExternalLogLink": schema_openshift_api_console_v1_ConsoleExternalLogLink(ref), + "github.com/openshift/api/console/v1.ConsoleExternalLogLinkList": schema_openshift_api_console_v1_ConsoleExternalLogLinkList(ref), + "github.com/openshift/api/console/v1.ConsoleExternalLogLinkSpec": schema_openshift_api_console_v1_ConsoleExternalLogLinkSpec(ref), + "github.com/openshift/api/console/v1.ConsoleLink": schema_openshift_api_console_v1_ConsoleLink(ref), + "github.com/openshift/api/console/v1.ConsoleLinkList": schema_openshift_api_console_v1_ConsoleLinkList(ref), + "github.com/openshift/api/console/v1.ConsoleLinkSpec": schema_openshift_api_console_v1_ConsoleLinkSpec(ref), + "github.com/openshift/api/console/v1.ConsoleNotification": schema_openshift_api_console_v1_ConsoleNotification(ref), + "github.com/openshift/api/console/v1.ConsoleNotificationList": schema_openshift_api_console_v1_ConsoleNotificationList(ref), + "github.com/openshift/api/console/v1.ConsoleNotificationSpec": schema_openshift_api_console_v1_ConsoleNotificationSpec(ref), + "github.com/openshift/api/console/v1.ConsolePlugin": schema_openshift_api_console_v1_ConsolePlugin(ref), + "github.com/openshift/api/console/v1.ConsolePluginBackend": schema_openshift_api_console_v1_ConsolePluginBackend(ref), + "github.com/openshift/api/console/v1.ConsolePluginCSP": schema_openshift_api_console_v1_ConsolePluginCSP(ref), + "github.com/openshift/api/console/v1.ConsolePluginI18n": schema_openshift_api_console_v1_ConsolePluginI18n(ref), + "github.com/openshift/api/console/v1.ConsolePluginList": schema_openshift_api_console_v1_ConsolePluginList(ref), + "github.com/openshift/api/console/v1.ConsolePluginProxy": schema_openshift_api_console_v1_ConsolePluginProxy(ref), + "github.com/openshift/api/console/v1.ConsolePluginProxyEndpoint": schema_openshift_api_console_v1_ConsolePluginProxyEndpoint(ref), + "github.com/openshift/api/console/v1.ConsolePluginProxyServiceConfig": schema_openshift_api_console_v1_ConsolePluginProxyServiceConfig(ref), + "github.com/openshift/api/console/v1.ConsolePluginService": schema_openshift_api_console_v1_ConsolePluginService(ref), + "github.com/openshift/api/console/v1.ConsolePluginSpec": schema_openshift_api_console_v1_ConsolePluginSpec(ref), + "github.com/openshift/api/console/v1.ConsoleQuickStart": schema_openshift_api_console_v1_ConsoleQuickStart(ref), + "github.com/openshift/api/console/v1.ConsoleQuickStartList": schema_openshift_api_console_v1_ConsoleQuickStartList(ref), + "github.com/openshift/api/console/v1.ConsoleQuickStartSpec": schema_openshift_api_console_v1_ConsoleQuickStartSpec(ref), + "github.com/openshift/api/console/v1.ConsoleQuickStartTask": schema_openshift_api_console_v1_ConsoleQuickStartTask(ref), + "github.com/openshift/api/console/v1.ConsoleQuickStartTaskReview": schema_openshift_api_console_v1_ConsoleQuickStartTaskReview(ref), + "github.com/openshift/api/console/v1.ConsoleQuickStartTaskSummary": schema_openshift_api_console_v1_ConsoleQuickStartTaskSummary(ref), + "github.com/openshift/api/console/v1.ConsoleSample": schema_openshift_api_console_v1_ConsoleSample(ref), + "github.com/openshift/api/console/v1.ConsoleSampleContainerImportSource": schema_openshift_api_console_v1_ConsoleSampleContainerImportSource(ref), + "github.com/openshift/api/console/v1.ConsoleSampleContainerImportSourceService": schema_openshift_api_console_v1_ConsoleSampleContainerImportSourceService(ref), + "github.com/openshift/api/console/v1.ConsoleSampleGitImportSource": schema_openshift_api_console_v1_ConsoleSampleGitImportSource(ref), + "github.com/openshift/api/console/v1.ConsoleSampleGitImportSourceRepository": schema_openshift_api_console_v1_ConsoleSampleGitImportSourceRepository(ref), + "github.com/openshift/api/console/v1.ConsoleSampleGitImportSourceService": schema_openshift_api_console_v1_ConsoleSampleGitImportSourceService(ref), + "github.com/openshift/api/console/v1.ConsoleSampleList": schema_openshift_api_console_v1_ConsoleSampleList(ref), + "github.com/openshift/api/console/v1.ConsoleSampleSource": schema_openshift_api_console_v1_ConsoleSampleSource(ref), + "github.com/openshift/api/console/v1.ConsoleSampleSpec": schema_openshift_api_console_v1_ConsoleSampleSpec(ref), + "github.com/openshift/api/console/v1.ConsoleYAMLSample": schema_openshift_api_console_v1_ConsoleYAMLSample(ref), + "github.com/openshift/api/console/v1.ConsoleYAMLSampleList": schema_openshift_api_console_v1_ConsoleYAMLSampleList(ref), + "github.com/openshift/api/console/v1.ConsoleYAMLSampleSpec": schema_openshift_api_console_v1_ConsoleYAMLSampleSpec(ref), + "github.com/openshift/api/console/v1.Link": schema_openshift_api_console_v1_Link(ref), + "github.com/openshift/api/console/v1.NamespaceDashboardSpec": schema_openshift_api_console_v1_NamespaceDashboardSpec(ref), + "github.com/openshift/api/etcd/v1.PacemakerCluster": schema_openshift_api_etcd_v1_PacemakerCluster(ref), + "github.com/openshift/api/etcd/v1.PacemakerClusterFencingAgentStatus": schema_openshift_api_etcd_v1_PacemakerClusterFencingAgentStatus(ref), + "github.com/openshift/api/etcd/v1.PacemakerClusterList": schema_openshift_api_etcd_v1_PacemakerClusterList(ref), + "github.com/openshift/api/etcd/v1.PacemakerClusterNodeStatus": schema_openshift_api_etcd_v1_PacemakerClusterNodeStatus(ref), + "github.com/openshift/api/etcd/v1.PacemakerClusterResourceStatus": schema_openshift_api_etcd_v1_PacemakerClusterResourceStatus(ref), + "github.com/openshift/api/etcd/v1.PacemakerClusterStatus": schema_openshift_api_etcd_v1_PacemakerClusterStatus(ref), + "github.com/openshift/api/etcd/v1.PacemakerNodeAddress": schema_openshift_api_etcd_v1_PacemakerNodeAddress(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerCluster": schema_openshift_api_etcd_v1alpha1_PacemakerCluster(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterFencingAgentStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterFencingAgentStatus(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterList": schema_openshift_api_etcd_v1alpha1_PacemakerClusterList(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterNodeStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterNodeStatus(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterResourceStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterResourceStatus(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerClusterStatus": schema_openshift_api_etcd_v1alpha1_PacemakerClusterStatus(ref), + "github.com/openshift/api/etcd/v1alpha1.PacemakerNodeAddress": schema_openshift_api_etcd_v1alpha1_PacemakerNodeAddress(ref), + "github.com/openshift/api/example/v1.CELUnion": schema_openshift_api_example_v1_CELUnion(ref), + "github.com/openshift/api/example/v1.EvolvingUnion": schema_openshift_api_example_v1_EvolvingUnion(ref), + "github.com/openshift/api/example/v1.FormatMarkerExamples": schema_openshift_api_example_v1_FormatMarkerExamples(ref), + "github.com/openshift/api/example/v1.StableConfigType": schema_openshift_api_example_v1_StableConfigType(ref), + "github.com/openshift/api/example/v1.StableConfigTypeList": schema_openshift_api_example_v1_StableConfigTypeList(ref), + "github.com/openshift/api/example/v1.StableConfigTypeSpec": schema_openshift_api_example_v1_StableConfigTypeSpec(ref), + "github.com/openshift/api/example/v1.StableConfigTypeStatus": schema_openshift_api_example_v1_StableConfigTypeStatus(ref), + "github.com/openshift/api/example/v1.SubnetsWithExclusions": schema_openshift_api_example_v1_SubnetsWithExclusions(ref), + "github.com/openshift/api/example/v1alpha1.NotStableConfigType": schema_openshift_api_example_v1alpha1_NotStableConfigType(ref), + "github.com/openshift/api/example/v1alpha1.NotStableConfigTypeList": schema_openshift_api_example_v1alpha1_NotStableConfigTypeList(ref), + "github.com/openshift/api/example/v1alpha1.NotStableConfigTypeSpec": schema_openshift_api_example_v1alpha1_NotStableConfigTypeSpec(ref), + "github.com/openshift/api/example/v1alpha1.NotStableConfigTypeStatus": schema_openshift_api_example_v1alpha1_NotStableConfigTypeStatus(ref), + "github.com/openshift/api/helm/v1beta1.ConnectionConfig": schema_openshift_api_helm_v1beta1_ConnectionConfig(ref), + "github.com/openshift/api/helm/v1beta1.ConnectionConfigNamespaceScoped": schema_openshift_api_helm_v1beta1_ConnectionConfigNamespaceScoped(ref), + "github.com/openshift/api/helm/v1beta1.HelmChartRepository": schema_openshift_api_helm_v1beta1_HelmChartRepository(ref), + "github.com/openshift/api/helm/v1beta1.HelmChartRepositoryList": schema_openshift_api_helm_v1beta1_HelmChartRepositoryList(ref), + "github.com/openshift/api/helm/v1beta1.HelmChartRepositorySpec": schema_openshift_api_helm_v1beta1_HelmChartRepositorySpec(ref), + "github.com/openshift/api/helm/v1beta1.HelmChartRepositoryStatus": schema_openshift_api_helm_v1beta1_HelmChartRepositoryStatus(ref), + "github.com/openshift/api/helm/v1beta1.ProjectHelmChartRepository": schema_openshift_api_helm_v1beta1_ProjectHelmChartRepository(ref), + "github.com/openshift/api/helm/v1beta1.ProjectHelmChartRepositoryList": schema_openshift_api_helm_v1beta1_ProjectHelmChartRepositoryList(ref), + "github.com/openshift/api/helm/v1beta1.ProjectHelmChartRepositorySpec": schema_openshift_api_helm_v1beta1_ProjectHelmChartRepositorySpec(ref), + "github.com/openshift/api/image/v1.DockerImageReference": schema_openshift_api_image_v1_DockerImageReference(ref), + "github.com/openshift/api/image/v1.Image": schema_openshift_api_image_v1_Image(ref), + "github.com/openshift/api/image/v1.ImageBlobReferences": schema_openshift_api_image_v1_ImageBlobReferences(ref), + "github.com/openshift/api/image/v1.ImageImportSpec": schema_openshift_api_image_v1_ImageImportSpec(ref), + "github.com/openshift/api/image/v1.ImageImportStatus": schema_openshift_api_image_v1_ImageImportStatus(ref), + "github.com/openshift/api/image/v1.ImageLayer": schema_openshift_api_image_v1_ImageLayer(ref), + "github.com/openshift/api/image/v1.ImageLayerData": schema_openshift_api_image_v1_ImageLayerData(ref), + "github.com/openshift/api/image/v1.ImageList": schema_openshift_api_image_v1_ImageList(ref), + "github.com/openshift/api/image/v1.ImageLookupPolicy": schema_openshift_api_image_v1_ImageLookupPolicy(ref), + "github.com/openshift/api/image/v1.ImageManifest": schema_openshift_api_image_v1_ImageManifest(ref), + "github.com/openshift/api/image/v1.ImageSignature": schema_openshift_api_image_v1_ImageSignature(ref), + "github.com/openshift/api/image/v1.ImageStream": schema_openshift_api_image_v1_ImageStream(ref), + "github.com/openshift/api/image/v1.ImageStreamImage": schema_openshift_api_image_v1_ImageStreamImage(ref), + "github.com/openshift/api/image/v1.ImageStreamImport": schema_openshift_api_image_v1_ImageStreamImport(ref), + "github.com/openshift/api/image/v1.ImageStreamImportSpec": schema_openshift_api_image_v1_ImageStreamImportSpec(ref), + "github.com/openshift/api/image/v1.ImageStreamImportStatus": schema_openshift_api_image_v1_ImageStreamImportStatus(ref), + "github.com/openshift/api/image/v1.ImageStreamLayers": schema_openshift_api_image_v1_ImageStreamLayers(ref), + "github.com/openshift/api/image/v1.ImageStreamList": schema_openshift_api_image_v1_ImageStreamList(ref), + "github.com/openshift/api/image/v1.ImageStreamMapping": schema_openshift_api_image_v1_ImageStreamMapping(ref), + "github.com/openshift/api/image/v1.ImageStreamSpec": schema_openshift_api_image_v1_ImageStreamSpec(ref), + "github.com/openshift/api/image/v1.ImageStreamStatus": schema_openshift_api_image_v1_ImageStreamStatus(ref), + "github.com/openshift/api/image/v1.ImageStreamTag": schema_openshift_api_image_v1_ImageStreamTag(ref), + "github.com/openshift/api/image/v1.ImageStreamTagList": schema_openshift_api_image_v1_ImageStreamTagList(ref), + "github.com/openshift/api/image/v1.ImageTag": schema_openshift_api_image_v1_ImageTag(ref), + "github.com/openshift/api/image/v1.ImageTagList": schema_openshift_api_image_v1_ImageTagList(ref), + "github.com/openshift/api/image/v1.NamedTagEventList": schema_openshift_api_image_v1_NamedTagEventList(ref), + "github.com/openshift/api/image/v1.RepositoryImportSpec": schema_openshift_api_image_v1_RepositoryImportSpec(ref), + "github.com/openshift/api/image/v1.RepositoryImportStatus": schema_openshift_api_image_v1_RepositoryImportStatus(ref), + "github.com/openshift/api/image/v1.SecretList": schema_openshift_api_image_v1_SecretList(ref), + "github.com/openshift/api/image/v1.SignatureCondition": schema_openshift_api_image_v1_SignatureCondition(ref), + "github.com/openshift/api/image/v1.SignatureGenericEntity": schema_openshift_api_image_v1_SignatureGenericEntity(ref), + "github.com/openshift/api/image/v1.SignatureIssuer": schema_openshift_api_image_v1_SignatureIssuer(ref), + "github.com/openshift/api/image/v1.SignatureSubject": schema_openshift_api_image_v1_SignatureSubject(ref), + "github.com/openshift/api/image/v1.TagEvent": schema_openshift_api_image_v1_TagEvent(ref), + "github.com/openshift/api/image/v1.TagEventCondition": schema_openshift_api_image_v1_TagEventCondition(ref), + "github.com/openshift/api/image/v1.TagImportPolicy": schema_openshift_api_image_v1_TagImportPolicy(ref), + "github.com/openshift/api/image/v1.TagReference": schema_openshift_api_image_v1_TagReference(ref), + "github.com/openshift/api/image/v1.TagReferencePolicy": schema_openshift_api_image_v1_TagReferencePolicy(ref), + "github.com/openshift/api/insights/v1.Custom": schema_openshift_api_insights_v1_Custom(ref), + "github.com/openshift/api/insights/v1.DataGather": schema_openshift_api_insights_v1_DataGather(ref), + "github.com/openshift/api/insights/v1.DataGatherList": schema_openshift_api_insights_v1_DataGatherList(ref), + "github.com/openshift/api/insights/v1.DataGatherSpec": schema_openshift_api_insights_v1_DataGatherSpec(ref), + "github.com/openshift/api/insights/v1.DataGatherStatus": schema_openshift_api_insights_v1_DataGatherStatus(ref), + "github.com/openshift/api/insights/v1.GathererConfig": schema_openshift_api_insights_v1_GathererConfig(ref), + "github.com/openshift/api/insights/v1.GathererStatus": schema_openshift_api_insights_v1_GathererStatus(ref), + "github.com/openshift/api/insights/v1.Gatherers": schema_openshift_api_insights_v1_Gatherers(ref), + "github.com/openshift/api/insights/v1.HealthCheck": schema_openshift_api_insights_v1_HealthCheck(ref), + "github.com/openshift/api/insights/v1.InsightsReport": schema_openshift_api_insights_v1_InsightsReport(ref), + "github.com/openshift/api/insights/v1.ObjectReference": schema_openshift_api_insights_v1_ObjectReference(ref), + "github.com/openshift/api/insights/v1.PersistentVolumeClaimReference": schema_openshift_api_insights_v1_PersistentVolumeClaimReference(ref), + "github.com/openshift/api/insights/v1.PersistentVolumeConfig": schema_openshift_api_insights_v1_PersistentVolumeConfig(ref), + "github.com/openshift/api/insights/v1.Storage": schema_openshift_api_insights_v1_Storage(ref), + "github.com/openshift/api/insights/v1alpha1.DataGather": schema_openshift_api_insights_v1alpha1_DataGather(ref), + "github.com/openshift/api/insights/v1alpha1.DataGatherList": schema_openshift_api_insights_v1alpha1_DataGatherList(ref), + "github.com/openshift/api/insights/v1alpha1.DataGatherSpec": schema_openshift_api_insights_v1alpha1_DataGatherSpec(ref), + "github.com/openshift/api/insights/v1alpha1.DataGatherStatus": schema_openshift_api_insights_v1alpha1_DataGatherStatus(ref), + "github.com/openshift/api/insights/v1alpha1.GathererConfig": schema_openshift_api_insights_v1alpha1_GathererConfig(ref), + "github.com/openshift/api/insights/v1alpha1.GathererStatus": schema_openshift_api_insights_v1alpha1_GathererStatus(ref), + "github.com/openshift/api/insights/v1alpha1.HealthCheck": schema_openshift_api_insights_v1alpha1_HealthCheck(ref), + "github.com/openshift/api/insights/v1alpha1.InsightsReport": schema_openshift_api_insights_v1alpha1_InsightsReport(ref), + "github.com/openshift/api/insights/v1alpha1.ObjectReference": schema_openshift_api_insights_v1alpha1_ObjectReference(ref), + "github.com/openshift/api/insights/v1alpha1.PersistentVolumeClaimReference": schema_openshift_api_insights_v1alpha1_PersistentVolumeClaimReference(ref), + "github.com/openshift/api/insights/v1alpha1.PersistentVolumeConfig": schema_openshift_api_insights_v1alpha1_PersistentVolumeConfig(ref), + "github.com/openshift/api/insights/v1alpha1.Storage": schema_openshift_api_insights_v1alpha1_Storage(ref), + "github.com/openshift/api/insights/v1alpha2.Custom": schema_openshift_api_insights_v1alpha2_Custom(ref), + "github.com/openshift/api/insights/v1alpha2.DataGather": schema_openshift_api_insights_v1alpha2_DataGather(ref), + "github.com/openshift/api/insights/v1alpha2.DataGatherList": schema_openshift_api_insights_v1alpha2_DataGatherList(ref), + "github.com/openshift/api/insights/v1alpha2.DataGatherSpec": schema_openshift_api_insights_v1alpha2_DataGatherSpec(ref), + "github.com/openshift/api/insights/v1alpha2.DataGatherStatus": schema_openshift_api_insights_v1alpha2_DataGatherStatus(ref), + "github.com/openshift/api/insights/v1alpha2.GathererConfig": schema_openshift_api_insights_v1alpha2_GathererConfig(ref), + "github.com/openshift/api/insights/v1alpha2.GathererStatus": schema_openshift_api_insights_v1alpha2_GathererStatus(ref), + "github.com/openshift/api/insights/v1alpha2.Gatherers": schema_openshift_api_insights_v1alpha2_Gatherers(ref), + "github.com/openshift/api/insights/v1alpha2.HealthCheck": schema_openshift_api_insights_v1alpha2_HealthCheck(ref), + "github.com/openshift/api/insights/v1alpha2.InsightsReport": schema_openshift_api_insights_v1alpha2_InsightsReport(ref), + "github.com/openshift/api/insights/v1alpha2.ObjectReference": schema_openshift_api_insights_v1alpha2_ObjectReference(ref), + "github.com/openshift/api/insights/v1alpha2.PersistentVolumeClaimReference": schema_openshift_api_insights_v1alpha2_PersistentVolumeClaimReference(ref), + "github.com/openshift/api/insights/v1alpha2.PersistentVolumeConfig": schema_openshift_api_insights_v1alpha2_PersistentVolumeConfig(ref), + "github.com/openshift/api/insights/v1alpha2.Storage": schema_openshift_api_insights_v1alpha2_Storage(ref), + "github.com/openshift/api/kubecontrolplane/v1.AggregatorConfig": schema_openshift_api_kubecontrolplane_v1_AggregatorConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.KubeAPIServerConfig": schema_openshift_api_kubecontrolplane_v1_KubeAPIServerConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.KubeAPIServerImagePolicyConfig": schema_openshift_api_kubecontrolplane_v1_KubeAPIServerImagePolicyConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.KubeAPIServerProjectConfig": schema_openshift_api_kubecontrolplane_v1_KubeAPIServerProjectConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.KubeControllerManagerConfig": schema_openshift_api_kubecontrolplane_v1_KubeControllerManagerConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.KubeControllerManagerProjectConfig": schema_openshift_api_kubecontrolplane_v1_KubeControllerManagerProjectConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.KubeletConnectionInfo": schema_openshift_api_kubecontrolplane_v1_KubeletConnectionInfo(ref), + "github.com/openshift/api/kubecontrolplane/v1.MasterAuthConfig": schema_openshift_api_kubecontrolplane_v1_MasterAuthConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.RequestHeaderAuthenticationOptions": schema_openshift_api_kubecontrolplane_v1_RequestHeaderAuthenticationOptions(ref), + "github.com/openshift/api/kubecontrolplane/v1.ServiceServingCert": schema_openshift_api_kubecontrolplane_v1_ServiceServingCert(ref), + "github.com/openshift/api/kubecontrolplane/v1.UserAgentDenyRule": schema_openshift_api_kubecontrolplane_v1_UserAgentDenyRule(ref), + "github.com/openshift/api/kubecontrolplane/v1.UserAgentMatchRule": schema_openshift_api_kubecontrolplane_v1_UserAgentMatchRule(ref), + "github.com/openshift/api/kubecontrolplane/v1.UserAgentMatchingConfig": schema_openshift_api_kubecontrolplane_v1_UserAgentMatchingConfig(ref), + "github.com/openshift/api/kubecontrolplane/v1.WebhookTokenAuthenticator": schema_openshift_api_kubecontrolplane_v1_WebhookTokenAuthenticator(ref), + "github.com/openshift/api/legacyconfig/v1.ActiveDirectoryConfig": schema_openshift_api_legacyconfig_v1_ActiveDirectoryConfig(ref), + "github.com/openshift/api/legacyconfig/v1.AdmissionConfig": schema_openshift_api_legacyconfig_v1_AdmissionConfig(ref), + "github.com/openshift/api/legacyconfig/v1.AdmissionPluginConfig": schema_openshift_api_legacyconfig_v1_AdmissionPluginConfig(ref), + "github.com/openshift/api/legacyconfig/v1.AggregatorConfig": schema_openshift_api_legacyconfig_v1_AggregatorConfig(ref), + "github.com/openshift/api/legacyconfig/v1.AllowAllPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_AllowAllPasswordIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.AuditConfig": schema_openshift_api_legacyconfig_v1_AuditConfig(ref), + "github.com/openshift/api/legacyconfig/v1.AugmentedActiveDirectoryConfig": schema_openshift_api_legacyconfig_v1_AugmentedActiveDirectoryConfig(ref), + "github.com/openshift/api/legacyconfig/v1.BasicAuthPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_BasicAuthPasswordIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.BuildDefaultsConfig": schema_openshift_api_legacyconfig_v1_BuildDefaultsConfig(ref), + "github.com/openshift/api/legacyconfig/v1.BuildOverridesConfig": schema_openshift_api_legacyconfig_v1_BuildOverridesConfig(ref), + "github.com/openshift/api/legacyconfig/v1.CertInfo": schema_openshift_api_legacyconfig_v1_CertInfo(ref), + "github.com/openshift/api/legacyconfig/v1.ClientConnectionOverrides": schema_openshift_api_legacyconfig_v1_ClientConnectionOverrides(ref), + "github.com/openshift/api/legacyconfig/v1.ClusterNetworkEntry": schema_openshift_api_legacyconfig_v1_ClusterNetworkEntry(ref), + "github.com/openshift/api/legacyconfig/v1.ControllerConfig": schema_openshift_api_legacyconfig_v1_ControllerConfig(ref), + "github.com/openshift/api/legacyconfig/v1.ControllerElectionConfig": schema_openshift_api_legacyconfig_v1_ControllerElectionConfig(ref), + "github.com/openshift/api/legacyconfig/v1.DNSConfig": schema_openshift_api_legacyconfig_v1_DNSConfig(ref), + "github.com/openshift/api/legacyconfig/v1.DefaultAdmissionConfig": schema_openshift_api_legacyconfig_v1_DefaultAdmissionConfig(ref), + "github.com/openshift/api/legacyconfig/v1.DenyAllPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_DenyAllPasswordIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.DockerConfig": schema_openshift_api_legacyconfig_v1_DockerConfig(ref), + "github.com/openshift/api/legacyconfig/v1.EtcdConfig": schema_openshift_api_legacyconfig_v1_EtcdConfig(ref), + "github.com/openshift/api/legacyconfig/v1.EtcdConnectionInfo": schema_openshift_api_legacyconfig_v1_EtcdConnectionInfo(ref), + "github.com/openshift/api/legacyconfig/v1.EtcdStorageConfig": schema_openshift_api_legacyconfig_v1_EtcdStorageConfig(ref), + "github.com/openshift/api/legacyconfig/v1.GitHubIdentityProvider": schema_openshift_api_legacyconfig_v1_GitHubIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.GitLabIdentityProvider": schema_openshift_api_legacyconfig_v1_GitLabIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.GoogleIdentityProvider": schema_openshift_api_legacyconfig_v1_GoogleIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.GrantConfig": schema_openshift_api_legacyconfig_v1_GrantConfig(ref), + "github.com/openshift/api/legacyconfig/v1.GroupResource": schema_openshift_api_legacyconfig_v1_GroupResource(ref), + "github.com/openshift/api/legacyconfig/v1.HTPasswdPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_HTPasswdPasswordIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.HTTPServingInfo": schema_openshift_api_legacyconfig_v1_HTTPServingInfo(ref), + "github.com/openshift/api/legacyconfig/v1.IdentityProvider": schema_openshift_api_legacyconfig_v1_IdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.ImageConfig": schema_openshift_api_legacyconfig_v1_ImageConfig(ref), + "github.com/openshift/api/legacyconfig/v1.ImagePolicyConfig": schema_openshift_api_legacyconfig_v1_ImagePolicyConfig(ref), + "github.com/openshift/api/legacyconfig/v1.JenkinsPipelineConfig": schema_openshift_api_legacyconfig_v1_JenkinsPipelineConfig(ref), + "github.com/openshift/api/legacyconfig/v1.KeystonePasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_KeystonePasswordIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.KubeletConnectionInfo": schema_openshift_api_legacyconfig_v1_KubeletConnectionInfo(ref), + "github.com/openshift/api/legacyconfig/v1.KubernetesMasterConfig": schema_openshift_api_legacyconfig_v1_KubernetesMasterConfig(ref), + "github.com/openshift/api/legacyconfig/v1.LDAPAttributeMapping": schema_openshift_api_legacyconfig_v1_LDAPAttributeMapping(ref), + "github.com/openshift/api/legacyconfig/v1.LDAPPasswordIdentityProvider": schema_openshift_api_legacyconfig_v1_LDAPPasswordIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.LDAPQuery": schema_openshift_api_legacyconfig_v1_LDAPQuery(ref), + "github.com/openshift/api/legacyconfig/v1.LDAPSyncConfig": schema_openshift_api_legacyconfig_v1_LDAPSyncConfig(ref), + "github.com/openshift/api/legacyconfig/v1.LocalQuota": schema_openshift_api_legacyconfig_v1_LocalQuota(ref), + "github.com/openshift/api/legacyconfig/v1.MasterAuthConfig": schema_openshift_api_legacyconfig_v1_MasterAuthConfig(ref), + "github.com/openshift/api/legacyconfig/v1.MasterClients": schema_openshift_api_legacyconfig_v1_MasterClients(ref), + "github.com/openshift/api/legacyconfig/v1.MasterConfig": schema_openshift_api_legacyconfig_v1_MasterConfig(ref), + "github.com/openshift/api/legacyconfig/v1.MasterNetworkConfig": schema_openshift_api_legacyconfig_v1_MasterNetworkConfig(ref), + "github.com/openshift/api/legacyconfig/v1.MasterVolumeConfig": schema_openshift_api_legacyconfig_v1_MasterVolumeConfig(ref), + "github.com/openshift/api/legacyconfig/v1.NamedCertificate": schema_openshift_api_legacyconfig_v1_NamedCertificate(ref), + "github.com/openshift/api/legacyconfig/v1.NodeAuthConfig": schema_openshift_api_legacyconfig_v1_NodeAuthConfig(ref), + "github.com/openshift/api/legacyconfig/v1.NodeConfig": schema_openshift_api_legacyconfig_v1_NodeConfig(ref), + "github.com/openshift/api/legacyconfig/v1.NodeNetworkConfig": schema_openshift_api_legacyconfig_v1_NodeNetworkConfig(ref), + "github.com/openshift/api/legacyconfig/v1.NodeVolumeConfig": schema_openshift_api_legacyconfig_v1_NodeVolumeConfig(ref), + "github.com/openshift/api/legacyconfig/v1.OAuthConfig": schema_openshift_api_legacyconfig_v1_OAuthConfig(ref), + "github.com/openshift/api/legacyconfig/v1.OAuthTemplates": schema_openshift_api_legacyconfig_v1_OAuthTemplates(ref), + "github.com/openshift/api/legacyconfig/v1.OpenIDClaims": schema_openshift_api_legacyconfig_v1_OpenIDClaims(ref), + "github.com/openshift/api/legacyconfig/v1.OpenIDIdentityProvider": schema_openshift_api_legacyconfig_v1_OpenIDIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.OpenIDURLs": schema_openshift_api_legacyconfig_v1_OpenIDURLs(ref), + "github.com/openshift/api/legacyconfig/v1.PodManifestConfig": schema_openshift_api_legacyconfig_v1_PodManifestConfig(ref), + "github.com/openshift/api/legacyconfig/v1.PolicyConfig": schema_openshift_api_legacyconfig_v1_PolicyConfig(ref), + "github.com/openshift/api/legacyconfig/v1.ProjectConfig": schema_openshift_api_legacyconfig_v1_ProjectConfig(ref), + "github.com/openshift/api/legacyconfig/v1.RFC2307Config": schema_openshift_api_legacyconfig_v1_RFC2307Config(ref), + "github.com/openshift/api/legacyconfig/v1.RegistryLocation": schema_openshift_api_legacyconfig_v1_RegistryLocation(ref), + "github.com/openshift/api/legacyconfig/v1.RemoteConnectionInfo": schema_openshift_api_legacyconfig_v1_RemoteConnectionInfo(ref), + "github.com/openshift/api/legacyconfig/v1.RequestHeaderAuthenticationOptions": schema_openshift_api_legacyconfig_v1_RequestHeaderAuthenticationOptions(ref), + "github.com/openshift/api/legacyconfig/v1.RequestHeaderIdentityProvider": schema_openshift_api_legacyconfig_v1_RequestHeaderIdentityProvider(ref), + "github.com/openshift/api/legacyconfig/v1.RoutingConfig": schema_openshift_api_legacyconfig_v1_RoutingConfig(ref), + "github.com/openshift/api/legacyconfig/v1.SecurityAllocator": schema_openshift_api_legacyconfig_v1_SecurityAllocator(ref), + "github.com/openshift/api/legacyconfig/v1.ServiceAccountConfig": schema_openshift_api_legacyconfig_v1_ServiceAccountConfig(ref), + "github.com/openshift/api/legacyconfig/v1.ServiceServingCert": schema_openshift_api_legacyconfig_v1_ServiceServingCert(ref), + "github.com/openshift/api/legacyconfig/v1.ServingInfo": schema_openshift_api_legacyconfig_v1_ServingInfo(ref), + "github.com/openshift/api/legacyconfig/v1.SessionConfig": schema_openshift_api_legacyconfig_v1_SessionConfig(ref), + "github.com/openshift/api/legacyconfig/v1.SessionSecret": schema_openshift_api_legacyconfig_v1_SessionSecret(ref), + "github.com/openshift/api/legacyconfig/v1.SessionSecrets": schema_openshift_api_legacyconfig_v1_SessionSecrets(ref), + "github.com/openshift/api/legacyconfig/v1.SourceStrategyDefaultsConfig": schema_openshift_api_legacyconfig_v1_SourceStrategyDefaultsConfig(ref), + "github.com/openshift/api/legacyconfig/v1.StringSource": schema_openshift_api_legacyconfig_v1_StringSource(ref), + "github.com/openshift/api/legacyconfig/v1.StringSourceSpec": schema_openshift_api_legacyconfig_v1_StringSourceSpec(ref), + "github.com/openshift/api/legacyconfig/v1.TokenConfig": schema_openshift_api_legacyconfig_v1_TokenConfig(ref), + "github.com/openshift/api/legacyconfig/v1.UserAgentDenyRule": schema_openshift_api_legacyconfig_v1_UserAgentDenyRule(ref), + "github.com/openshift/api/legacyconfig/v1.UserAgentMatchRule": schema_openshift_api_legacyconfig_v1_UserAgentMatchRule(ref), + "github.com/openshift/api/legacyconfig/v1.UserAgentMatchingConfig": schema_openshift_api_legacyconfig_v1_UserAgentMatchingConfig(ref), + "github.com/openshift/api/legacyconfig/v1.WebhookTokenAuthenticator": schema_openshift_api_legacyconfig_v1_WebhookTokenAuthenticator(ref), + "github.com/openshift/api/machine/v1.AWSFailureDomain": schema_openshift_api_machine_v1_AWSFailureDomain(ref), + "github.com/openshift/api/machine/v1.AWSFailureDomainPlacement": schema_openshift_api_machine_v1_AWSFailureDomainPlacement(ref), + "github.com/openshift/api/machine/v1.AWSResourceFilter": schema_openshift_api_machine_v1_AWSResourceFilter(ref), + "github.com/openshift/api/machine/v1.AWSResourceReference": schema_openshift_api_machine_v1_AWSResourceReference(ref), + "github.com/openshift/api/machine/v1.AlibabaCloudMachineProviderConfig": schema_openshift_api_machine_v1_AlibabaCloudMachineProviderConfig(ref), + "github.com/openshift/api/machine/v1.AlibabaCloudMachineProviderConfigList": schema_openshift_api_machine_v1_AlibabaCloudMachineProviderConfigList(ref), + "github.com/openshift/api/machine/v1.AlibabaCloudMachineProviderStatus": schema_openshift_api_machine_v1_AlibabaCloudMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1.AlibabaResourceReference": schema_openshift_api_machine_v1_AlibabaResourceReference(ref), + "github.com/openshift/api/machine/v1.AzureFailureDomain": schema_openshift_api_machine_v1_AzureFailureDomain(ref), + "github.com/openshift/api/machine/v1.BandwidthProperties": schema_openshift_api_machine_v1_BandwidthProperties(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSet": schema_openshift_api_machine_v1_ControlPlaneMachineSet(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSetList": schema_openshift_api_machine_v1_ControlPlaneMachineSetList(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSetSpec": schema_openshift_api_machine_v1_ControlPlaneMachineSetSpec(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSetStatus": schema_openshift_api_machine_v1_ControlPlaneMachineSetStatus(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSetStrategy": schema_openshift_api_machine_v1_ControlPlaneMachineSetStrategy(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSetTemplate": schema_openshift_api_machine_v1_ControlPlaneMachineSetTemplate(ref), + "github.com/openshift/api/machine/v1.ControlPlaneMachineSetTemplateObjectMeta": schema_openshift_api_machine_v1_ControlPlaneMachineSetTemplateObjectMeta(ref), + "github.com/openshift/api/machine/v1.DataDiskProperties": schema_openshift_api_machine_v1_DataDiskProperties(ref), + "github.com/openshift/api/machine/v1.FailureDomains": schema_openshift_api_machine_v1_FailureDomains(ref), + "github.com/openshift/api/machine/v1.GCPFailureDomain": schema_openshift_api_machine_v1_GCPFailureDomain(ref), + "github.com/openshift/api/machine/v1.LoadBalancerReference": schema_openshift_api_machine_v1_LoadBalancerReference(ref), + "github.com/openshift/api/machine/v1.NutanixCategory": schema_openshift_api_machine_v1_NutanixCategory(ref), + "github.com/openshift/api/machine/v1.NutanixFailureDomainReference": schema_openshift_api_machine_v1_NutanixFailureDomainReference(ref), + "github.com/openshift/api/machine/v1.NutanixGPU": schema_openshift_api_machine_v1_NutanixGPU(ref), + "github.com/openshift/api/machine/v1.NutanixMachineProviderConfig": schema_openshift_api_machine_v1_NutanixMachineProviderConfig(ref), + "github.com/openshift/api/machine/v1.NutanixMachineProviderStatus": schema_openshift_api_machine_v1_NutanixMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1.NutanixResourceIdentifier": schema_openshift_api_machine_v1_NutanixResourceIdentifier(ref), + "github.com/openshift/api/machine/v1.NutanixStorageResourceIdentifier": schema_openshift_api_machine_v1_NutanixStorageResourceIdentifier(ref), + "github.com/openshift/api/machine/v1.NutanixVMDisk": schema_openshift_api_machine_v1_NutanixVMDisk(ref), + "github.com/openshift/api/machine/v1.NutanixVMDiskDeviceProperties": schema_openshift_api_machine_v1_NutanixVMDiskDeviceProperties(ref), + "github.com/openshift/api/machine/v1.NutanixVMStorageConfig": schema_openshift_api_machine_v1_NutanixVMStorageConfig(ref), + "github.com/openshift/api/machine/v1.OpenShiftMachineV1Beta1MachineTemplate": schema_openshift_api_machine_v1_OpenShiftMachineV1Beta1MachineTemplate(ref), + "github.com/openshift/api/machine/v1.OpenStackFailureDomain": schema_openshift_api_machine_v1_OpenStackFailureDomain(ref), + "github.com/openshift/api/machine/v1.PowerVSMachineProviderConfig": schema_openshift_api_machine_v1_PowerVSMachineProviderConfig(ref), + "github.com/openshift/api/machine/v1.PowerVSMachineProviderStatus": schema_openshift_api_machine_v1_PowerVSMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1.PowerVSResource": schema_openshift_api_machine_v1_PowerVSResource(ref), + "github.com/openshift/api/machine/v1.PowerVSSecretReference": schema_openshift_api_machine_v1_PowerVSSecretReference(ref), + "github.com/openshift/api/machine/v1.RootVolume": schema_openshift_api_machine_v1_RootVolume(ref), + "github.com/openshift/api/machine/v1.SystemDiskProperties": schema_openshift_api_machine_v1_SystemDiskProperties(ref), + "github.com/openshift/api/machine/v1.Tag": schema_openshift_api_machine_v1_Tag(ref), + "github.com/openshift/api/machine/v1.VSphereFailureDomain": schema_openshift_api_machine_v1_VSphereFailureDomain(ref), + "github.com/openshift/api/machine/v1alpha1.AdditionalBlockDevice": schema_openshift_api_machine_v1alpha1_AdditionalBlockDevice(ref), + "github.com/openshift/api/machine/v1alpha1.AddressPair": schema_openshift_api_machine_v1alpha1_AddressPair(ref), + "github.com/openshift/api/machine/v1alpha1.BlockDeviceStorage": schema_openshift_api_machine_v1alpha1_BlockDeviceStorage(ref), + "github.com/openshift/api/machine/v1alpha1.BlockDeviceVolume": schema_openshift_api_machine_v1alpha1_BlockDeviceVolume(ref), + "github.com/openshift/api/machine/v1alpha1.Filter": schema_openshift_api_machine_v1alpha1_Filter(ref), + "github.com/openshift/api/machine/v1alpha1.FixedIPs": schema_openshift_api_machine_v1alpha1_FixedIPs(ref), + "github.com/openshift/api/machine/v1alpha1.NetworkParam": schema_openshift_api_machine_v1alpha1_NetworkParam(ref), + "github.com/openshift/api/machine/v1alpha1.OpenstackProviderSpec": schema_openshift_api_machine_v1alpha1_OpenstackProviderSpec(ref), + "github.com/openshift/api/machine/v1alpha1.PortOpts": schema_openshift_api_machine_v1alpha1_PortOpts(ref), + "github.com/openshift/api/machine/v1alpha1.RootVolume": schema_openshift_api_machine_v1alpha1_RootVolume(ref), + "github.com/openshift/api/machine/v1alpha1.SecurityGroupFilter": schema_openshift_api_machine_v1alpha1_SecurityGroupFilter(ref), + "github.com/openshift/api/machine/v1alpha1.SecurityGroupParam": schema_openshift_api_machine_v1alpha1_SecurityGroupParam(ref), + "github.com/openshift/api/machine/v1alpha1.SubnetFilter": schema_openshift_api_machine_v1alpha1_SubnetFilter(ref), + "github.com/openshift/api/machine/v1alpha1.SubnetParam": schema_openshift_api_machine_v1alpha1_SubnetParam(ref), + "github.com/openshift/api/machine/v1beta1.AWSMachineProviderConfig": schema_openshift_api_machine_v1beta1_AWSMachineProviderConfig(ref), + "github.com/openshift/api/machine/v1beta1.AWSMachineProviderConfigList": schema_openshift_api_machine_v1beta1_AWSMachineProviderConfigList(ref), + "github.com/openshift/api/machine/v1beta1.AWSMachineProviderStatus": schema_openshift_api_machine_v1beta1_AWSMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1beta1.AWSResourceReference": schema_openshift_api_machine_v1beta1_AWSResourceReference(ref), + "github.com/openshift/api/machine/v1beta1.AddressesFromPool": schema_openshift_api_machine_v1beta1_AddressesFromPool(ref), + "github.com/openshift/api/machine/v1beta1.AzureBootDiagnostics": schema_openshift_api_machine_v1beta1_AzureBootDiagnostics(ref), + "github.com/openshift/api/machine/v1beta1.AzureCustomerManagedBootDiagnostics": schema_openshift_api_machine_v1beta1_AzureCustomerManagedBootDiagnostics(ref), + "github.com/openshift/api/machine/v1beta1.AzureDiagnostics": schema_openshift_api_machine_v1beta1_AzureDiagnostics(ref), + "github.com/openshift/api/machine/v1beta1.AzureMachineProviderSpec": schema_openshift_api_machine_v1beta1_AzureMachineProviderSpec(ref), + "github.com/openshift/api/machine/v1beta1.AzureMachineProviderStatus": schema_openshift_api_machine_v1beta1_AzureMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1beta1.BlockDeviceMappingSpec": schema_openshift_api_machine_v1beta1_BlockDeviceMappingSpec(ref), + "github.com/openshift/api/machine/v1beta1.CPUOptions": schema_openshift_api_machine_v1beta1_CPUOptions(ref), + "github.com/openshift/api/machine/v1beta1.Condition": schema_openshift_api_machine_v1beta1_Condition(ref), + "github.com/openshift/api/machine/v1beta1.ConfidentialVM": schema_openshift_api_machine_v1beta1_ConfidentialVM(ref), + "github.com/openshift/api/machine/v1beta1.DataDisk": schema_openshift_api_machine_v1beta1_DataDisk(ref), + "github.com/openshift/api/machine/v1beta1.DataDiskManagedDiskParameters": schema_openshift_api_machine_v1beta1_DataDiskManagedDiskParameters(ref), + "github.com/openshift/api/machine/v1beta1.DedicatedHost": schema_openshift_api_machine_v1beta1_DedicatedHost(ref), + "github.com/openshift/api/machine/v1beta1.DedicatedHostStatus": schema_openshift_api_machine_v1beta1_DedicatedHostStatus(ref), + "github.com/openshift/api/machine/v1beta1.DiskEncryptionSetParameters": schema_openshift_api_machine_v1beta1_DiskEncryptionSetParameters(ref), + "github.com/openshift/api/machine/v1beta1.DiskSettings": schema_openshift_api_machine_v1beta1_DiskSettings(ref), + "github.com/openshift/api/machine/v1beta1.DynamicHostAllocationSpec": schema_openshift_api_machine_v1beta1_DynamicHostAllocationSpec(ref), + "github.com/openshift/api/machine/v1beta1.EBSBlockDeviceSpec": schema_openshift_api_machine_v1beta1_EBSBlockDeviceSpec(ref), + "github.com/openshift/api/machine/v1beta1.Filter": schema_openshift_api_machine_v1beta1_Filter(ref), + "github.com/openshift/api/machine/v1beta1.GCPDisk": schema_openshift_api_machine_v1beta1_GCPDisk(ref), + "github.com/openshift/api/machine/v1beta1.GCPEncryptionKeyReference": schema_openshift_api_machine_v1beta1_GCPEncryptionKeyReference(ref), + "github.com/openshift/api/machine/v1beta1.GCPGPUConfig": schema_openshift_api_machine_v1beta1_GCPGPUConfig(ref), + "github.com/openshift/api/machine/v1beta1.GCPKMSKeyReference": schema_openshift_api_machine_v1beta1_GCPKMSKeyReference(ref), + "github.com/openshift/api/machine/v1beta1.GCPMachineProviderSpec": schema_openshift_api_machine_v1beta1_GCPMachineProviderSpec(ref), + "github.com/openshift/api/machine/v1beta1.GCPMachineProviderStatus": schema_openshift_api_machine_v1beta1_GCPMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1beta1.GCPMetadata": schema_openshift_api_machine_v1beta1_GCPMetadata(ref), + "github.com/openshift/api/machine/v1beta1.GCPNetworkInterface": schema_openshift_api_machine_v1beta1_GCPNetworkInterface(ref), + "github.com/openshift/api/machine/v1beta1.GCPServiceAccount": schema_openshift_api_machine_v1beta1_GCPServiceAccount(ref), + "github.com/openshift/api/machine/v1beta1.GCPShieldedInstanceConfig": schema_openshift_api_machine_v1beta1_GCPShieldedInstanceConfig(ref), + "github.com/openshift/api/machine/v1beta1.HostPlacement": schema_openshift_api_machine_v1beta1_HostPlacement(ref), + "github.com/openshift/api/machine/v1beta1.Image": schema_openshift_api_machine_v1beta1_Image(ref), + "github.com/openshift/api/machine/v1beta1.LastOperation": schema_openshift_api_machine_v1beta1_LastOperation(ref), + "github.com/openshift/api/machine/v1beta1.LifecycleHook": schema_openshift_api_machine_v1beta1_LifecycleHook(ref), + "github.com/openshift/api/machine/v1beta1.LifecycleHooks": schema_openshift_api_machine_v1beta1_LifecycleHooks(ref), + "github.com/openshift/api/machine/v1beta1.LoadBalancerReference": schema_openshift_api_machine_v1beta1_LoadBalancerReference(ref), + "github.com/openshift/api/machine/v1beta1.Machine": schema_openshift_api_machine_v1beta1_Machine(ref), + "github.com/openshift/api/machine/v1beta1.MachineHealthCheck": schema_openshift_api_machine_v1beta1_MachineHealthCheck(ref), + "github.com/openshift/api/machine/v1beta1.MachineHealthCheckList": schema_openshift_api_machine_v1beta1_MachineHealthCheckList(ref), + "github.com/openshift/api/machine/v1beta1.MachineHealthCheckSpec": schema_openshift_api_machine_v1beta1_MachineHealthCheckSpec(ref), + "github.com/openshift/api/machine/v1beta1.MachineHealthCheckStatus": schema_openshift_api_machine_v1beta1_MachineHealthCheckStatus(ref), + "github.com/openshift/api/machine/v1beta1.MachineList": schema_openshift_api_machine_v1beta1_MachineList(ref), + "github.com/openshift/api/machine/v1beta1.MachineSet": schema_openshift_api_machine_v1beta1_MachineSet(ref), + "github.com/openshift/api/machine/v1beta1.MachineSetList": schema_openshift_api_machine_v1beta1_MachineSetList(ref), + "github.com/openshift/api/machine/v1beta1.MachineSetSpec": schema_openshift_api_machine_v1beta1_MachineSetSpec(ref), + "github.com/openshift/api/machine/v1beta1.MachineSetStatus": schema_openshift_api_machine_v1beta1_MachineSetStatus(ref), + "github.com/openshift/api/machine/v1beta1.MachineSpec": schema_openshift_api_machine_v1beta1_MachineSpec(ref), + "github.com/openshift/api/machine/v1beta1.MachineStatus": schema_openshift_api_machine_v1beta1_MachineStatus(ref), + "github.com/openshift/api/machine/v1beta1.MachineTemplateSpec": schema_openshift_api_machine_v1beta1_MachineTemplateSpec(ref), + "github.com/openshift/api/machine/v1beta1.MetadataServiceOptions": schema_openshift_api_machine_v1beta1_MetadataServiceOptions(ref), + "github.com/openshift/api/machine/v1beta1.NetworkDeviceSpec": schema_openshift_api_machine_v1beta1_NetworkDeviceSpec(ref), + "github.com/openshift/api/machine/v1beta1.NetworkSpec": schema_openshift_api_machine_v1beta1_NetworkSpec(ref), + "github.com/openshift/api/machine/v1beta1.OSDisk": schema_openshift_api_machine_v1beta1_OSDisk(ref), + "github.com/openshift/api/machine/v1beta1.OSDiskManagedDiskParameters": schema_openshift_api_machine_v1beta1_OSDiskManagedDiskParameters(ref), + "github.com/openshift/api/machine/v1beta1.ObjectMeta": schema_openshift_api_machine_v1beta1_ObjectMeta(ref), + "github.com/openshift/api/machine/v1beta1.Placement": schema_openshift_api_machine_v1beta1_Placement(ref), + "github.com/openshift/api/machine/v1beta1.ProviderSpec": schema_openshift_api_machine_v1beta1_ProviderSpec(ref), + "github.com/openshift/api/machine/v1beta1.ResourceManagerTag": schema_openshift_api_machine_v1beta1_ResourceManagerTag(ref), + "github.com/openshift/api/machine/v1beta1.SecurityProfile": schema_openshift_api_machine_v1beta1_SecurityProfile(ref), + "github.com/openshift/api/machine/v1beta1.SecuritySettings": schema_openshift_api_machine_v1beta1_SecuritySettings(ref), + "github.com/openshift/api/machine/v1beta1.SpotMarketOptions": schema_openshift_api_machine_v1beta1_SpotMarketOptions(ref), + "github.com/openshift/api/machine/v1beta1.SpotVMOptions": schema_openshift_api_machine_v1beta1_SpotVMOptions(ref), + "github.com/openshift/api/machine/v1beta1.TagSpecification": schema_openshift_api_machine_v1beta1_TagSpecification(ref), + "github.com/openshift/api/machine/v1beta1.TrustedLaunch": schema_openshift_api_machine_v1beta1_TrustedLaunch(ref), + "github.com/openshift/api/machine/v1beta1.UEFISettings": schema_openshift_api_machine_v1beta1_UEFISettings(ref), + "github.com/openshift/api/machine/v1beta1.UnhealthyCondition": schema_openshift_api_machine_v1beta1_UnhealthyCondition(ref), + "github.com/openshift/api/machine/v1beta1.VMDiskSecurityProfile": schema_openshift_api_machine_v1beta1_VMDiskSecurityProfile(ref), + "github.com/openshift/api/machine/v1beta1.VSphereDisk": schema_openshift_api_machine_v1beta1_VSphereDisk(ref), + "github.com/openshift/api/machine/v1beta1.VSphereMachineProviderSpec": schema_openshift_api_machine_v1beta1_VSphereMachineProviderSpec(ref), + "github.com/openshift/api/machine/v1beta1.VSphereMachineProviderStatus": schema_openshift_api_machine_v1beta1_VSphereMachineProviderStatus(ref), + "github.com/openshift/api/machine/v1beta1.Workspace": schema_openshift_api_machine_v1beta1_Workspace(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImage": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImage(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageBundleStatus": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageBundleStatus(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageList": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageList(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageRef": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageRef(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageSpec": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageSpec(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.InternalReleaseImageStatus": schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageStatus(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStream": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStream(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamList": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamList(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamSet": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamSet(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamSpec": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamSpec(ref), + "github.com/openshift/api/machineconfiguration/v1alpha1.OSImageStreamStatus": schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamStatus(ref), + "github.com/openshift/api/monitoring/v1.AlertRelabelConfig": schema_openshift_api_monitoring_v1_AlertRelabelConfig(ref), + "github.com/openshift/api/monitoring/v1.AlertRelabelConfigList": schema_openshift_api_monitoring_v1_AlertRelabelConfigList(ref), + "github.com/openshift/api/monitoring/v1.AlertRelabelConfigSpec": schema_openshift_api_monitoring_v1_AlertRelabelConfigSpec(ref), + "github.com/openshift/api/monitoring/v1.AlertRelabelConfigStatus": schema_openshift_api_monitoring_v1_AlertRelabelConfigStatus(ref), + "github.com/openshift/api/monitoring/v1.AlertingRule": schema_openshift_api_monitoring_v1_AlertingRule(ref), + "github.com/openshift/api/monitoring/v1.AlertingRuleList": schema_openshift_api_monitoring_v1_AlertingRuleList(ref), + "github.com/openshift/api/monitoring/v1.AlertingRuleSpec": schema_openshift_api_monitoring_v1_AlertingRuleSpec(ref), + "github.com/openshift/api/monitoring/v1.AlertingRuleStatus": schema_openshift_api_monitoring_v1_AlertingRuleStatus(ref), + "github.com/openshift/api/monitoring/v1.PrometheusRuleRef": schema_openshift_api_monitoring_v1_PrometheusRuleRef(ref), + "github.com/openshift/api/monitoring/v1.RelabelConfig": schema_openshift_api_monitoring_v1_RelabelConfig(ref), + "github.com/openshift/api/monitoring/v1.Rule": schema_openshift_api_monitoring_v1_Rule(ref), + "github.com/openshift/api/monitoring/v1.RuleGroup": schema_openshift_api_monitoring_v1_RuleGroup(ref), + "github.com/openshift/api/network/v1.ClusterNetwork": schema_openshift_api_network_v1_ClusterNetwork(ref), + "github.com/openshift/api/network/v1.ClusterNetworkEntry": schema_openshift_api_network_v1_ClusterNetworkEntry(ref), + "github.com/openshift/api/network/v1.ClusterNetworkList": schema_openshift_api_network_v1_ClusterNetworkList(ref), + "github.com/openshift/api/network/v1.EgressNetworkPolicy": schema_openshift_api_network_v1_EgressNetworkPolicy(ref), + "github.com/openshift/api/network/v1.EgressNetworkPolicyList": schema_openshift_api_network_v1_EgressNetworkPolicyList(ref), + "github.com/openshift/api/network/v1.EgressNetworkPolicyPeer": schema_openshift_api_network_v1_EgressNetworkPolicyPeer(ref), + "github.com/openshift/api/network/v1.EgressNetworkPolicyRule": schema_openshift_api_network_v1_EgressNetworkPolicyRule(ref), + "github.com/openshift/api/network/v1.EgressNetworkPolicySpec": schema_openshift_api_network_v1_EgressNetworkPolicySpec(ref), + "github.com/openshift/api/network/v1.HostSubnet": schema_openshift_api_network_v1_HostSubnet(ref), + "github.com/openshift/api/network/v1.HostSubnetList": schema_openshift_api_network_v1_HostSubnetList(ref), + "github.com/openshift/api/network/v1.NetNamespace": schema_openshift_api_network_v1_NetNamespace(ref), + "github.com/openshift/api/network/v1.NetNamespaceList": schema_openshift_api_network_v1_NetNamespaceList(ref), + "github.com/openshift/api/network/v1alpha1.DNSNameResolver": schema_openshift_api_network_v1alpha1_DNSNameResolver(ref), + "github.com/openshift/api/network/v1alpha1.DNSNameResolverList": schema_openshift_api_network_v1alpha1_DNSNameResolverList(ref), + "github.com/openshift/api/network/v1alpha1.DNSNameResolverResolvedAddress": schema_openshift_api_network_v1alpha1_DNSNameResolverResolvedAddress(ref), + "github.com/openshift/api/network/v1alpha1.DNSNameResolverResolvedName": schema_openshift_api_network_v1alpha1_DNSNameResolverResolvedName(ref), + "github.com/openshift/api/network/v1alpha1.DNSNameResolverSpec": schema_openshift_api_network_v1alpha1_DNSNameResolverSpec(ref), + "github.com/openshift/api/network/v1alpha1.DNSNameResolverStatus": schema_openshift_api_network_v1alpha1_DNSNameResolverStatus(ref), + "github.com/openshift/api/networkoperator/v1.EgressRouter": schema_openshift_api_networkoperator_v1_EgressRouter(ref), + "github.com/openshift/api/networkoperator/v1.EgressRouterSpec": schema_openshift_api_networkoperator_v1_EgressRouterSpec(ref), + "github.com/openshift/api/oauth/v1.ClusterRoleScopeRestriction": schema_openshift_api_oauth_v1_ClusterRoleScopeRestriction(ref), + "github.com/openshift/api/oauth/v1.OAuthAccessToken": schema_openshift_api_oauth_v1_OAuthAccessToken(ref), + "github.com/openshift/api/oauth/v1.OAuthAccessTokenList": schema_openshift_api_oauth_v1_OAuthAccessTokenList(ref), + "github.com/openshift/api/oauth/v1.OAuthAuthorizeToken": schema_openshift_api_oauth_v1_OAuthAuthorizeToken(ref), + "github.com/openshift/api/oauth/v1.OAuthAuthorizeTokenList": schema_openshift_api_oauth_v1_OAuthAuthorizeTokenList(ref), + "github.com/openshift/api/oauth/v1.OAuthClient": schema_openshift_api_oauth_v1_OAuthClient(ref), + "github.com/openshift/api/oauth/v1.OAuthClientAuthorization": schema_openshift_api_oauth_v1_OAuthClientAuthorization(ref), + "github.com/openshift/api/oauth/v1.OAuthClientAuthorizationList": schema_openshift_api_oauth_v1_OAuthClientAuthorizationList(ref), + "github.com/openshift/api/oauth/v1.OAuthClientList": schema_openshift_api_oauth_v1_OAuthClientList(ref), + "github.com/openshift/api/oauth/v1.OAuthRedirectReference": schema_openshift_api_oauth_v1_OAuthRedirectReference(ref), + "github.com/openshift/api/oauth/v1.RedirectReference": schema_openshift_api_oauth_v1_RedirectReference(ref), + "github.com/openshift/api/oauth/v1.ScopeRestriction": schema_openshift_api_oauth_v1_ScopeRestriction(ref), + "github.com/openshift/api/oauth/v1.UserOAuthAccessToken": schema_openshift_api_oauth_v1_UserOAuthAccessToken(ref), + "github.com/openshift/api/oauth/v1.UserOAuthAccessTokenList": schema_openshift_api_oauth_v1_UserOAuthAccessTokenList(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.APIServers": schema_openshift_api_openshiftcontrolplane_v1_APIServers(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.BuildControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_BuildControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.BuildDefaultsConfig": schema_openshift_api_openshiftcontrolplane_v1_BuildDefaultsConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.BuildOverridesConfig": schema_openshift_api_openshiftcontrolplane_v1_BuildOverridesConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ClusterNetworkEntry": schema_openshift_api_openshiftcontrolplane_v1_ClusterNetworkEntry(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.DeployerControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_DeployerControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.DockerPullSecretControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_DockerPullSecretControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.FrontProxyConfig": schema_openshift_api_openshiftcontrolplane_v1_FrontProxyConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ImageConfig": schema_openshift_api_openshiftcontrolplane_v1_ImageConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ImageImportControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_ImageImportControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ImagePolicyConfig": schema_openshift_api_openshiftcontrolplane_v1_ImagePolicyConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.IngressControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_IngressControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.JenkinsPipelineConfig": schema_openshift_api_openshiftcontrolplane_v1_JenkinsPipelineConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.NetworkControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_NetworkControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.OpenShiftAPIServerConfig": schema_openshift_api_openshiftcontrolplane_v1_OpenShiftAPIServerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.OpenShiftControllerManagerConfig": schema_openshift_api_openshiftcontrolplane_v1_OpenShiftControllerManagerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.PerGroupOptions": schema_openshift_api_openshiftcontrolplane_v1_PerGroupOptions(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ProjectConfig": schema_openshift_api_openshiftcontrolplane_v1_ProjectConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.RegistryLocation": schema_openshift_api_openshiftcontrolplane_v1_RegistryLocation(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ResourceQuotaControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_ResourceQuotaControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.RoutingConfig": schema_openshift_api_openshiftcontrolplane_v1_RoutingConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.SecurityAllocator": schema_openshift_api_openshiftcontrolplane_v1_SecurityAllocator(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ServiceAccountControllerConfig": schema_openshift_api_openshiftcontrolplane_v1_ServiceAccountControllerConfig(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.ServiceServingCert": schema_openshift_api_openshiftcontrolplane_v1_ServiceServingCert(ref), + "github.com/openshift/api/openshiftcontrolplane/v1.SourceStrategyDefaultsConfig": schema_openshift_api_openshiftcontrolplane_v1_SourceStrategyDefaultsConfig(ref), + "github.com/openshift/api/operator/v1.AWSCSIDriverConfigSpec": schema_openshift_api_operator_v1_AWSCSIDriverConfigSpec(ref), + "github.com/openshift/api/operator/v1.AWSClassicLoadBalancerParameters": schema_openshift_api_operator_v1_AWSClassicLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.AWSEFSVolumeMetrics": schema_openshift_api_operator_v1_AWSEFSVolumeMetrics(ref), + "github.com/openshift/api/operator/v1.AWSEFSVolumeMetricsRecursiveWalkConfig": schema_openshift_api_operator_v1_AWSEFSVolumeMetricsRecursiveWalkConfig(ref), + "github.com/openshift/api/operator/v1.AWSLoadBalancerParameters": schema_openshift_api_operator_v1_AWSLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.AWSNetworkLoadBalancerParameters": schema_openshift_api_operator_v1_AWSNetworkLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.AWSSubnets": schema_openshift_api_operator_v1_AWSSubnets(ref), + "github.com/openshift/api/operator/v1.AccessLogging": schema_openshift_api_operator_v1_AccessLogging(ref), + "github.com/openshift/api/operator/v1.AddPage": schema_openshift_api_operator_v1_AddPage(ref), + "github.com/openshift/api/operator/v1.AdditionalNetworkDefinition": schema_openshift_api_operator_v1_AdditionalNetworkDefinition(ref), + "github.com/openshift/api/operator/v1.AdditionalRoutingCapabilities": schema_openshift_api_operator_v1_AdditionalRoutingCapabilities(ref), + "github.com/openshift/api/operator/v1.Authentication": schema_openshift_api_operator_v1_Authentication(ref), + "github.com/openshift/api/operator/v1.AuthenticationList": schema_openshift_api_operator_v1_AuthenticationList(ref), + "github.com/openshift/api/operator/v1.AuthenticationSpec": schema_openshift_api_operator_v1_AuthenticationSpec(ref), + "github.com/openshift/api/operator/v1.AuthenticationStatus": schema_openshift_api_operator_v1_AuthenticationStatus(ref), + "github.com/openshift/api/operator/v1.AzureCSIDriverConfigSpec": schema_openshift_api_operator_v1_AzureCSIDriverConfigSpec(ref), + "github.com/openshift/api/operator/v1.AzureDiskEncryptionSet": schema_openshift_api_operator_v1_AzureDiskEncryptionSet(ref), + "github.com/openshift/api/operator/v1.BGPManagedConfig": schema_openshift_api_operator_v1_BGPManagedConfig(ref), + "github.com/openshift/api/operator/v1.BootImageSkewEnforcementConfig": schema_openshift_api_operator_v1_BootImageSkewEnforcementConfig(ref), + "github.com/openshift/api/operator/v1.BootImageSkewEnforcementStatus": schema_openshift_api_operator_v1_BootImageSkewEnforcementStatus(ref), + "github.com/openshift/api/operator/v1.CSIDriverConfigSpec": schema_openshift_api_operator_v1_CSIDriverConfigSpec(ref), + "github.com/openshift/api/operator/v1.CSISnapshotController": schema_openshift_api_operator_v1_CSISnapshotController(ref), + "github.com/openshift/api/operator/v1.CSISnapshotControllerList": schema_openshift_api_operator_v1_CSISnapshotControllerList(ref), + "github.com/openshift/api/operator/v1.CSISnapshotControllerSpec": schema_openshift_api_operator_v1_CSISnapshotControllerSpec(ref), + "github.com/openshift/api/operator/v1.CSISnapshotControllerStatus": schema_openshift_api_operator_v1_CSISnapshotControllerStatus(ref), + "github.com/openshift/api/operator/v1.Capability": schema_openshift_api_operator_v1_Capability(ref), + "github.com/openshift/api/operator/v1.CapabilityVisibility": schema_openshift_api_operator_v1_CapabilityVisibility(ref), + "github.com/openshift/api/operator/v1.ClientTLS": schema_openshift_api_operator_v1_ClientTLS(ref), + "github.com/openshift/api/operator/v1.CloudCredential": schema_openshift_api_operator_v1_CloudCredential(ref), + "github.com/openshift/api/operator/v1.CloudCredentialList": schema_openshift_api_operator_v1_CloudCredentialList(ref), + "github.com/openshift/api/operator/v1.CloudCredentialSpec": schema_openshift_api_operator_v1_CloudCredentialSpec(ref), + "github.com/openshift/api/operator/v1.CloudCredentialStatus": schema_openshift_api_operator_v1_CloudCredentialStatus(ref), + "github.com/openshift/api/operator/v1.ClusterBootImageAutomatic": schema_openshift_api_operator_v1_ClusterBootImageAutomatic(ref), + "github.com/openshift/api/operator/v1.ClusterBootImageManual": schema_openshift_api_operator_v1_ClusterBootImageManual(ref), + "github.com/openshift/api/operator/v1.ClusterCSIDriver": schema_openshift_api_operator_v1_ClusterCSIDriver(ref), + "github.com/openshift/api/operator/v1.ClusterCSIDriverList": schema_openshift_api_operator_v1_ClusterCSIDriverList(ref), + "github.com/openshift/api/operator/v1.ClusterCSIDriverSpec": schema_openshift_api_operator_v1_ClusterCSIDriverSpec(ref), + "github.com/openshift/api/operator/v1.ClusterCSIDriverStatus": schema_openshift_api_operator_v1_ClusterCSIDriverStatus(ref), + "github.com/openshift/api/operator/v1.ClusterNetworkEntry": schema_openshift_api_operator_v1_ClusterNetworkEntry(ref), + "github.com/openshift/api/operator/v1.Config": schema_openshift_api_operator_v1_Config(ref), + "github.com/openshift/api/operator/v1.ConfigList": schema_openshift_api_operator_v1_ConfigList(ref), + "github.com/openshift/api/operator/v1.ConfigMapFileReference": schema_openshift_api_operator_v1_ConfigMapFileReference(ref), + "github.com/openshift/api/operator/v1.ConfigSpec": schema_openshift_api_operator_v1_ConfigSpec(ref), + "github.com/openshift/api/operator/v1.ConfigStatus": schema_openshift_api_operator_v1_ConfigStatus(ref), + "github.com/openshift/api/operator/v1.Console": schema_openshift_api_operator_v1_Console(ref), + "github.com/openshift/api/operator/v1.ConsoleConfigRoute": schema_openshift_api_operator_v1_ConsoleConfigRoute(ref), + "github.com/openshift/api/operator/v1.ConsoleCustomization": schema_openshift_api_operator_v1_ConsoleCustomization(ref), + "github.com/openshift/api/operator/v1.ConsoleList": schema_openshift_api_operator_v1_ConsoleList(ref), + "github.com/openshift/api/operator/v1.ConsoleProviders": schema_openshift_api_operator_v1_ConsoleProviders(ref), + "github.com/openshift/api/operator/v1.ConsoleSpec": schema_openshift_api_operator_v1_ConsoleSpec(ref), + "github.com/openshift/api/operator/v1.ConsoleStatus": schema_openshift_api_operator_v1_ConsoleStatus(ref), + "github.com/openshift/api/operator/v1.ContainerLoggingDestinationParameters": schema_openshift_api_operator_v1_ContainerLoggingDestinationParameters(ref), + "github.com/openshift/api/operator/v1.DNS": schema_openshift_api_operator_v1_DNS(ref), + "github.com/openshift/api/operator/v1.DNSCache": schema_openshift_api_operator_v1_DNSCache(ref), + "github.com/openshift/api/operator/v1.DNSList": schema_openshift_api_operator_v1_DNSList(ref), + "github.com/openshift/api/operator/v1.DNSNodePlacement": schema_openshift_api_operator_v1_DNSNodePlacement(ref), + "github.com/openshift/api/operator/v1.DNSOverTLSConfig": schema_openshift_api_operator_v1_DNSOverTLSConfig(ref), + "github.com/openshift/api/operator/v1.DNSSpec": schema_openshift_api_operator_v1_DNSSpec(ref), + "github.com/openshift/api/operator/v1.DNSStatus": schema_openshift_api_operator_v1_DNSStatus(ref), + "github.com/openshift/api/operator/v1.DNSTransportConfig": schema_openshift_api_operator_v1_DNSTransportConfig(ref), + "github.com/openshift/api/operator/v1.DefaultNetworkDefinition": schema_openshift_api_operator_v1_DefaultNetworkDefinition(ref), + "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogCategory": schema_openshift_api_operator_v1_DeveloperConsoleCatalogCategory(ref), + "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogCategoryMeta": schema_openshift_api_operator_v1_DeveloperConsoleCatalogCategoryMeta(ref), + "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogCustomization": schema_openshift_api_operator_v1_DeveloperConsoleCatalogCustomization(ref), + "github.com/openshift/api/operator/v1.DeveloperConsoleCatalogTypes": schema_openshift_api_operator_v1_DeveloperConsoleCatalogTypes(ref), + "github.com/openshift/api/operator/v1.EgressIPConfig": schema_openshift_api_operator_v1_EgressIPConfig(ref), + "github.com/openshift/api/operator/v1.EndpointPublishingStrategy": schema_openshift_api_operator_v1_EndpointPublishingStrategy(ref), + "github.com/openshift/api/operator/v1.Etcd": schema_openshift_api_operator_v1_Etcd(ref), + "github.com/openshift/api/operator/v1.EtcdList": schema_openshift_api_operator_v1_EtcdList(ref), + "github.com/openshift/api/operator/v1.EtcdSpec": schema_openshift_api_operator_v1_EtcdSpec(ref), + "github.com/openshift/api/operator/v1.EtcdStatus": schema_openshift_api_operator_v1_EtcdStatus(ref), + "github.com/openshift/api/operator/v1.ExportNetworkFlows": schema_openshift_api_operator_v1_ExportNetworkFlows(ref), + "github.com/openshift/api/operator/v1.FeaturesMigration": schema_openshift_api_operator_v1_FeaturesMigration(ref), + "github.com/openshift/api/operator/v1.FileReferenceSource": schema_openshift_api_operator_v1_FileReferenceSource(ref), + "github.com/openshift/api/operator/v1.ForwardPlugin": schema_openshift_api_operator_v1_ForwardPlugin(ref), + "github.com/openshift/api/operator/v1.GCPCSIDriverConfigSpec": schema_openshift_api_operator_v1_GCPCSIDriverConfigSpec(ref), + "github.com/openshift/api/operator/v1.GCPKMSKeyReference": schema_openshift_api_operator_v1_GCPKMSKeyReference(ref), + "github.com/openshift/api/operator/v1.GCPLoadBalancerParameters": schema_openshift_api_operator_v1_GCPLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.GatewayConfig": schema_openshift_api_operator_v1_GatewayConfig(ref), + "github.com/openshift/api/operator/v1.GatherStatus": schema_openshift_api_operator_v1_GatherStatus(ref), + "github.com/openshift/api/operator/v1.GathererStatus": schema_openshift_api_operator_v1_GathererStatus(ref), + "github.com/openshift/api/operator/v1.GenerationStatus": schema_openshift_api_operator_v1_GenerationStatus(ref), + "github.com/openshift/api/operator/v1.HTTPCompressionPolicy": schema_openshift_api_operator_v1_HTTPCompressionPolicy(ref), + "github.com/openshift/api/operator/v1.HealthCheck": schema_openshift_api_operator_v1_HealthCheck(ref), + "github.com/openshift/api/operator/v1.HostNetworkStrategy": schema_openshift_api_operator_v1_HostNetworkStrategy(ref), + "github.com/openshift/api/operator/v1.HybridOverlayConfig": schema_openshift_api_operator_v1_HybridOverlayConfig(ref), + "github.com/openshift/api/operator/v1.IBMCloudCSIDriverConfigSpec": schema_openshift_api_operator_v1_IBMCloudCSIDriverConfigSpec(ref), + "github.com/openshift/api/operator/v1.IBMLoadBalancerParameters": schema_openshift_api_operator_v1_IBMLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.IPAMConfig": schema_openshift_api_operator_v1_IPAMConfig(ref), + "github.com/openshift/api/operator/v1.IPFIXConfig": schema_openshift_api_operator_v1_IPFIXConfig(ref), + "github.com/openshift/api/operator/v1.IPsecConfig": schema_openshift_api_operator_v1_IPsecConfig(ref), + "github.com/openshift/api/operator/v1.IPsecFullModeConfig": schema_openshift_api_operator_v1_IPsecFullModeConfig(ref), + "github.com/openshift/api/operator/v1.IPv4GatewayConfig": schema_openshift_api_operator_v1_IPv4GatewayConfig(ref), + "github.com/openshift/api/operator/v1.IPv4OVNKubernetesConfig": schema_openshift_api_operator_v1_IPv4OVNKubernetesConfig(ref), + "github.com/openshift/api/operator/v1.IPv6GatewayConfig": schema_openshift_api_operator_v1_IPv6GatewayConfig(ref), + "github.com/openshift/api/operator/v1.IPv6OVNKubernetesConfig": schema_openshift_api_operator_v1_IPv6OVNKubernetesConfig(ref), + "github.com/openshift/api/operator/v1.Ingress": schema_openshift_api_operator_v1_Ingress(ref), + "github.com/openshift/api/operator/v1.IngressController": schema_openshift_api_operator_v1_IngressController(ref), + "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPCookie": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPCookie(ref), + "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPCookieUnion": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPCookieUnion(ref), + "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPHeader": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPHeader(ref), + "github.com/openshift/api/operator/v1.IngressControllerCaptureHTTPHeaders": schema_openshift_api_operator_v1_IngressControllerCaptureHTTPHeaders(ref), + "github.com/openshift/api/operator/v1.IngressControllerHTTPHeader": schema_openshift_api_operator_v1_IngressControllerHTTPHeader(ref), + "github.com/openshift/api/operator/v1.IngressControllerHTTPHeaderActionUnion": schema_openshift_api_operator_v1_IngressControllerHTTPHeaderActionUnion(ref), + "github.com/openshift/api/operator/v1.IngressControllerHTTPHeaderActions": schema_openshift_api_operator_v1_IngressControllerHTTPHeaderActions(ref), + "github.com/openshift/api/operator/v1.IngressControllerHTTPHeaders": schema_openshift_api_operator_v1_IngressControllerHTTPHeaders(ref), + "github.com/openshift/api/operator/v1.IngressControllerHTTPUniqueIdHeaderPolicy": schema_openshift_api_operator_v1_IngressControllerHTTPUniqueIdHeaderPolicy(ref), + "github.com/openshift/api/operator/v1.IngressControllerList": schema_openshift_api_operator_v1_IngressControllerList(ref), + "github.com/openshift/api/operator/v1.IngressControllerLogging": schema_openshift_api_operator_v1_IngressControllerLogging(ref), + "github.com/openshift/api/operator/v1.IngressControllerSetHTTPHeader": schema_openshift_api_operator_v1_IngressControllerSetHTTPHeader(ref), + "github.com/openshift/api/operator/v1.IngressControllerSpec": schema_openshift_api_operator_v1_IngressControllerSpec(ref), + "github.com/openshift/api/operator/v1.IngressControllerStatus": schema_openshift_api_operator_v1_IngressControllerStatus(ref), + "github.com/openshift/api/operator/v1.IngressControllerTuningOptions": schema_openshift_api_operator_v1_IngressControllerTuningOptions(ref), + "github.com/openshift/api/operator/v1.InsightsOperator": schema_openshift_api_operator_v1_InsightsOperator(ref), + "github.com/openshift/api/operator/v1.InsightsOperatorList": schema_openshift_api_operator_v1_InsightsOperatorList(ref), + "github.com/openshift/api/operator/v1.InsightsOperatorSpec": schema_openshift_api_operator_v1_InsightsOperatorSpec(ref), + "github.com/openshift/api/operator/v1.InsightsOperatorStatus": schema_openshift_api_operator_v1_InsightsOperatorStatus(ref), + "github.com/openshift/api/operator/v1.InsightsReport": schema_openshift_api_operator_v1_InsightsReport(ref), + "github.com/openshift/api/operator/v1.IrreconcilableValidationOverrides": schema_openshift_api_operator_v1_IrreconcilableValidationOverrides(ref), + "github.com/openshift/api/operator/v1.KubeAPIServer": schema_openshift_api_operator_v1_KubeAPIServer(ref), + "github.com/openshift/api/operator/v1.KubeAPIServerList": schema_openshift_api_operator_v1_KubeAPIServerList(ref), + "github.com/openshift/api/operator/v1.KubeAPIServerSpec": schema_openshift_api_operator_v1_KubeAPIServerSpec(ref), + "github.com/openshift/api/operator/v1.KubeAPIServerStatus": schema_openshift_api_operator_v1_KubeAPIServerStatus(ref), + "github.com/openshift/api/operator/v1.KubeControllerManager": schema_openshift_api_operator_v1_KubeControllerManager(ref), + "github.com/openshift/api/operator/v1.KubeControllerManagerList": schema_openshift_api_operator_v1_KubeControllerManagerList(ref), + "github.com/openshift/api/operator/v1.KubeControllerManagerSpec": schema_openshift_api_operator_v1_KubeControllerManagerSpec(ref), + "github.com/openshift/api/operator/v1.KubeControllerManagerStatus": schema_openshift_api_operator_v1_KubeControllerManagerStatus(ref), + "github.com/openshift/api/operator/v1.KubeScheduler": schema_openshift_api_operator_v1_KubeScheduler(ref), + "github.com/openshift/api/operator/v1.KubeSchedulerList": schema_openshift_api_operator_v1_KubeSchedulerList(ref), + "github.com/openshift/api/operator/v1.KubeSchedulerSpec": schema_openshift_api_operator_v1_KubeSchedulerSpec(ref), + "github.com/openshift/api/operator/v1.KubeSchedulerStatus": schema_openshift_api_operator_v1_KubeSchedulerStatus(ref), + "github.com/openshift/api/operator/v1.KubeStorageVersionMigrator": schema_openshift_api_operator_v1_KubeStorageVersionMigrator(ref), + "github.com/openshift/api/operator/v1.KubeStorageVersionMigratorList": schema_openshift_api_operator_v1_KubeStorageVersionMigratorList(ref), + "github.com/openshift/api/operator/v1.KubeStorageVersionMigratorSpec": schema_openshift_api_operator_v1_KubeStorageVersionMigratorSpec(ref), + "github.com/openshift/api/operator/v1.KubeStorageVersionMigratorStatus": schema_openshift_api_operator_v1_KubeStorageVersionMigratorStatus(ref), + "github.com/openshift/api/operator/v1.LoadBalancerStrategy": schema_openshift_api_operator_v1_LoadBalancerStrategy(ref), + "github.com/openshift/api/operator/v1.LoggingDestination": schema_openshift_api_operator_v1_LoggingDestination(ref), + "github.com/openshift/api/operator/v1.Logo": schema_openshift_api_operator_v1_Logo(ref), + "github.com/openshift/api/operator/v1.MTUMigration": schema_openshift_api_operator_v1_MTUMigration(ref), + "github.com/openshift/api/operator/v1.MTUMigrationValues": schema_openshift_api_operator_v1_MTUMigrationValues(ref), + "github.com/openshift/api/operator/v1.MachineConfiguration": schema_openshift_api_operator_v1_MachineConfiguration(ref), + "github.com/openshift/api/operator/v1.MachineConfigurationList": schema_openshift_api_operator_v1_MachineConfigurationList(ref), + "github.com/openshift/api/operator/v1.MachineConfigurationSpec": schema_openshift_api_operator_v1_MachineConfigurationSpec(ref), + "github.com/openshift/api/operator/v1.MachineConfigurationStatus": schema_openshift_api_operator_v1_MachineConfigurationStatus(ref), + "github.com/openshift/api/operator/v1.MachineManager": schema_openshift_api_operator_v1_MachineManager(ref), + "github.com/openshift/api/operator/v1.MachineManagerSelector": schema_openshift_api_operator_v1_MachineManagerSelector(ref), + "github.com/openshift/api/operator/v1.ManagedBootImages": schema_openshift_api_operator_v1_ManagedBootImages(ref), + "github.com/openshift/api/operator/v1.MyOperatorResource": schema_openshift_api_operator_v1_MyOperatorResource(ref), + "github.com/openshift/api/operator/v1.MyOperatorResourceSpec": schema_openshift_api_operator_v1_MyOperatorResourceSpec(ref), + "github.com/openshift/api/operator/v1.MyOperatorResourceStatus": schema_openshift_api_operator_v1_MyOperatorResourceStatus(ref), + "github.com/openshift/api/operator/v1.NetFlowConfig": schema_openshift_api_operator_v1_NetFlowConfig(ref), + "github.com/openshift/api/operator/v1.Network": schema_openshift_api_operator_v1_Network(ref), + "github.com/openshift/api/operator/v1.NetworkList": schema_openshift_api_operator_v1_NetworkList(ref), + "github.com/openshift/api/operator/v1.NetworkMigration": schema_openshift_api_operator_v1_NetworkMigration(ref), + "github.com/openshift/api/operator/v1.NetworkSpec": schema_openshift_api_operator_v1_NetworkSpec(ref), + "github.com/openshift/api/operator/v1.NetworkStatus": schema_openshift_api_operator_v1_NetworkStatus(ref), + "github.com/openshift/api/operator/v1.NoOverlayConfig": schema_openshift_api_operator_v1_NoOverlayConfig(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyClusterStatus": schema_openshift_api_operator_v1_NodeDisruptionPolicyClusterStatus(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyConfig": schema_openshift_api_operator_v1_NodeDisruptionPolicyConfig(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecAction": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecAction(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecFile": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecFile(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecSSHKey": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecSSHKey(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicySpecUnit": schema_openshift_api_operator_v1_NodeDisruptionPolicySpecUnit(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatus": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatus(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusAction": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusAction(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusFile": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusFile(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusSSHKey": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusSSHKey(ref), + "github.com/openshift/api/operator/v1.NodeDisruptionPolicyStatusUnit": schema_openshift_api_operator_v1_NodeDisruptionPolicyStatusUnit(ref), + "github.com/openshift/api/operator/v1.NodePlacement": schema_openshift_api_operator_v1_NodePlacement(ref), + "github.com/openshift/api/operator/v1.NodePortStrategy": schema_openshift_api_operator_v1_NodePortStrategy(ref), + "github.com/openshift/api/operator/v1.NodeStatus": schema_openshift_api_operator_v1_NodeStatus(ref), + "github.com/openshift/api/operator/v1.OAuthAPIServerStatus": schema_openshift_api_operator_v1_OAuthAPIServerStatus(ref), + "github.com/openshift/api/operator/v1.OLM": schema_openshift_api_operator_v1_OLM(ref), + "github.com/openshift/api/operator/v1.OLMList": schema_openshift_api_operator_v1_OLMList(ref), + "github.com/openshift/api/operator/v1.OLMSpec": schema_openshift_api_operator_v1_OLMSpec(ref), + "github.com/openshift/api/operator/v1.OLMStatus": schema_openshift_api_operator_v1_OLMStatus(ref), + "github.com/openshift/api/operator/v1.OVNKubernetesConfig": schema_openshift_api_operator_v1_OVNKubernetesConfig(ref), + "github.com/openshift/api/operator/v1.OpenShiftAPIServer": schema_openshift_api_operator_v1_OpenShiftAPIServer(ref), + "github.com/openshift/api/operator/v1.OpenShiftAPIServerList": schema_openshift_api_operator_v1_OpenShiftAPIServerList(ref), + "github.com/openshift/api/operator/v1.OpenShiftAPIServerSpec": schema_openshift_api_operator_v1_OpenShiftAPIServerSpec(ref), + "github.com/openshift/api/operator/v1.OpenShiftAPIServerStatus": schema_openshift_api_operator_v1_OpenShiftAPIServerStatus(ref), + "github.com/openshift/api/operator/v1.OpenShiftControllerManager": schema_openshift_api_operator_v1_OpenShiftControllerManager(ref), + "github.com/openshift/api/operator/v1.OpenShiftControllerManagerList": schema_openshift_api_operator_v1_OpenShiftControllerManagerList(ref), + "github.com/openshift/api/operator/v1.OpenShiftControllerManagerSpec": schema_openshift_api_operator_v1_OpenShiftControllerManagerSpec(ref), + "github.com/openshift/api/operator/v1.OpenShiftControllerManagerStatus": schema_openshift_api_operator_v1_OpenShiftControllerManagerStatus(ref), + "github.com/openshift/api/operator/v1.OpenShiftSDNConfig": schema_openshift_api_operator_v1_OpenShiftSDNConfig(ref), + "github.com/openshift/api/operator/v1.OpenStackLoadBalancerParameters": schema_openshift_api_operator_v1_OpenStackLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.OperatorCondition": schema_openshift_api_operator_v1_OperatorCondition(ref), + "github.com/openshift/api/operator/v1.OperatorSpec": schema_openshift_api_operator_v1_OperatorSpec(ref), + "github.com/openshift/api/operator/v1.OperatorStatus": schema_openshift_api_operator_v1_OperatorStatus(ref), + "github.com/openshift/api/operator/v1.PartialSelector": schema_openshift_api_operator_v1_PartialSelector(ref), + "github.com/openshift/api/operator/v1.Perspective": schema_openshift_api_operator_v1_Perspective(ref), + "github.com/openshift/api/operator/v1.PerspectiveVisibility": schema_openshift_api_operator_v1_PerspectiveVisibility(ref), + "github.com/openshift/api/operator/v1.PinnedResourceReference": schema_openshift_api_operator_v1_PinnedResourceReference(ref), + "github.com/openshift/api/operator/v1.PolicyAuditConfig": schema_openshift_api_operator_v1_PolicyAuditConfig(ref), + "github.com/openshift/api/operator/v1.PrivateStrategy": schema_openshift_api_operator_v1_PrivateStrategy(ref), + "github.com/openshift/api/operator/v1.ProjectAccess": schema_openshift_api_operator_v1_ProjectAccess(ref), + "github.com/openshift/api/operator/v1.ProviderLoadBalancerParameters": schema_openshift_api_operator_v1_ProviderLoadBalancerParameters(ref), + "github.com/openshift/api/operator/v1.ProxyConfig": schema_openshift_api_operator_v1_ProxyConfig(ref), + "github.com/openshift/api/operator/v1.QuickStarts": schema_openshift_api_operator_v1_QuickStarts(ref), + "github.com/openshift/api/operator/v1.ReloadService": schema_openshift_api_operator_v1_ReloadService(ref), + "github.com/openshift/api/operator/v1.ResourceAttributesAccessReview": schema_openshift_api_operator_v1_ResourceAttributesAccessReview(ref), + "github.com/openshift/api/operator/v1.RestartService": schema_openshift_api_operator_v1_RestartService(ref), + "github.com/openshift/api/operator/v1.RouteAdmissionPolicy": schema_openshift_api_operator_v1_RouteAdmissionPolicy(ref), + "github.com/openshift/api/operator/v1.SFlowConfig": schema_openshift_api_operator_v1_SFlowConfig(ref), + "github.com/openshift/api/operator/v1.Server": schema_openshift_api_operator_v1_Server(ref), + "github.com/openshift/api/operator/v1.ServiceAccountIssuerStatus": schema_openshift_api_operator_v1_ServiceAccountIssuerStatus(ref), + "github.com/openshift/api/operator/v1.ServiceCA": schema_openshift_api_operator_v1_ServiceCA(ref), + "github.com/openshift/api/operator/v1.ServiceCAList": schema_openshift_api_operator_v1_ServiceCAList(ref), + "github.com/openshift/api/operator/v1.ServiceCASpec": schema_openshift_api_operator_v1_ServiceCASpec(ref), + "github.com/openshift/api/operator/v1.ServiceCAStatus": schema_openshift_api_operator_v1_ServiceCAStatus(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogAPIServer": schema_openshift_api_operator_v1_ServiceCatalogAPIServer(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogAPIServerList": schema_openshift_api_operator_v1_ServiceCatalogAPIServerList(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogAPIServerSpec": schema_openshift_api_operator_v1_ServiceCatalogAPIServerSpec(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogAPIServerStatus": schema_openshift_api_operator_v1_ServiceCatalogAPIServerStatus(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogControllerManager": schema_openshift_api_operator_v1_ServiceCatalogControllerManager(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogControllerManagerList": schema_openshift_api_operator_v1_ServiceCatalogControllerManagerList(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogControllerManagerSpec": schema_openshift_api_operator_v1_ServiceCatalogControllerManagerSpec(ref), + "github.com/openshift/api/operator/v1.ServiceCatalogControllerManagerStatus": schema_openshift_api_operator_v1_ServiceCatalogControllerManagerStatus(ref), + "github.com/openshift/api/operator/v1.SimpleMacvlanConfig": schema_openshift_api_operator_v1_SimpleMacvlanConfig(ref), + "github.com/openshift/api/operator/v1.StaticIPAMAddresses": schema_openshift_api_operator_v1_StaticIPAMAddresses(ref), + "github.com/openshift/api/operator/v1.StaticIPAMConfig": schema_openshift_api_operator_v1_StaticIPAMConfig(ref), + "github.com/openshift/api/operator/v1.StaticIPAMDNS": schema_openshift_api_operator_v1_StaticIPAMDNS(ref), + "github.com/openshift/api/operator/v1.StaticIPAMRoutes": schema_openshift_api_operator_v1_StaticIPAMRoutes(ref), + "github.com/openshift/api/operator/v1.StaticPodOperatorSpec": schema_openshift_api_operator_v1_StaticPodOperatorSpec(ref), + "github.com/openshift/api/operator/v1.StaticPodOperatorStatus": schema_openshift_api_operator_v1_StaticPodOperatorStatus(ref), + "github.com/openshift/api/operator/v1.StatuspageProvider": schema_openshift_api_operator_v1_StatuspageProvider(ref), + "github.com/openshift/api/operator/v1.Storage": schema_openshift_api_operator_v1_Storage(ref), + "github.com/openshift/api/operator/v1.StorageList": schema_openshift_api_operator_v1_StorageList(ref), + "github.com/openshift/api/operator/v1.StorageSpec": schema_openshift_api_operator_v1_StorageSpec(ref), + "github.com/openshift/api/operator/v1.StorageStatus": schema_openshift_api_operator_v1_StorageStatus(ref), + "github.com/openshift/api/operator/v1.SyslogLoggingDestinationParameters": schema_openshift_api_operator_v1_SyslogLoggingDestinationParameters(ref), + "github.com/openshift/api/operator/v1.Theme": schema_openshift_api_operator_v1_Theme(ref), + "github.com/openshift/api/operator/v1.Upstream": schema_openshift_api_operator_v1_Upstream(ref), + "github.com/openshift/api/operator/v1.UpstreamResolvers": schema_openshift_api_operator_v1_UpstreamResolvers(ref), + "github.com/openshift/api/operator/v1.VSphereCSIDriverConfigSpec": schema_openshift_api_operator_v1_VSphereCSIDriverConfigSpec(ref), + "github.com/openshift/api/operator/v1alpha1.BackupJobReference": schema_openshift_api_operator_v1alpha1_BackupJobReference(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPI": schema_openshift_api_operator_v1alpha1_ClusterAPI(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponent": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponent(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponentImage": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponentImage(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponentSource": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponentSource(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerRevision": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevision(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerRevisionManifestSubstitution": schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevisionManifestSubstitution(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIList": schema_openshift_api_operator_v1alpha1_ClusterAPIList(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPISpec": schema_openshift_api_operator_v1alpha1_ClusterAPISpec(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterAPIStatus": schema_openshift_api_operator_v1alpha1_ClusterAPIStatus(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperator": schema_openshift_api_operator_v1alpha1_ClusterVersionOperator(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperatorList": schema_openshift_api_operator_v1alpha1_ClusterVersionOperatorList(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperatorSpec": schema_openshift_api_operator_v1alpha1_ClusterVersionOperatorSpec(ref), + "github.com/openshift/api/operator/v1alpha1.ClusterVersionOperatorStatus": schema_openshift_api_operator_v1alpha1_ClusterVersionOperatorStatus(ref), + "github.com/openshift/api/operator/v1alpha1.DelegatedAuthentication": schema_openshift_api_operator_v1alpha1_DelegatedAuthentication(ref), + "github.com/openshift/api/operator/v1alpha1.DelegatedAuthorization": schema_openshift_api_operator_v1alpha1_DelegatedAuthorization(ref), + "github.com/openshift/api/operator/v1alpha1.EtcdBackup": schema_openshift_api_operator_v1alpha1_EtcdBackup(ref), + "github.com/openshift/api/operator/v1alpha1.EtcdBackupList": schema_openshift_api_operator_v1alpha1_EtcdBackupList(ref), + "github.com/openshift/api/operator/v1alpha1.EtcdBackupSpec": schema_openshift_api_operator_v1alpha1_EtcdBackupSpec(ref), + "github.com/openshift/api/operator/v1alpha1.EtcdBackupStatus": schema_openshift_api_operator_v1alpha1_EtcdBackupStatus(ref), + "github.com/openshift/api/operator/v1alpha1.GenerationHistory": schema_openshift_api_operator_v1alpha1_GenerationHistory(ref), + "github.com/openshift/api/operator/v1alpha1.GenericOperatorConfig": schema_openshift_api_operator_v1alpha1_GenericOperatorConfig(ref), + "github.com/openshift/api/operator/v1alpha1.ImageContentSourcePolicy": schema_openshift_api_operator_v1alpha1_ImageContentSourcePolicy(ref), + "github.com/openshift/api/operator/v1alpha1.ImageContentSourcePolicyList": schema_openshift_api_operator_v1alpha1_ImageContentSourcePolicyList(ref), + "github.com/openshift/api/operator/v1alpha1.ImageContentSourcePolicySpec": schema_openshift_api_operator_v1alpha1_ImageContentSourcePolicySpec(ref), + "github.com/openshift/api/operator/v1alpha1.LoggingConfig": schema_openshift_api_operator_v1alpha1_LoggingConfig(ref), + "github.com/openshift/api/operator/v1alpha1.NodeStatus": schema_openshift_api_operator_v1alpha1_NodeStatus(ref), + "github.com/openshift/api/operator/v1alpha1.OLM": schema_openshift_api_operator_v1alpha1_OLM(ref), + "github.com/openshift/api/operator/v1alpha1.OLMList": schema_openshift_api_operator_v1alpha1_OLMList(ref), + "github.com/openshift/api/operator/v1alpha1.OLMSpec": schema_openshift_api_operator_v1alpha1_OLMSpec(ref), + "github.com/openshift/api/operator/v1alpha1.OLMStatus": schema_openshift_api_operator_v1alpha1_OLMStatus(ref), + "github.com/openshift/api/operator/v1alpha1.OperatorCondition": schema_openshift_api_operator_v1alpha1_OperatorCondition(ref), + "github.com/openshift/api/operator/v1alpha1.OperatorSpec": schema_openshift_api_operator_v1alpha1_OperatorSpec(ref), + "github.com/openshift/api/operator/v1alpha1.OperatorStatus": schema_openshift_api_operator_v1alpha1_OperatorStatus(ref), + "github.com/openshift/api/operator/v1alpha1.RepositoryDigestMirrors": schema_openshift_api_operator_v1alpha1_RepositoryDigestMirrors(ref), + "github.com/openshift/api/operator/v1alpha1.StaticPodOperatorStatus": schema_openshift_api_operator_v1alpha1_StaticPodOperatorStatus(ref), + "github.com/openshift/api/operator/v1alpha1.VersionAvailability": schema_openshift_api_operator_v1alpha1_VersionAvailability(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.LogEntry": schema_openshift_api_operatorcontrolplane_v1alpha1_LogEntry(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.OutageEntry": schema_openshift_api_operatorcontrolplane_v1alpha1_OutageEntry(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheck": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheck(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckCondition": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckCondition(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckList": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckList(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckSpec": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckSpec(ref), + "github.com/openshift/api/operatorcontrolplane/v1alpha1.PodNetworkConnectivityCheckStatus": schema_openshift_api_operatorcontrolplane_v1alpha1_PodNetworkConnectivityCheckStatus(ref), + "github.com/openshift/api/operatoringress/v1.DNSRecord": schema_openshift_api_operatoringress_v1_DNSRecord(ref), + "github.com/openshift/api/operatoringress/v1.DNSRecordList": schema_openshift_api_operatoringress_v1_DNSRecordList(ref), + "github.com/openshift/api/operatoringress/v1.DNSRecordSpec": schema_openshift_api_operatoringress_v1_DNSRecordSpec(ref), + "github.com/openshift/api/operatoringress/v1.DNSRecordStatus": schema_openshift_api_operatoringress_v1_DNSRecordStatus(ref), + "github.com/openshift/api/operatoringress/v1.DNSZoneCondition": schema_openshift_api_operatoringress_v1_DNSZoneCondition(ref), + "github.com/openshift/api/operatoringress/v1.DNSZoneStatus": schema_openshift_api_operatoringress_v1_DNSZoneStatus(ref), + "github.com/openshift/api/osin/v1.AllowAllPasswordIdentityProvider": schema_openshift_api_osin_v1_AllowAllPasswordIdentityProvider(ref), + "github.com/openshift/api/osin/v1.BasicAuthPasswordIdentityProvider": schema_openshift_api_osin_v1_BasicAuthPasswordIdentityProvider(ref), + "github.com/openshift/api/osin/v1.DenyAllPasswordIdentityProvider": schema_openshift_api_osin_v1_DenyAllPasswordIdentityProvider(ref), + "github.com/openshift/api/osin/v1.GitHubIdentityProvider": schema_openshift_api_osin_v1_GitHubIdentityProvider(ref), + "github.com/openshift/api/osin/v1.GitLabIdentityProvider": schema_openshift_api_osin_v1_GitLabIdentityProvider(ref), + "github.com/openshift/api/osin/v1.GoogleIdentityProvider": schema_openshift_api_osin_v1_GoogleIdentityProvider(ref), + "github.com/openshift/api/osin/v1.GrantConfig": schema_openshift_api_osin_v1_GrantConfig(ref), + "github.com/openshift/api/osin/v1.HTPasswdPasswordIdentityProvider": schema_openshift_api_osin_v1_HTPasswdPasswordIdentityProvider(ref), + "github.com/openshift/api/osin/v1.IdentityProvider": schema_openshift_api_osin_v1_IdentityProvider(ref), + "github.com/openshift/api/osin/v1.KeystonePasswordIdentityProvider": schema_openshift_api_osin_v1_KeystonePasswordIdentityProvider(ref), + "github.com/openshift/api/osin/v1.LDAPAttributeMapping": schema_openshift_api_osin_v1_LDAPAttributeMapping(ref), + "github.com/openshift/api/osin/v1.LDAPPasswordIdentityProvider": schema_openshift_api_osin_v1_LDAPPasswordIdentityProvider(ref), + "github.com/openshift/api/osin/v1.OAuthConfig": schema_openshift_api_osin_v1_OAuthConfig(ref), + "github.com/openshift/api/osin/v1.OAuthTemplates": schema_openshift_api_osin_v1_OAuthTemplates(ref), + "github.com/openshift/api/osin/v1.OpenIDClaims": schema_openshift_api_osin_v1_OpenIDClaims(ref), + "github.com/openshift/api/osin/v1.OpenIDIdentityProvider": schema_openshift_api_osin_v1_OpenIDIdentityProvider(ref), + "github.com/openshift/api/osin/v1.OpenIDURLs": schema_openshift_api_osin_v1_OpenIDURLs(ref), + "github.com/openshift/api/osin/v1.OsinServerConfig": schema_openshift_api_osin_v1_OsinServerConfig(ref), + "github.com/openshift/api/osin/v1.RequestHeaderIdentityProvider": schema_openshift_api_osin_v1_RequestHeaderIdentityProvider(ref), + "github.com/openshift/api/osin/v1.SessionConfig": schema_openshift_api_osin_v1_SessionConfig(ref), + "github.com/openshift/api/osin/v1.SessionSecret": schema_openshift_api_osin_v1_SessionSecret(ref), + "github.com/openshift/api/osin/v1.SessionSecrets": schema_openshift_api_osin_v1_SessionSecrets(ref), + "github.com/openshift/api/osin/v1.TokenConfig": schema_openshift_api_osin_v1_TokenConfig(ref), + "github.com/openshift/api/project/v1.Project": schema_openshift_api_project_v1_Project(ref), + "github.com/openshift/api/project/v1.ProjectList": schema_openshift_api_project_v1_ProjectList(ref), + "github.com/openshift/api/project/v1.ProjectRequest": schema_openshift_api_project_v1_ProjectRequest(ref), + "github.com/openshift/api/project/v1.ProjectSpec": schema_openshift_api_project_v1_ProjectSpec(ref), + "github.com/openshift/api/project/v1.ProjectStatus": schema_openshift_api_project_v1_ProjectStatus(ref), + "github.com/openshift/api/quota/v1.AppliedClusterResourceQuota": schema_openshift_api_quota_v1_AppliedClusterResourceQuota(ref), + "github.com/openshift/api/quota/v1.AppliedClusterResourceQuotaList": schema_openshift_api_quota_v1_AppliedClusterResourceQuotaList(ref), + "github.com/openshift/api/quota/v1.ClusterResourceQuota": schema_openshift_api_quota_v1_ClusterResourceQuota(ref), + "github.com/openshift/api/quota/v1.ClusterResourceQuotaList": schema_openshift_api_quota_v1_ClusterResourceQuotaList(ref), + "github.com/openshift/api/quota/v1.ClusterResourceQuotaSelector": schema_openshift_api_quota_v1_ClusterResourceQuotaSelector(ref), + "github.com/openshift/api/quota/v1.ClusterResourceQuotaSpec": schema_openshift_api_quota_v1_ClusterResourceQuotaSpec(ref), + "github.com/openshift/api/quota/v1.ClusterResourceQuotaStatus": schema_openshift_api_quota_v1_ClusterResourceQuotaStatus(ref), + "github.com/openshift/api/quota/v1.ResourceQuotaStatusByNamespace": schema_openshift_api_quota_v1_ResourceQuotaStatusByNamespace(ref), + "github.com/openshift/api/route/v1.LocalObjectReference": schema_openshift_api_route_v1_LocalObjectReference(ref), + "github.com/openshift/api/route/v1.Route": schema_openshift_api_route_v1_Route(ref), + "github.com/openshift/api/route/v1.RouteHTTPHeader": schema_openshift_api_route_v1_RouteHTTPHeader(ref), + "github.com/openshift/api/route/v1.RouteHTTPHeaderActionUnion": schema_openshift_api_route_v1_RouteHTTPHeaderActionUnion(ref), + "github.com/openshift/api/route/v1.RouteHTTPHeaderActions": schema_openshift_api_route_v1_RouteHTTPHeaderActions(ref), + "github.com/openshift/api/route/v1.RouteHTTPHeaders": schema_openshift_api_route_v1_RouteHTTPHeaders(ref), + "github.com/openshift/api/route/v1.RouteIngress": schema_openshift_api_route_v1_RouteIngress(ref), + "github.com/openshift/api/route/v1.RouteIngressCondition": schema_openshift_api_route_v1_RouteIngressCondition(ref), + "github.com/openshift/api/route/v1.RouteList": schema_openshift_api_route_v1_RouteList(ref), + "github.com/openshift/api/route/v1.RoutePort": schema_openshift_api_route_v1_RoutePort(ref), + "github.com/openshift/api/route/v1.RouteSetHTTPHeader": schema_openshift_api_route_v1_RouteSetHTTPHeader(ref), + "github.com/openshift/api/route/v1.RouteSpec": schema_openshift_api_route_v1_RouteSpec(ref), + "github.com/openshift/api/route/v1.RouteStatus": schema_openshift_api_route_v1_RouteStatus(ref), + "github.com/openshift/api/route/v1.RouteTargetReference": schema_openshift_api_route_v1_RouteTargetReference(ref), + "github.com/openshift/api/route/v1.RouterShard": schema_openshift_api_route_v1_RouterShard(ref), + "github.com/openshift/api/route/v1.TLSConfig": schema_openshift_api_route_v1_TLSConfig(ref), + "github.com/openshift/api/samples/v1.Config": schema_openshift_api_samples_v1_Config(ref), + "github.com/openshift/api/samples/v1.ConfigCondition": schema_openshift_api_samples_v1_ConfigCondition(ref), + "github.com/openshift/api/samples/v1.ConfigList": schema_openshift_api_samples_v1_ConfigList(ref), + "github.com/openshift/api/samples/v1.ConfigSpec": schema_openshift_api_samples_v1_ConfigSpec(ref), + "github.com/openshift/api/samples/v1.ConfigStatus": schema_openshift_api_samples_v1_ConfigStatus(ref), + "github.com/openshift/api/security/v1.AllowedFlexVolume": schema_openshift_api_security_v1_AllowedFlexVolume(ref), + "github.com/openshift/api/security/v1.FSGroupStrategyOptions": schema_openshift_api_security_v1_FSGroupStrategyOptions(ref), + "github.com/openshift/api/security/v1.IDRange": schema_openshift_api_security_v1_IDRange(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicyReview": schema_openshift_api_security_v1_PodSecurityPolicyReview(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicyReviewSpec": schema_openshift_api_security_v1_PodSecurityPolicyReviewSpec(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicyReviewStatus": schema_openshift_api_security_v1_PodSecurityPolicyReviewStatus(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicySelfSubjectReview": schema_openshift_api_security_v1_PodSecurityPolicySelfSubjectReview(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicySelfSubjectReviewSpec": schema_openshift_api_security_v1_PodSecurityPolicySelfSubjectReviewSpec(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicySubjectReview": schema_openshift_api_security_v1_PodSecurityPolicySubjectReview(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicySubjectReviewSpec": schema_openshift_api_security_v1_PodSecurityPolicySubjectReviewSpec(ref), + "github.com/openshift/api/security/v1.PodSecurityPolicySubjectReviewStatus": schema_openshift_api_security_v1_PodSecurityPolicySubjectReviewStatus(ref), + "github.com/openshift/api/security/v1.RangeAllocation": schema_openshift_api_security_v1_RangeAllocation(ref), + "github.com/openshift/api/security/v1.RangeAllocationList": schema_openshift_api_security_v1_RangeAllocationList(ref), + "github.com/openshift/api/security/v1.RunAsUserStrategyOptions": schema_openshift_api_security_v1_RunAsUserStrategyOptions(ref), + "github.com/openshift/api/security/v1.SELinuxContextStrategyOptions": schema_openshift_api_security_v1_SELinuxContextStrategyOptions(ref), + "github.com/openshift/api/security/v1.SecurityContextConstraints": schema_openshift_api_security_v1_SecurityContextConstraints(ref), + "github.com/openshift/api/security/v1.SecurityContextConstraintsList": schema_openshift_api_security_v1_SecurityContextConstraintsList(ref), + "github.com/openshift/api/security/v1.ServiceAccountPodSecurityPolicyReviewStatus": schema_openshift_api_security_v1_ServiceAccountPodSecurityPolicyReviewStatus(ref), + "github.com/openshift/api/security/v1.SupplementalGroupsStrategyOptions": schema_openshift_api_security_v1_SupplementalGroupsStrategyOptions(ref), + "github.com/openshift/api/securityinternal/v1.RangeAllocation": schema_openshift_api_securityinternal_v1_RangeAllocation(ref), + "github.com/openshift/api/securityinternal/v1.RangeAllocationList": schema_openshift_api_securityinternal_v1_RangeAllocationList(ref), + "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfig": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfig(ref), + "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfigList": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfigList(ref), + "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfigSpec": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfigSpec(ref), + "github.com/openshift/api/servicecertsigner/v1alpha1.ServiceCertSignerOperatorConfigStatus": schema_openshift_api_servicecertsigner_v1alpha1_ServiceCertSignerOperatorConfigStatus(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMap": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMap(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapList": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapList(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapReference": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapReference(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapSpec": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapSpec(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedConfigMapStatus": schema_openshift_api_sharedresource_v1alpha1_SharedConfigMapStatus(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedSecret": schema_openshift_api_sharedresource_v1alpha1_SharedSecret(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretList": schema_openshift_api_sharedresource_v1alpha1_SharedSecretList(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretReference": schema_openshift_api_sharedresource_v1alpha1_SharedSecretReference(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretSpec": schema_openshift_api_sharedresource_v1alpha1_SharedSecretSpec(ref), + "github.com/openshift/api/sharedresource/v1alpha1.SharedSecretStatus": schema_openshift_api_sharedresource_v1alpha1_SharedSecretStatus(ref), + "github.com/openshift/api/template/v1.BrokerTemplateInstance": schema_openshift_api_template_v1_BrokerTemplateInstance(ref), + "github.com/openshift/api/template/v1.BrokerTemplateInstanceList": schema_openshift_api_template_v1_BrokerTemplateInstanceList(ref), + "github.com/openshift/api/template/v1.BrokerTemplateInstanceSpec": schema_openshift_api_template_v1_BrokerTemplateInstanceSpec(ref), + "github.com/openshift/api/template/v1.Parameter": schema_openshift_api_template_v1_Parameter(ref), + "github.com/openshift/api/template/v1.Template": schema_openshift_api_template_v1_Template(ref), + "github.com/openshift/api/template/v1.TemplateInstance": schema_openshift_api_template_v1_TemplateInstance(ref), + "github.com/openshift/api/template/v1.TemplateInstanceCondition": schema_openshift_api_template_v1_TemplateInstanceCondition(ref), + "github.com/openshift/api/template/v1.TemplateInstanceList": schema_openshift_api_template_v1_TemplateInstanceList(ref), + "github.com/openshift/api/template/v1.TemplateInstanceObject": schema_openshift_api_template_v1_TemplateInstanceObject(ref), + "github.com/openshift/api/template/v1.TemplateInstanceRequester": schema_openshift_api_template_v1_TemplateInstanceRequester(ref), + "github.com/openshift/api/template/v1.TemplateInstanceSpec": schema_openshift_api_template_v1_TemplateInstanceSpec(ref), + "github.com/openshift/api/template/v1.TemplateInstanceStatus": schema_openshift_api_template_v1_TemplateInstanceStatus(ref), + "github.com/openshift/api/template/v1.TemplateList": schema_openshift_api_template_v1_TemplateList(ref), + "github.com/openshift/api/user/v1.Group": schema_openshift_api_user_v1_Group(ref), + "github.com/openshift/api/user/v1.GroupList": schema_openshift_api_user_v1_GroupList(ref), + "github.com/openshift/api/user/v1.Identity": schema_openshift_api_user_v1_Identity(ref), + "github.com/openshift/api/user/v1.IdentityList": schema_openshift_api_user_v1_IdentityList(ref), + "github.com/openshift/api/user/v1.User": schema_openshift_api_user_v1_User(ref), + "github.com/openshift/api/user/v1.UserIdentityMapping": schema_openshift_api_user_v1_UserIdentityMapping(ref), + "github.com/openshift/api/user/v1.UserList": schema_openshift_api_user_v1_UserList(ref), + v1.AuditAnnotation{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_AuditAnnotation(ref), + v1.ExpressionWarning{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ExpressionWarning(ref), + v1.MatchCondition{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MatchCondition(ref), + v1.MatchResources{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MatchResources(ref), + v1.MutatingWebhook{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MutatingWebhook(ref), + v1.MutatingWebhookConfiguration{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MutatingWebhookConfiguration(ref), + v1.MutatingWebhookConfigurationList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_MutatingWebhookConfigurationList(ref), + v1.NamedRuleWithOperations{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_NamedRuleWithOperations(ref), + v1.ParamKind{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ParamKind(ref), + v1.ParamRef{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ParamRef(ref), + v1.Rule{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_Rule(ref), + v1.RuleWithOperations{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_RuleWithOperations(ref), + v1.ServiceReference{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ServiceReference(ref), + v1.TypeChecking{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_TypeChecking(ref), + v1.ValidatingAdmissionPolicy{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicy(ref), + v1.ValidatingAdmissionPolicyBinding{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyBinding(ref), + v1.ValidatingAdmissionPolicyBindingList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyBindingList(ref), + v1.ValidatingAdmissionPolicyBindingSpec{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyBindingSpec(ref), + v1.ValidatingAdmissionPolicyList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyList(ref), + v1.ValidatingAdmissionPolicySpec{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicySpec(ref), + v1.ValidatingAdmissionPolicyStatus{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingAdmissionPolicyStatus(ref), + v1.ValidatingWebhook{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingWebhook(ref), + v1.ValidatingWebhookConfiguration{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingWebhookConfiguration(ref), + v1.ValidatingWebhookConfigurationList{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_ValidatingWebhookConfigurationList(ref), + v1.Validation{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_Validation(ref), + v1.Variable{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_Variable(ref), + v1.WebhookClientConfig{}.OpenAPIModelName(): schema_k8sio_api_admissionregistration_v1_WebhookClientConfig(ref), + authorizationv1.FieldSelectorAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_FieldSelectorAttributes(ref), + authorizationv1.LabelSelectorAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_LabelSelectorAttributes(ref), + authorizationv1.LocalSubjectAccessReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_LocalSubjectAccessReview(ref), + authorizationv1.NonResourceAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_NonResourceAttributes(ref), + authorizationv1.NonResourceRule{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_NonResourceRule(ref), + authorizationv1.ResourceAttributes{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_ResourceAttributes(ref), + authorizationv1.ResourceRule{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_ResourceRule(ref), + authorizationv1.SelfSubjectAccessReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectAccessReview(ref), + authorizationv1.SelfSubjectAccessReviewSpec{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectAccessReviewSpec(ref), + authorizationv1.SelfSubjectRulesReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectRulesReview(ref), + authorizationv1.SelfSubjectRulesReviewSpec{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SelfSubjectRulesReviewSpec(ref), + authorizationv1.SubjectAccessReview{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectAccessReview(ref), + authorizationv1.SubjectAccessReviewSpec{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectAccessReviewSpec(ref), + authorizationv1.SubjectAccessReviewStatus{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectAccessReviewStatus(ref), + authorizationv1.SubjectRulesReviewStatus{}.OpenAPIModelName(): schema_k8sio_api_authorization_v1_SubjectRulesReviewStatus(ref), + corev1.AWSElasticBlockStoreVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AWSElasticBlockStoreVolumeSource(ref), + corev1.Affinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Affinity(ref), + corev1.AppArmorProfile{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AppArmorProfile(ref), + corev1.AttachedVolume{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AttachedVolume(ref), + corev1.AvoidPods{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AvoidPods(ref), + corev1.AzureDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AzureDiskVolumeSource(ref), + corev1.AzureFilePersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AzureFilePersistentVolumeSource(ref), + corev1.AzureFileVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_AzureFileVolumeSource(ref), + corev1.Binding{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Binding(ref), + corev1.CSIPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CSIPersistentVolumeSource(ref), + corev1.CSIVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CSIVolumeSource(ref), + corev1.Capabilities{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Capabilities(ref), + corev1.CephFSPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CephFSPersistentVolumeSource(ref), + corev1.CephFSVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CephFSVolumeSource(ref), + corev1.CinderPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CinderPersistentVolumeSource(ref), + corev1.CinderVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_CinderVolumeSource(ref), + corev1.ClientIPConfig{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ClientIPConfig(ref), + corev1.ClusterTrustBundleProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ClusterTrustBundleProjection(ref), + corev1.ComponentCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ComponentCondition(ref), + corev1.ComponentStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ComponentStatus(ref), + corev1.ComponentStatusList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ComponentStatusList(ref), + corev1.ConfigMap{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMap(ref), + corev1.ConfigMapEnvSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapEnvSource(ref), + corev1.ConfigMapKeySelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapKeySelector(ref), + corev1.ConfigMapList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapList(ref), + corev1.ConfigMapNodeConfigSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapNodeConfigSource(ref), + corev1.ConfigMapProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapProjection(ref), + corev1.ConfigMapVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ConfigMapVolumeSource(ref), + corev1.Container{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Container(ref), + corev1.ContainerExtendedResourceRequest{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerExtendedResourceRequest(ref), + corev1.ContainerImage{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerImage(ref), + corev1.ContainerPort{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerPort(ref), + corev1.ContainerResizePolicy{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerResizePolicy(ref), + corev1.ContainerRestartRule{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerRestartRule(ref), + corev1.ContainerRestartRuleOnExitCodes{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerRestartRuleOnExitCodes(ref), + corev1.ContainerState{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerState(ref), + corev1.ContainerStateRunning{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStateRunning(ref), + corev1.ContainerStateTerminated{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStateTerminated(ref), + corev1.ContainerStateWaiting{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStateWaiting(ref), + corev1.ContainerStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerStatus(ref), + corev1.ContainerUser{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ContainerUser(ref), + corev1.DaemonEndpoint{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DaemonEndpoint(ref), + corev1.DownwardAPIProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DownwardAPIProjection(ref), + corev1.DownwardAPIVolumeFile{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DownwardAPIVolumeFile(ref), + corev1.DownwardAPIVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_DownwardAPIVolumeSource(ref), + corev1.EmptyDirVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EmptyDirVolumeSource(ref), + corev1.EndpointAddress{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointAddress(ref), + corev1.EndpointPort{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointPort(ref), + corev1.EndpointSubset{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointSubset(ref), + corev1.Endpoints{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Endpoints(ref), + corev1.EndpointsList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EndpointsList(ref), + corev1.EnvFromSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EnvFromSource(ref), + corev1.EnvVar{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EnvVar(ref), + corev1.EnvVarSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EnvVarSource(ref), + corev1.EphemeralContainer{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EphemeralContainer(ref), + corev1.EphemeralContainerCommon{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EphemeralContainerCommon(ref), + corev1.EphemeralVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EphemeralVolumeSource(ref), + corev1.Event{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Event(ref), + corev1.EventList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EventList(ref), + corev1.EventSeries{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EventSeries(ref), + corev1.EventSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_EventSource(ref), + corev1.ExecAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ExecAction(ref), + corev1.FCVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FCVolumeSource(ref), + corev1.FileKeySelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FileKeySelector(ref), + corev1.FlexPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FlexPersistentVolumeSource(ref), + corev1.FlexVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FlexVolumeSource(ref), + corev1.FlockerVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_FlockerVolumeSource(ref), + corev1.GCEPersistentDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GCEPersistentDiskVolumeSource(ref), + corev1.GRPCAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GRPCAction(ref), + corev1.GitRepoVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GitRepoVolumeSource(ref), + corev1.GlusterfsPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GlusterfsPersistentVolumeSource(ref), + corev1.GlusterfsVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_GlusterfsVolumeSource(ref), + corev1.HTTPGetAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HTTPGetAction(ref), + corev1.HTTPHeader{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HTTPHeader(ref), + corev1.HostAlias{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HostAlias(ref), + corev1.HostIP{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HostIP(ref), + corev1.HostPathVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_HostPathVolumeSource(ref), + corev1.ISCSIPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ISCSIPersistentVolumeSource(ref), + corev1.ISCSIVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ISCSIVolumeSource(ref), + corev1.ImageVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ImageVolumeSource(ref), + corev1.KeyToPath{}.OpenAPIModelName(): schema_k8sio_api_core_v1_KeyToPath(ref), + corev1.Lifecycle{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Lifecycle(ref), + corev1.LifecycleHandler{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LifecycleHandler(ref), + corev1.LimitRange{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRange(ref), + corev1.LimitRangeItem{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRangeItem(ref), + corev1.LimitRangeList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRangeList(ref), + corev1.LimitRangeSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LimitRangeSpec(ref), + corev1.LinuxContainerUser{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LinuxContainerUser(ref), + corev1.List{}.OpenAPIModelName(): schema_k8sio_api_core_v1_List(ref), + corev1.LoadBalancerIngress{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LoadBalancerIngress(ref), + corev1.LoadBalancerStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LoadBalancerStatus(ref), + corev1.LocalObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LocalObjectReference(ref), + corev1.LocalVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_LocalVolumeSource(ref), + corev1.ModifyVolumeStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ModifyVolumeStatus(ref), + corev1.NFSVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NFSVolumeSource(ref), + corev1.Namespace{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Namespace(ref), + corev1.NamespaceCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceCondition(ref), + corev1.NamespaceList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceList(ref), + corev1.NamespaceSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceSpec(ref), + corev1.NamespaceStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NamespaceStatus(ref), + corev1.Node{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Node(ref), + corev1.NodeAddress{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeAddress(ref), + corev1.NodeAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeAffinity(ref), + corev1.NodeCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeCondition(ref), + corev1.NodeConfigSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeConfigSource(ref), + corev1.NodeConfigStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeConfigStatus(ref), + corev1.NodeDaemonEndpoints{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeDaemonEndpoints(ref), + corev1.NodeFeatures{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeFeatures(ref), + corev1.NodeList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeList(ref), + corev1.NodeProxyOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeProxyOptions(ref), + corev1.NodeRuntimeHandler{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeRuntimeHandler(ref), + corev1.NodeRuntimeHandlerFeatures{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeRuntimeHandlerFeatures(ref), + corev1.NodeSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSelector(ref), + corev1.NodeSelectorRequirement{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSelectorRequirement(ref), + corev1.NodeSelectorTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSelectorTerm(ref), + corev1.NodeSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSpec(ref), + corev1.NodeStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeStatus(ref), + corev1.NodeSwapStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSwapStatus(ref), + corev1.NodeSystemInfo{}.OpenAPIModelName(): schema_k8sio_api_core_v1_NodeSystemInfo(ref), + corev1.ObjectFieldSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ObjectFieldSelector(ref), + corev1.ObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ObjectReference(ref), + corev1.PersistentVolume{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolume(ref), + corev1.PersistentVolumeClaim{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaim(ref), + corev1.PersistentVolumeClaimCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimCondition(ref), + corev1.PersistentVolumeClaimList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimList(ref), + corev1.PersistentVolumeClaimSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimSpec(ref), + corev1.PersistentVolumeClaimStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimStatus(ref), + corev1.PersistentVolumeClaimTemplate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimTemplate(ref), + corev1.PersistentVolumeClaimVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeClaimVolumeSource(ref), + corev1.PersistentVolumeList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeList(ref), + corev1.PersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeSource(ref), + corev1.PersistentVolumeSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeSpec(ref), + corev1.PersistentVolumeStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PersistentVolumeStatus(ref), + corev1.PhotonPersistentDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PhotonPersistentDiskVolumeSource(ref), + corev1.Pod{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Pod(ref), + corev1.PodAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAffinity(ref), + corev1.PodAffinityTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAffinityTerm(ref), + corev1.PodAntiAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAntiAffinity(ref), + corev1.PodAttachOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodAttachOptions(ref), + corev1.PodCertificateProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodCertificateProjection(ref), + corev1.PodCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodCondition(ref), + corev1.PodDNSConfig{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodDNSConfig(ref), + corev1.PodDNSConfigOption{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodDNSConfigOption(ref), + corev1.PodExecOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodExecOptions(ref), + corev1.PodExtendedResourceClaimStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodExtendedResourceClaimStatus(ref), + corev1.PodIP{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodIP(ref), + corev1.PodList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodList(ref), + corev1.PodLogOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodLogOptions(ref), + corev1.PodOS{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodOS(ref), + corev1.PodPortForwardOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodPortForwardOptions(ref), + corev1.PodProxyOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodProxyOptions(ref), + corev1.PodReadinessGate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodReadinessGate(ref), + corev1.PodResourceClaim{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodResourceClaim(ref), + corev1.PodResourceClaimStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodResourceClaimStatus(ref), + corev1.PodSchedulingGate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSchedulingGate(ref), + corev1.PodSecurityContext{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSecurityContext(ref), + corev1.PodSignature{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSignature(ref), + corev1.PodSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodSpec(ref), + corev1.PodStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodStatus(ref), + corev1.PodStatusResult{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodStatusResult(ref), + corev1.PodTemplate{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodTemplate(ref), + corev1.PodTemplateList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodTemplateList(ref), + corev1.PodTemplateSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PodTemplateSpec(ref), + corev1.PortStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PortStatus(ref), + corev1.PortworxVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PortworxVolumeSource(ref), + corev1.PreferAvoidPodsEntry{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PreferAvoidPodsEntry(ref), + corev1.PreferredSchedulingTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_PreferredSchedulingTerm(ref), + corev1.Probe{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Probe(ref), + corev1.ProbeHandler{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ProbeHandler(ref), + corev1.ProjectedVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ProjectedVolumeSource(ref), + corev1.QuobyteVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_QuobyteVolumeSource(ref), + corev1.RBDPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_RBDPersistentVolumeSource(ref), + corev1.RBDVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_RBDVolumeSource(ref), + corev1.RangeAllocation{}.OpenAPIModelName(): schema_k8sio_api_core_v1_RangeAllocation(ref), + corev1.ReplicationController{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationController(ref), + corev1.ReplicationControllerCondition{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerCondition(ref), + corev1.ReplicationControllerList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerList(ref), + corev1.ReplicationControllerSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerSpec(ref), + corev1.ReplicationControllerStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ReplicationControllerStatus(ref), + corev1.ResourceClaim{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceClaim(ref), + corev1.ResourceFieldSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceFieldSelector(ref), + corev1.ResourceHealth{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceHealth(ref), + corev1.ResourceQuota{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuota(ref), + corev1.ResourceQuotaList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuotaList(ref), + corev1.ResourceQuotaSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuotaSpec(ref), + corev1.ResourceQuotaStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceQuotaStatus(ref), + corev1.ResourceRequirements{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceRequirements(ref), + corev1.ResourceStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ResourceStatus(ref), + corev1.SELinuxOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SELinuxOptions(ref), + corev1.ScaleIOPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScaleIOPersistentVolumeSource(ref), + corev1.ScaleIOVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScaleIOVolumeSource(ref), + corev1.ScopeSelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScopeSelector(ref), + corev1.ScopedResourceSelectorRequirement{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ScopedResourceSelectorRequirement(ref), + corev1.SeccompProfile{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SeccompProfile(ref), + corev1.Secret{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Secret(ref), + corev1.SecretEnvSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretEnvSource(ref), + corev1.SecretKeySelector{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretKeySelector(ref), + corev1.SecretList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretList(ref), + corev1.SecretProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretProjection(ref), + corev1.SecretReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretReference(ref), + corev1.SecretVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecretVolumeSource(ref), + corev1.SecurityContext{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SecurityContext(ref), + corev1.SerializedReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SerializedReference(ref), + corev1.Service{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Service(ref), + corev1.ServiceAccount{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceAccount(ref), + corev1.ServiceAccountList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceAccountList(ref), + corev1.ServiceAccountTokenProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceAccountTokenProjection(ref), + corev1.ServiceList{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceList(ref), + corev1.ServicePort{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServicePort(ref), + corev1.ServiceProxyOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceProxyOptions(ref), + corev1.ServiceSpec{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceSpec(ref), + corev1.ServiceStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_ServiceStatus(ref), + corev1.SessionAffinityConfig{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SessionAffinityConfig(ref), + corev1.SleepAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_SleepAction(ref), + corev1.StorageOSPersistentVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_StorageOSPersistentVolumeSource(ref), + corev1.StorageOSVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_StorageOSVolumeSource(ref), + corev1.Sysctl{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Sysctl(ref), + corev1.TCPSocketAction{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TCPSocketAction(ref), + corev1.Taint{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Taint(ref), + corev1.Toleration{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Toleration(ref), + corev1.TopologySelectorLabelRequirement{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TopologySelectorLabelRequirement(ref), + corev1.TopologySelectorTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TopologySelectorTerm(ref), + corev1.TopologySpreadConstraint{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TopologySpreadConstraint(ref), + corev1.TypedLocalObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TypedLocalObjectReference(ref), + corev1.TypedObjectReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_TypedObjectReference(ref), + corev1.Volume{}.OpenAPIModelName(): schema_k8sio_api_core_v1_Volume(ref), + corev1.VolumeDevice{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeDevice(ref), + corev1.VolumeMount{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeMount(ref), + corev1.VolumeMountStatus{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeMountStatus(ref), + corev1.VolumeNodeAffinity{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeNodeAffinity(ref), + corev1.VolumeProjection{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeProjection(ref), + corev1.VolumeResourceRequirements{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeResourceRequirements(ref), + corev1.VolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VolumeSource(ref), + corev1.VsphereVirtualDiskVolumeSource{}.OpenAPIModelName(): schema_k8sio_api_core_v1_VsphereVirtualDiskVolumeSource(ref), + corev1.WeightedPodAffinityTerm{}.OpenAPIModelName(): schema_k8sio_api_core_v1_WeightedPodAffinityTerm(ref), + corev1.WindowsSecurityContextOptions{}.OpenAPIModelName(): schema_k8sio_api_core_v1_WindowsSecurityContextOptions(ref), + corev1.WorkloadReference{}.OpenAPIModelName(): schema_k8sio_api_core_v1_WorkloadReference(ref), + rbacv1.AggregationRule{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_AggregationRule(ref), + rbacv1.ClusterRole{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRole(ref), + rbacv1.ClusterRoleBinding{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRoleBinding(ref), + rbacv1.ClusterRoleBindingList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRoleBindingList(ref), + rbacv1.ClusterRoleList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_ClusterRoleList(ref), + rbacv1.PolicyRule{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_PolicyRule(ref), + rbacv1.Role{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_Role(ref), + rbacv1.RoleBinding{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleBinding(ref), + rbacv1.RoleBindingList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleBindingList(ref), + rbacv1.RoleList{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleList(ref), + rbacv1.RoleRef{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_RoleRef(ref), + rbacv1.Subject{}.OpenAPIModelName(): schema_k8sio_api_rbac_v1_Subject(ref), + resource.Quantity{}.OpenAPIModelName(): schema_apimachinery_pkg_api_resource_Quantity(ref), + metav1.APIGroup{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIGroup(ref), + metav1.APIGroupList{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIGroupList(ref), + metav1.APIResource{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIResource(ref), + metav1.APIResourceList{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIResourceList(ref), + metav1.APIVersions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_APIVersions(ref), + metav1.ApplyOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ApplyOptions(ref), + metav1.Condition{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Condition(ref), + metav1.CreateOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_CreateOptions(ref), + metav1.DeleteOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_DeleteOptions(ref), + metav1.Duration{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Duration(ref), + metav1.FieldSelectorRequirement{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_FieldSelectorRequirement(ref), + metav1.FieldsV1{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_FieldsV1(ref), + metav1.GetOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GetOptions(ref), + metav1.GroupKind{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupKind(ref), + metav1.GroupResource{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupResource(ref), + metav1.GroupVersion{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersion(ref), + metav1.GroupVersionForDiscovery{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersionForDiscovery(ref), + metav1.GroupVersionKind{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersionKind(ref), + metav1.GroupVersionResource{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_GroupVersionResource(ref), + metav1.InternalEvent{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_InternalEvent(ref), + metav1.LabelSelector{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_LabelSelector(ref), + metav1.LabelSelectorRequirement{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_LabelSelectorRequirement(ref), + metav1.List{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_List(ref), + metav1.ListMeta{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ListMeta(ref), + metav1.ListOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ListOptions(ref), + metav1.ManagedFieldsEntry{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ManagedFieldsEntry(ref), + metav1.MicroTime{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_MicroTime(ref), + metav1.ObjectMeta{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ObjectMeta(ref), + metav1.OwnerReference{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_OwnerReference(ref), + metav1.PartialObjectMetadata{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_PartialObjectMetadata(ref), + metav1.PartialObjectMetadataList{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_PartialObjectMetadataList(ref), + metav1.Patch{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Patch(ref), + metav1.PatchOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_PatchOptions(ref), + metav1.Preconditions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Preconditions(ref), + metav1.RootPaths{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_RootPaths(ref), + metav1.ServerAddressByClientCIDR{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_ServerAddressByClientCIDR(ref), + metav1.Status{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Status(ref), + metav1.StatusCause{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_StatusCause(ref), + metav1.StatusDetails{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_StatusDetails(ref), + metav1.Table{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Table(ref), + metav1.TableColumnDefinition{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableColumnDefinition(ref), + metav1.TableOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableOptions(ref), + metav1.TableRow{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableRow(ref), + metav1.TableRowCondition{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TableRowCondition(ref), + metav1.Time{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Time(ref), + metav1.Timestamp{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_Timestamp(ref), + metav1.TypeMeta{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_TypeMeta(ref), + metav1.UpdateOptions{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_UpdateOptions(ref), + metav1.WatchEvent{}.OpenAPIModelName(): schema_pkg_apis_meta_v1_WatchEvent(ref), + runtime.RawExtension{}.OpenAPIModelName(): schema_k8sio_apimachinery_pkg_runtime_RawExtension(ref), + runtime.TypeMeta{}.OpenAPIModelName(): schema_k8sio_apimachinery_pkg_runtime_TypeMeta(ref), + runtime.Unknown{}.OpenAPIModelName(): schema_k8sio_apimachinery_pkg_runtime_Unknown(ref), + intstr.IntOrString{}.OpenAPIModelName(): schema_apimachinery_pkg_util_intstr_IntOrString(ref), } } @@ -9129,6 +9138,13 @@ func schema_openshift_api_config_v1_APIServerSpec(ref common.ReferenceCallback) Ref: ref("github.com/openshift/api/config/v1.TLSSecurityProfile"), }, }, + "tlsAdherence": { + SchemaProps: spec.SchemaProps{ + Description: "tlsAdherence controls if components in the cluster adhere to the TLS security profile configured on this APIServer resource.\n\nValid values are \"LegacyAdheringComponentsOnly\" and \"StrictAllComponents\".\n\nWhen set to \"LegacyAdheringComponentsOnly\", components that already honor the cluster-wide TLS profile continue to do so. Components that do not already honor it continue to use their individual TLS configurations.\n\nWhen set to \"StrictAllComponents\", all components must honor the configured TLS profile unless they have a component-specific TLS configuration that overrides it. This mode is recommended for security-conscious deployments and is required for certain compliance frameworks.\n\nNote: Some components such as Kubelet and IngressController have their own dedicated TLS configuration mechanisms via KubeletConfig and IngressController CRs respectively. When these component-specific TLS configurations are set, they take precedence over the cluster-wide tlsSecurityProfile. When not set, these components fall back to the cluster-wide default.\n\nComponents that encounter an unknown value for tlsAdherence should treat it as \"StrictAllComponents\" and log a warning to ensure forward compatibility while defaulting to the more secure behavior.\n\nThis field is optional. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default is LegacyAdheringComponentsOnly.\n\nOnce set, this field may be changed to a different value, but may not be removed.", + Type: []string{"string"}, + Format: "", + }, + }, "audit": { SchemaProps: spec.SchemaProps{ Description: "audit specifies the settings for audit configuration to be applied to all OpenShift-provided API servers in the cluster.", @@ -9163,7 +9179,7 @@ func schema_openshift_api_config_v1_AWSDNSSpec(ref common.ReferenceCallback) com Properties: map[string]spec.Schema{ "privateZoneIAMRole": { SchemaProps: spec.SchemaProps{ - Description: "privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed.", + Description: "privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed.\n\nThe ARN must follow the format: arn::iam:::role/, where: is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), is a 12-digit numeric identifier for the AWS account, is the IAM role name.", Default: "", Type: []string{"string"}, Format: "", @@ -13791,9 +13807,23 @@ func schema_openshift_api_config_v1_GenericControllerConfig(ref common.Reference return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "GenericControllerConfig provides information to configure a controller", + Description: "GenericControllerConfig provides information to configure a controller\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", Type: []string{"object"}, Properties: map[string]spec.Schema{ + "kind": { + SchemaProps: spec.SchemaProps{ + Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + Type: []string{"string"}, + Format: "", + }, + }, + "apiVersion": { + SchemaProps: spec.SchemaProps{ + Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + Type: []string{"string"}, + Format: "", + }, + }, "servingInfo": { SchemaProps: spec.SchemaProps{ Description: "servingInfo is the HTTP serving information for the controller's endpoints", @@ -15756,7 +15786,7 @@ func schema_openshift_api_config_v1_InfrastructureStatus(ref common.ReferenceCal }, "controlPlaneTopology": { SchemaProps: spec.SchemaProps{ - Description: "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster.", + Description: "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.", Default: "", Type: []string{"string"}, Format: "", @@ -19620,7 +19650,7 @@ func schema_openshift_api_config_v1_PrefixedClaimMapping(ref common.ReferenceCal }, "prefix": { SchemaProps: spec.SchemaProps{ - Description: "prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.\n\nWhen omitted (\"\"), no prefix is applied to the cluster identity attribute.\n\nExample: if `prefix` is set to \"myoidc:\" and the `claim` in JWT contains an array of strings \"a\", \"b\" and \"c\", the mapping will result in an array of string \"myoidc:a\", \"myoidc:b\" and \"myoidc:c\".", + Description: "prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.\n\nWhen omitted or set to an empty string (\"\"), no prefix is applied to the cluster identity attribute. Must not be set to a non-empty value when expression is set.\n\nExample: if `prefix` is set to \"myoidc:\" and the `claim` in JWT contains an array of strings \"a\", \"b\" and \"c\", the mapping will result in an array of string \"myoidc:a\", \"myoidc:b\" and \"myoidc:c\".", Default: "", Type: []string{"string"}, Format: "", @@ -21523,6 +21553,14 @@ func schema_openshift_api_config_v1_Update(ref common.ReferenceCallback) common. }, }, }, + "mode": { + SchemaProps: spec.SchemaProps{ + Description: "mode determines how an update should be processed. The only valid value is \"Preflight\". When omitted, the cluster performs a normal update by applying the specified version or image to the cluster. This is the standard update behavior. When set to \"Preflight\", the cluster runs compatibility checks against the target release without performing an actual update. Compatibility results, including any detected risks, are reported in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update recommendation service. This allows administrators to assess update readiness and address issues before committing to the update. Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be verified across multiple minor versions. When mode is set to \"Preflight\", the same rules for version, image, and architecture apply as for normal updates.\n\nPossible enum values:\n - `\"Preflight\"` allows an update to be checked for compatibility without committing to updating the cluster.", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"Preflight"}, + }, + }, }, }, }, @@ -21620,7 +21658,7 @@ func schema_openshift_api_config_v1_UsernameClaimMapping(ref common.ReferenceCal }, "prefixPolicy": { SchemaProps: spec.SchemaProps{ - Description: "prefixPolicy is an optional field that configures how a prefix should be applied to the value of the JWT claim specified in the 'claim' field.\n\nAllowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).\n\nWhen set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.\n\nThe prefix field must be set when prefixPolicy is 'Prefix'.\n\nWhen set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.\n\nWhen omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.\n\nAs an example, consider the following scenario:\n\n `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,\n the JWT claims include \"username\":\"userA\" and \"email\":\"userA@myoidc.tld\",\n and `claim` is set to:\n - \"username\": the mapped value will be \"https://myoidc.tld#userA\"\n - \"email\": the mapped value will be \"userA@myoidc.tld\"", + Description: "prefixPolicy is an optional field that configures how a prefix should be applied to the value of the JWT claim specified in the 'claim' field.\n\nAllowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).\n\nWhen set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. The prefix field must be set when prefixPolicy is 'Prefix'. Must not be set to 'Prefix' when expression is set. When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.\n\nAs an example, consider the following scenario:\n\n `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,\n the JWT claims include \"username\":\"userA\" and \"email\":\"userA@myoidc.tld\",\n and `claim` is set to:\n - \"username\": the mapped value will be \"https://myoidc.tld#userA\"\n - \"email\": the mapped value will be \"userA@myoidc.tld\"", Default: "", Type: []string{"string"}, Format: "", @@ -22364,6 +22402,84 @@ func schema_openshift_api_config_v1_WebhookTokenAuthenticator(ref common.Referen } } +func schema_openshift_api_config_v1alpha1_AdditionalAlertmanagerConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "AdditionalAlertmanagerConfig represents configuration for additional Alertmanager instances. The `AdditionalAlertmanagerConfig` resource defines settings for how a component communicates with additional Alertmanager instances.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is a unique identifier for this Alertmanager configuration entry. The name must be a valid DNS subdomain (RFC 1123): lowercase alphanumeric characters, hyphens, or periods, and must start and end with an alphanumeric character. Minimum length is 1 character (empty string is invalid). Maximum length is 253 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + "authorization": { + SchemaProps: spec.SchemaProps{ + Description: "authorization configures the authentication method for Alertmanager connections. Supports bearer token authentication. When omitted, no authentication is used.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.AuthorizationConfig"), + }, + }, + "pathPrefix": { + SchemaProps: spec.SchemaProps{ + Description: "pathPrefix defines an optional URL path prefix to prepend to the Alertmanager API endpoints. For example, if your Alertmanager is behind a reverse proxy at \"/alertmanager/\", set this to \"/alertmanager\" so requests go to \"/alertmanager/api/v1/alerts\" instead of \"/api/v1/alerts\". This is commonly needed when Alertmanager is deployed behind ingress controllers or load balancers. When no prefix is needed, omit this field; do not set it to \"/\" as that would produce paths with double slashes (e.g. \"//api/v1/alerts\"). Must start with \"/\", must not end with \"/\", and must not be exactly \"/\". Must not contain query strings (\"?\") or fragments (\"#\").", + Type: []string{"string"}, + Format: "", + }, + }, + "scheme": { + SchemaProps: spec.SchemaProps{ + Description: "scheme defines the URL scheme to use when communicating with Alertmanager instances. Possible values are `HTTP` or `HTTPS`. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default value is `HTTP`.", + Type: []string{"string"}, + Format: "", + }, + }, + "staticConfigs": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "set", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "staticConfigs is a list of statically configured Alertmanager endpoints in the form of `:`. Each entry must be a valid hostname, IPv4 address, or IPv6 address (in brackets) followed by a colon and a valid port number (1-65535). Examples: \"alertmanager.example.com:9093\", \"192.168.1.100:9093\", \"[::1]:9093\" At least one endpoint must be specified (minimum 1, maximum 10 endpoints). Each entry must be unique and non-empty (empty string is invalid).", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "timeoutSeconds": { + SchemaProps: spec.SchemaProps{ + Description: "timeoutSeconds defines the timeout in seconds for requests to Alertmanager. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Currently the default is 10 seconds. Minimum value is 1 second. Maximum value is 600 seconds (10 minutes).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "tlsConfig": { + SchemaProps: spec.SchemaProps{ + Description: "tlsConfig defines the TLS settings to use for Alertmanager connections. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.TLSConfig"), + }, + }, + }, + Required: []string{"name", "staticConfigs"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.AuthorizationConfig", "github.com/openshift/api/config/v1alpha1.TLSConfig"}, + } +} + func schema_openshift_api_config_v1alpha1_AlertmanagerConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -22434,7 +22550,7 @@ func schema_openshift_api_config_v1alpha1_AlertmanagerCustomConfig(ref common.Re }, }, SchemaProps: spec.SchemaProps{ - Description: "resources defines the compute resource requests and limits for the Alertmanager container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + Description: "resources defines the compute resource requests and limits for the Alertmanager container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ @@ -22510,7 +22626,7 @@ func schema_openshift_api_config_v1alpha1_AlertmanagerCustomConfig(ref common.Re }, "volumeClaimTemplate": { SchemaProps: spec.SchemaProps{ - Description: "volumeClaimTemplate Defines persistent storage for Alertmanager. Use this setting to configure the persistent volume claim, including storage class, volume size, and name. If omitted, the Pod uses ephemeral storage and alert data will not persist across restarts. This field is optional.", + Description: "volumeClaimTemplate defines persistent storage for Alertmanager. Use this setting to configure the persistent volume claim, including storage class and volume size. If omitted, the Pod uses ephemeral storage and alert data will not persist across restarts.", Ref: ref(corev1.PersistentVolumeClaim{}.OpenAPIModelName()), }, }, @@ -22543,6 +22659,48 @@ func schema_openshift_api_config_v1alpha1_Audit(ref common.ReferenceCallback) co } } +func schema_openshift_api_config_v1alpha1_AuthorizationConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "AuthorizationConfig defines the authentication method for Alertmanager connections.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "type": { + SchemaProps: spec.SchemaProps{ + Description: "type specifies the authentication type to use. Valid value is \"BearerToken\" (bearer token authentication). When set to BearerToken, the bearerToken field must be specified.", + Type: []string{"string"}, + Format: "", + }, + }, + "bearerToken": { + SchemaProps: spec.SchemaProps{ + Description: "bearerToken defines the secret reference containing the bearer token. Required when type is \"BearerToken\", and forbidden otherwise. The secret must exist in the openshift-monitoring namespace.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + }, + Required: []string{"type"}, + }, + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-unions": []interface{}{ + map[string]interface{}{ + "discriminator": "type", + "fields-to-discriminateBy": map[string]interface{}{ + "bearerToken": "BearerToken", + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.SecretKeySelector"}, + } +} + func schema_openshift_api_config_v1alpha1_Backup(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -22676,203 +22834,41 @@ func schema_openshift_api_config_v1alpha1_BackupStatus(ref common.ReferenceCallb } } -func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is \"cluster\". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.\n\nThe resource is a singleton named \"cluster\".\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - Default: map[string]interface{}{}, - Ref: ref(metav1.ObjectMeta{}.OpenAPIModelName()), - }, - }, - "spec": { - SchemaProps: spec.SchemaProps{ - Description: "spec defines the desired configuration of the CRI-O Credential Provider. This field is required and must be provided when creating the resource.", - Ref: ref("github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigSpec"), - }, - }, - "status": { - SchemaProps: spec.SchemaProps{ - Description: "status represents the current state of the CRIOCredentialProviderConfig. When omitted or nil, it indicates that the status has not yet been set by the controller. The controller will populate this field with validation conditions and operational state.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigStatus"), - }, - }, - }, - Required: []string{"spec"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigSpec", "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigList(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_BasicAuth(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + Description: "BasicAuth defines basic authentication settings for the remote write endpoint URL.", Type: []string{"object"}, Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { + "username": { SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + Description: "username defines the secret reference containing the username for basic authentication. The secret must exist in the openshift-monitoring namespace.", Default: map[string]interface{}{}, - Ref: ref(metav1.ListMeta{}.OpenAPIModelName()), + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), }, }, - "items": { + "password": { SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfig"), - }, - }, - }, - }, - }, - }, - Required: []string{"metadata", "items"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfig", metav1.ListMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "matchImages": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-type": "set", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "matchImages is a list of string patterns used to determine whether the CRI-O credential provider should be invoked for a given image. This list is passed to the kubelet CredentialProviderConfig, and if any pattern matches the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling that image or its mirrors. Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. Conflicts between the existing platform specific provider image match configuration and this list will be handled by the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those from the CRIOCredentialProviderConfig when both match the same image. To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). You can check the resource's Status conditions to see if any entries were ignored due to exact matches with known built-in provider patterns.\n\nThis field is optional, the items of the list must contain between 1 and 50 entries. The list is treated as a set, so duplicate entries are not allowed.\n\nFor more details, see: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ https://github.com/cri-o/crio-credential-provider#architecture\n\nEach entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). A global wildcard '*' (matching any domain) is not allowed. Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. Each wildcard matches only a single domain label, so '*.io' does **not** match '*.k8s.io'.\n\nA match exists between an image and a matchImage when all of the below are true: Both contain the same number of domain parts and each part matches. The URL path of an matchImages must be a prefix of the target image URL path. If the matchImages contains a port, then the port must match in the image as well.\n\nExample values of matchImages: - 123456789.dkr.ecr.us-east-1.amazonaws.com - *.azurecr.io - gcr.io - *.*.registry.io - registry.io:8080/path", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - }, - }, - }, - } -} - -func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "conditions": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ - "type", - }, - "x-kubernetes-list-type": "map", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "conditions represent the latest available observations of the configuration state. When omitted, it indicates that no conditions have been reported yet. The maximum number of conditions is 16. Conditions are stored as a map keyed by condition type, ensuring uniqueness.\n\nExpected condition types include: \"Validated\": indicates whether the matchImages configuration is valid", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(metav1.Condition{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - }, - }, - Dependencies: []string{ - metav1.Condition{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_CertificateConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "CertificateConfig specifies configuration parameters for certificates. At least one property must be specified.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "key": { - SchemaProps: spec.SchemaProps{ - Description: "key specifies the cryptographic parameters for the certificate's key pair. Currently this is the only configurable parameter. When omitted in an overrides entry, the key configuration from defaults is used.", + Description: "password defines the secret reference containing the password for basic authentication. The secret must exist in the openshift-monitoring namespace.", Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.KeyConfig"), + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), }, }, }, + Required: []string{"username", "password"}, }, }, Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.KeyConfig"}, + "github.com/openshift/api/config/v1alpha1.SecretKeySelector"}, } } -func schema_openshift_api_config_v1alpha1_ClusterImagePolicy(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "ClusterImagePolicy holds cluster-wide configuration for image signature verification\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + Description: "CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is \"cluster\". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.\n\nThe resource is a singleton named \"cluster\".\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", Type: []string{"object"}, Properties: map[string]spec.Schema{ "kind": { @@ -22898,16 +22894,15 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicy(ref common.Referenc }, "spec": { SchemaProps: spec.SchemaProps{ - Description: "spec contains the configuration for the cluster image policy.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ClusterImagePolicySpec"), + Description: "spec defines the desired configuration of the CRI-O Credential Provider. This field is required and must be provided when creating the resource.", + Ref: ref("github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigSpec"), }, }, "status": { SchemaProps: spec.SchemaProps{ - Description: "status contains the observed state of the resource.", + Description: "status represents the current state of the CRIOCredentialProviderConfig. When omitted or nil, it indicates that the status has not yet been set by the controller. The controller will populate this field with validation conditions and operational state.", Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ClusterImagePolicyStatus"), + Ref: ref("github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigStatus"), }, }, }, @@ -22915,15 +22910,15 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicy(ref common.Referenc }, }, Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ClusterImagePolicySpec", "github.com/openshift/api/config/v1alpha1.ClusterImagePolicyStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, + "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigSpec", "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfigStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, } } -func schema_openshift_api_config_v1alpha1_ClusterImagePolicyList(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigList(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "ClusterImagePolicyList is a list of ClusterImagePolicy resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + Description: "CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", Type: []string{"object"}, Properties: map[string]spec.Schema{ "kind": { @@ -22954,7 +22949,7 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicyList(ref common.Refe Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ClusterImagePolicy"), + Ref: ref("github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfig"), }, }, }, @@ -22965,25 +22960,25 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicyList(ref common.Refe }, }, Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ClusterImagePolicy", metav1.ListMeta{}.OpenAPIModelName()}, + "github.com/openshift/api/config/v1alpha1.CRIOCredentialProviderConfig", metav1.ListMeta{}.OpenAPIModelName()}, } } -func schema_openshift_api_config_v1alpha1_ClusterImagePolicySpec(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "CLusterImagePolicySpec is the specification of the ClusterImagePolicy custom resource.", + Description: "CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider.", Type: []string{"object"}, Properties: map[string]spec.Schema{ - "scopes": { + "matchImages": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ "x-kubernetes-list-type": "set", }, }, SchemaProps: spec.SchemaProps{ - Description: "scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the \"Docker Registry HTTP API V2\". Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. For additional details about the format, please refer to the document explaining the docker transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker", + Description: "matchImages is a list of string patterns used to determine whether the CRI-O credential provider should be invoked for a given image. This list is passed to the kubelet CredentialProviderConfig, and if any pattern matches the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling that image or its mirrors. Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. Conflicts between the existing platform specific provider image match configuration and this list will be handled by the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those from the CRIOCredentialProviderConfig when both match the same image. To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). You can check the resource's Status conditions to see if any entries were ignored due to exact matches with known built-in provider patterns.\n\nThis field is optional, the items of the list must contain between 1 and 50 entries. The list is treated as a set, so duplicate entries are not allowed.\n\nFor more details, see: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ https://github.com/cri-o/crio-credential-provider#architecture\n\nEach entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). A global wildcard '*' (matching any domain) is not allowed. Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. Each wildcard matches only a single domain label, so '*.io' does **not** match '*.k8s.io'.\n\nA match exists between an image and a matchImage when all of the below are true: Both contain the same number of domain parts and each part matches. The URL path of an matchImages must be a prefix of the target image URL path. If the matchImages contains a port, then the port must match in the image as well.\n\nExample values of matchImages: - 123456789.dkr.ecr.us-east-1.amazonaws.com - *.azurecr.io - gcr.io - *.*.registry.io - registry.io:8080/path", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ @@ -22996,27 +22991,18 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicySpec(ref common.Refe }, }, }, - "policy": { - SchemaProps: spec.SchemaProps{ - Description: "policy contains configuration to allow scopes to be verified, and defines how images not matching the verification policy will be treated.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ImageSigstoreVerificationPolicy"), - }, - }, }, - Required: []string{"scopes", "policy"}, }, }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ImageSigstoreVerificationPolicy"}, } } -func schema_openshift_api_config_v1alpha1_ClusterImagePolicyStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_CRIOCredentialProviderConfigStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, + Description: "CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig", + Type: []string{"object"}, Properties: map[string]spec.Schema{ "conditions": { VendorExtensible: spec.VendorExtensible{ @@ -23028,7 +23014,7 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicyStatus(ref common.Re }, }, SchemaProps: spec.SchemaProps{ - Description: "conditions provide details on the status of this API Resource.", + Description: "conditions represent the latest available observations of the configuration state. When omitted, it indicates that no conditions have been reported yet. The maximum number of conditions is 16. Conditions are stored as a map keyed by condition type, ensuring uniqueness.\n\nExpected condition types include: \"Validated\": indicates whether the matchImages configuration is valid", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ @@ -23048,6 +23034,28 @@ func schema_openshift_api_config_v1alpha1_ClusterImagePolicyStatus(ref common.Re } } +func schema_openshift_api_config_v1alpha1_CertificateConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "CertificateConfig specifies configuration parameters for certificates. At least one property must be specified.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "key": { + SchemaProps: spec.SchemaProps{ + Description: "key specifies the cryptographic parameters for the certificate's key pair. Currently this is the only configurable parameter. When omitted in an overrides entry, the key configuration from defaults is used.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.KeyConfig"), + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.KeyConfig"}, + } +} + func schema_openshift_api_config_v1alpha1_ClusterMonitoring(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -23170,6 +23178,13 @@ func schema_openshift_api_config_v1alpha1_ClusterMonitoringSpec(ref common.Refer Ref: ref("github.com/openshift/api/config/v1alpha1.AlertmanagerConfig"), }, }, + "prometheusConfig": { + SchemaProps: spec.SchemaProps{ + Description: "prometheusConfig provides configuration options for the default platform Prometheus instance that runs in the `openshift-monitoring` namespace. This configuration applies only to the platform Prometheus instance; user-workload Prometheus instances are configured separately.\n\nThis field allows you to customize how the platform Prometheus is deployed and operated, including:\n - Pod scheduling (node selectors, tolerations, topology spread constraints)\n - Resource allocation (CPU, memory requests/limits)\n - Retention policies (how long metrics are stored)\n - External integrations (remote write, additional alertmanagers)\n\nThis field is optional. When omitted, the platform chooses reasonable defaults, which may change over time.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.PrometheusConfig"), + }, + }, "metricsServerConfig": { SchemaProps: spec.SchemaProps{ Description: "metricsServerConfig is an optional field that can be used to configure the Kubernetes Metrics Server that runs in the openshift-monitoring namespace. Specifically, it can configure how the Metrics Server instance is deployed, pod scheduling, its audit policy and log verbosity. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", @@ -23191,11 +23206,32 @@ func schema_openshift_api_config_v1alpha1_ClusterMonitoringSpec(ref common.Refer Ref: ref("github.com/openshift/api/config/v1alpha1.PrometheusOperatorAdmissionWebhookConfig"), }, }, + "openShiftStateMetricsConfig": { + SchemaProps: spec.SchemaProps{ + Description: "openShiftStateMetricsConfig is an optional field that can be used to configure the openshift-state-metrics agent that runs in the openshift-monitoring namespace. The openshift-state-metrics agent generates metrics about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.OpenShiftStateMetricsConfig"), + }, + }, + "telemeterClientConfig": { + SchemaProps: spec.SchemaProps{ + Description: "telemeterClientConfig is an optional field that can be used to configure the Telemeter Client component that runs in the openshift-monitoring namespace. The Telemeter Client collects selected monitoring metrics and forwards them to Red Hat for telemetry purposes. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. When set, at least one field must be specified within telemeterClientConfig.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.TelemeterClientConfig"), + }, + }, + "thanosQuerierConfig": { + SchemaProps: spec.SchemaProps{ + Description: "thanosQuerierConfig is an optional field that can be used to configure the Thanos Querier component that runs in the openshift-monitoring namespace. The Thanos Querier provides a global query view by aggregating and deduplicating metrics from multiple Prometheus instances. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default deploys the Thanos Querier on linux nodes with 5m CPU and 12Mi memory requests, and no custom tolerations or topology spread constraints. When set, at least one field must be specified within thanosQuerierConfig.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ThanosQuerierConfig"), + }, + }, }, }, }, Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.AlertmanagerConfig", "github.com/openshift/api/config/v1alpha1.MetricsServerConfig", "github.com/openshift/api/config/v1alpha1.PrometheusOperatorAdmissionWebhookConfig", "github.com/openshift/api/config/v1alpha1.PrometheusOperatorConfig", "github.com/openshift/api/config/v1alpha1.UserDefinedMonitoring"}, + "github.com/openshift/api/config/v1alpha1.AlertmanagerConfig", "github.com/openshift/api/config/v1alpha1.MetricsServerConfig", "github.com/openshift/api/config/v1alpha1.OpenShiftStateMetricsConfig", "github.com/openshift/api/config/v1alpha1.PrometheusConfig", "github.com/openshift/api/config/v1alpha1.PrometheusOperatorAdmissionWebhookConfig", "github.com/openshift/api/config/v1alpha1.PrometheusOperatorConfig", "github.com/openshift/api/config/v1alpha1.TelemeterClientConfig", "github.com/openshift/api/config/v1alpha1.ThanosQuerierConfig", "github.com/openshift/api/config/v1alpha1.UserDefinedMonitoring"}, } } @@ -23226,7 +23262,7 @@ func schema_openshift_api_config_v1alpha1_ContainerResource(ref common.Reference }, "request": { SchemaProps: spec.SchemaProps{ - Description: "request is the minimum amount of the resource required (e.g. \"2Mi\", \"1Gi\"). This field is optional. When limit is specified, request cannot be greater than limit.", + Description: "request is the minimum amount of the resource required (e.g. \"2Mi\", \"1Gi\"). This field is optional. When limit is specified, request cannot be greater than limit. The value must be greater than 0 when specified.", Ref: ref(resource.Quantity{}.OpenAPIModelName()), }, }, @@ -23312,6 +23348,27 @@ func schema_openshift_api_config_v1alpha1_DefaultCertificateConfig(ref common.Re } } +func schema_openshift_api_config_v1alpha1_DropEqualActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "DropEqualActionConfig configures the DropEqual action. Drops targets for which the concatenated source_labels do match the value of target_label. Requires Prometheus >= v2.41.0.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "targetLabel": { + SchemaProps: spec.SchemaProps{ + Description: "targetLabel is the label name whose value is compared to the concatenated source_labels; targets that match are dropped. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"targetLabel"}, + }, + }, + } +} + func schema_openshift_api_config_v1alpha1_ECDSAKeyConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -23427,315 +23484,31 @@ func schema_openshift_api_config_v1alpha1_GatherConfig(ref common.ReferenceCallb } } -func schema_openshift_api_config_v1alpha1_ImagePolicy(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_HashModActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "ImagePolicy holds namespace-wide configuration for image signature verification\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + Description: "HashModActionConfig configures the HashMod action. target_label is set to the modulus of a hash of the concatenated source_labels (target = hash % modulus).", Type: []string{"object"}, Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - Default: map[string]interface{}{}, - Ref: ref(metav1.ObjectMeta{}.OpenAPIModelName()), - }, - }, - "spec": { - SchemaProps: spec.SchemaProps{ - Description: "spec holds user settable values for configuration", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ImagePolicySpec"), - }, - }, - "status": { - SchemaProps: spec.SchemaProps{ - Description: "status contains the observed state of the resource.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ImagePolicyStatus"), - }, - }, - }, - Required: []string{"spec"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ImagePolicySpec", "github.com/openshift/api/config/v1alpha1.ImagePolicyStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_ImagePolicyFulcioCAWithRekorRootOfTrust(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "ImagePolicyFulcioCAWithRekorRootOfTrust defines the root of trust based on the Fulcio certificate and the Rekor public key.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "fulcioCAData": { - SchemaProps: spec.SchemaProps{ - Description: "fulcioCAData contains inline base64-encoded data for the PEM format fulcio CA. fulcioCAData must be at most 8192 characters.", - Type: []string{"string"}, - Format: "byte", - }, - }, - "rekorKeyData": { - SchemaProps: spec.SchemaProps{ - Description: "rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. rekorKeyData must be at most 8192 characters.", - Type: []string{"string"}, - Format: "byte", - }, - }, - "fulcioSubject": { - SchemaProps: spec.SchemaProps{ - Description: "fulcioSubject specifies OIDC issuer and the email of the Fulcio authentication configuration.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.PolicyFulcioSubject"), - }, - }, - }, - Required: []string{"fulcioCAData", "rekorKeyData", "fulcioSubject"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.PolicyFulcioSubject"}, - } -} - -func schema_openshift_api_config_v1alpha1_ImagePolicyList(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "ImagePolicyList is a list of ImagePolicy resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { + "targetLabel": { SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + Description: "targetLabel is the label name where the hash modulus result is written. Must be between 1 and 128 characters in length.", Type: []string{"string"}, Format: "", }, }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - Default: map[string]interface{}{}, - Ref: ref(metav1.ListMeta{}.OpenAPIModelName()), - }, - }, - "items": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ImagePolicy"), - }, - }, - }, - }, - }, - }, - Required: []string{"metadata", "items"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ImagePolicy", metav1.ListMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_ImagePolicyPKIRootOfTrust(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "ImagePolicyPKIRootOfTrust defines the root of trust based on Root CA(s) and corresponding intermediate certificates.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "caRootsData": { - SchemaProps: spec.SchemaProps{ - Description: "caRootsData contains base64-encoded data of a certificate bundle PEM file, which contains one or more CA roots in the PEM format. The total length of the data must not exceed 8192 characters.", - Type: []string{"string"}, - Format: "byte", - }, - }, - "caIntermediatesData": { - SchemaProps: spec.SchemaProps{ - Description: "caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters. caIntermediatesData requires caRootsData to be set.", - Type: []string{"string"}, - Format: "byte", - }, - }, - "pkiCertificateSubject": { - SchemaProps: spec.SchemaProps{ - Description: "pkiCertificateSubject defines the requirements imposed on the subject to which the certificate was issued.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.PKICertificateSubject"), - }, - }, - }, - Required: []string{"caRootsData", "pkiCertificateSubject"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.PKICertificateSubject"}, - } -} - -func schema_openshift_api_config_v1alpha1_ImagePolicyPublicKeyRootOfTrust(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "ImagePolicyPublicKeyRootOfTrust defines the root of trust based on a sigstore public key.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "keyData": { - SchemaProps: spec.SchemaProps{ - Description: "keyData contains inline base64-encoded data for the PEM format public key. KeyData must be at most 8192 characters.", - Type: []string{"string"}, - Format: "byte", - }, - }, - "rekorKeyData": { - SchemaProps: spec.SchemaProps{ - Description: "rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. rekorKeyData must be at most 8192 characters.", - Type: []string{"string"}, - Format: "byte", - }, - }, - }, - Required: []string{"keyData"}, - }, - }, - } -} - -func schema_openshift_api_config_v1alpha1_ImagePolicySpec(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "ImagePolicySpec is the specification of the ImagePolicy CRD.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "scopes": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-type": "set", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the \"Docker Registry HTTP API V2\". Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. For additional details about the format, please refer to the document explaining the docker transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - "policy": { - SchemaProps: spec.SchemaProps{ - Description: "policy contains configuration to allow scopes to be verified, and defines how images not matching the verification policy will be treated.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ImageSigstoreVerificationPolicy"), - }, - }, - }, - Required: []string{"scopes", "policy"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ImageSigstoreVerificationPolicy"}, - } -} - -func schema_openshift_api_config_v1alpha1_ImagePolicyStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "conditions": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ - "type", - }, - "x-kubernetes-list-type": "map", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "conditions provide details on the status of this API Resource.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(metav1.Condition{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - }, - }, - Dependencies: []string{ - metav1.Condition{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_ImageSigstoreVerificationPolicy(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "ImageSigstoreVerificationPolicy defines the verification policy for the items in the scopes list.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "rootOfTrust": { - SchemaProps: spec.SchemaProps{ - Description: "rootOfTrust specifies the root of trust for the policy.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.PolicyRootOfTrust"), - }, - }, - "signedIdentity": { + "modulus": { SchemaProps: spec.SchemaProps{ - Description: "signedIdentity specifies what image identity the signature claims about the image. The required matchPolicy field specifies the approach used in the verification process to verify the identity in the signature and the actual image identity, the default matchPolicy is \"MatchRepoDigestOrExact\".", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.PolicyIdentity"), + Description: "modulus is the divisor applied to the hash of the concatenated source label values (target = hash % modulus). Required when using the HashMod action so the intended behavior is explicit. Must be between 1 and 1000000.", + Type: []string{"integer"}, + Format: "int64", }, }, }, - Required: []string{"rootOfTrust"}, + Required: []string{"targetLabel", "modulus"}, }, }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.PolicyIdentity", "github.com/openshift/api/config/v1alpha1.PolicyRootOfTrust"}, } } @@ -23871,6 +23644,27 @@ func schema_openshift_api_config_v1alpha1_InsightsDataGatherStatus(ref common.Re } } +func schema_openshift_api_config_v1alpha1_KeepEqualActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "KeepEqualActionConfig configures the KeepEqual action. Drops targets for which the concatenated source_labels do not match the value of target_label. Requires Prometheus >= v2.41.0.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "targetLabel": { + SchemaProps: spec.SchemaProps{ + Description: "targetLabel is the label name whose value is compared to the concatenated source_labels; targets that do not match are dropped. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"targetLabel"}, + }, + }, + } +} + func schema_openshift_api_config_v1alpha1_KeyConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -23921,6 +23715,126 @@ func schema_openshift_api_config_v1alpha1_KeyConfig(ref common.ReferenceCallback } } +func schema_openshift_api_config_v1alpha1_Label(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "Label represents a key/value pair for external labels.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "key": { + SchemaProps: spec.SchemaProps{ + Description: "key is the name of the label. Prometheus supports UTF-8 label names, so any valid UTF-8 string is allowed. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "value": { + SchemaProps: spec.SchemaProps{ + Description: "value is the value of the label. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"key", "value"}, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_LabelMapActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "LabelMapActionConfig configures the LabelMap action. Regex is matched against all source label names (not just source_labels). Matching label values are copied to new label names given by replacement, with match group references (${1}, ${2}, ...) substituted.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "replacement": { + SchemaProps: spec.SchemaProps{ + Description: "replacement is the template for new label names; match group references (${1}, ${2}, ...) are substituted from the matched label name. Required when using the LabelMap action so the intended behavior is explicit and the platform does not need to apply defaults. Use \"$1\" for the first capture group, \"$2\" for the second, etc. Must be between 1 and 255 characters in length. Empty string is invalid as it would produce invalid label names.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"replacement"}, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_LowercaseActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "LowercaseActionConfig configures the Lowercase action. Maps the concatenated source_labels to their lower case and writes to target_label. Requires Prometheus >= v2.36.0.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "targetLabel": { + SchemaProps: spec.SchemaProps{ + Description: "targetLabel is the label name where the lower-cased value is written. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"targetLabel"}, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_MetadataConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "MetadataConfig defines whether and how to send series metadata to remote write storage.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "sendPolicy": { + SchemaProps: spec.SchemaProps{ + Description: "sendPolicy specifies whether to send metadata and how it is configured. Default: send metadata using platform-chosen defaults (e.g. send interval 30 seconds). Custom: send metadata using the settings in the custom field.", + Type: []string{"string"}, + Format: "", + }, + }, + "custom": { + SchemaProps: spec.SchemaProps{ + Description: "custom defines custom metadata send settings. Required when sendPolicy is Custom (must have at least one property), and forbidden when sendPolicy is Default.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.MetadataConfigCustom"), + }, + }, + }, + Required: []string{"sendPolicy"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.MetadataConfigCustom"}, + } +} + +func schema_openshift_api_config_v1alpha1_MetadataConfigCustom(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "MetadataConfigCustom defines custom settings for sending series metadata when sendPolicy is Custom. At least one property must be set when sendPolicy is Custom (e.g. sendIntervalSeconds).", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "sendIntervalSeconds": { + SchemaProps: spec.SchemaProps{ + Description: "sendIntervalSeconds is the interval in seconds at which metadata is sent. When omitted, the platform chooses a reasonable default (e.g. 30 seconds). Minimum value is 1 second. Maximum value is 86400 seconds (24 hours).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + }, + }, + }, + } +} + func schema_openshift_api_config_v1alpha1_MetricsServerConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -23987,7 +23901,7 @@ func schema_openshift_api_config_v1alpha1_MetricsServerConfig(ref common.Referen }, }, SchemaProps: spec.SchemaProps{ - Description: "resources defines the compute resource requests and limits for the Metrics Server container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + Description: "resources defines the compute resource requests and limits for the Metrics Server container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ @@ -24030,6 +23944,208 @@ func schema_openshift_api_config_v1alpha1_MetricsServerConfig(ref common.Referen } } +func schema_openshift_api_config_v1alpha1_OAuth2(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "OAuth2 defines OAuth2 authentication settings for the remote write endpoint.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "clientId": { + SchemaProps: spec.SchemaProps{ + Description: "clientId defines the secret reference containing the OAuth2 client ID. The secret must exist in the openshift-monitoring namespace.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "clientSecret": { + SchemaProps: spec.SchemaProps{ + Description: "clientSecret defines the secret reference containing the OAuth2 client secret. The secret must exist in the openshift-monitoring namespace.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "tokenUrl": { + SchemaProps: spec.SchemaProps{ + Description: "tokenUrl is the URL to fetch the token from. Must be a valid URL with http or https scheme. Must be between 1 and 2048 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "scopes": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "scopes is a list of OAuth2 scopes to request. When omitted, no scopes are requested. Maximum of 20 scopes can be specified. Each scope must be between 1 and 256 characters.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "endpointParams": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "endpointParams defines additional parameters to append to the token URL. When omitted, no additional parameters are sent. Maximum of 20 parameters can be specified. Entries must have unique names (name is the list key).", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.OAuth2EndpointParam"), + }, + }, + }, + }, + }, + }, + Required: []string{"clientId", "clientSecret", "tokenUrl"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.OAuth2EndpointParam", "github.com/openshift/api/config/v1alpha1.SecretKeySelector"}, + } +} + +func schema_openshift_api_config_v1alpha1_OAuth2EndpointParam(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "OAuth2EndpointParam defines a name/value parameter for the OAuth2 token URL.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is the parameter name. Must be between 1 and 256 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + "value": { + SchemaProps: spec.SchemaProps{ + Description: "value is the optional parameter value. When omitted, the query parameter is applied as ?name (no value). When set (including to the empty string), it is applied as ?name=value. Empty string may be used when the external system expects a parameter with an empty value (e.g. ?parameter=\"\"). Must be between 0 and 2048 characters when present (aligned with common URL length recommendations).", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"name"}, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_OpenShiftStateMetricsConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "OpenShiftStateMetricsConfig provides configuration options for the openshift-state-metrics agent that runs in the `openshift-monitoring` namespace. The openshift-state-metrics agent generates metrics about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "nodeSelector": { + SchemaProps: spec.SchemaProps{ + Description: "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "resources": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "resources defines the compute resource requests and limits for the openshift-state-metrics container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 1m\n limit: null\n - name: memory\n request: 32Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + }, + }, + }, + }, + }, + "tolerations": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.Toleration{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "topologySpreadConstraints": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "topologyKey", + "whenUnsatisfiable", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "topologySpreadConstraints defines rules for how openshift-state-metrics Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.TopologySpreadConstraint{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.ContainerResource", corev1.Toleration{}.OpenAPIModelName(), corev1.TopologySpreadConstraint{}.OpenAPIModelName()}, + } +} + func schema_openshift_api_config_v1alpha1_PKI(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -24116,33 +24232,6 @@ func schema_openshift_api_config_v1alpha1_PKICertificateManagement(ref common.Re } } -func schema_openshift_api_config_v1alpha1_PKICertificateSubject(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PKICertificateSubject defines the requirements imposed on the subject to which the certificate was issued.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "email": { - SchemaProps: spec.SchemaProps{ - Description: "email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate. The email should be a valid email address and at most 320 characters in length.", - Type: []string{"string"}, - Format: "", - }, - }, - "hostname": { - SchemaProps: spec.SchemaProps{ - Description: "hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate. The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length. It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk.", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - } -} - func schema_openshift_api_config_v1alpha1_PKIList(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -24313,199 +24402,14 @@ func schema_openshift_api_config_v1alpha1_PersistentVolumeConfig(ref common.Refe } } -func schema_openshift_api_config_v1alpha1_PolicyFulcioSubject(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PolicyFulcioSubject defines the OIDC issuer and the email of the Fulcio authentication configuration.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "oidcIssuer": { - SchemaProps: spec.SchemaProps{ - Description: "oidcIssuer contains the expected OIDC issuer. It will be verified that the Fulcio-issued certificate contains a (Fulcio-defined) certificate extension pointing at this OIDC issuer URL. When Fulcio issues certificates, it includes a value based on an URL inside the client-provided ID token. Example: \"https://expected.OIDC.issuer/\"", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "signedEmail": { - SchemaProps: spec.SchemaProps{ - Description: "signedEmail holds the email address the the Fulcio certificate is issued for. Example: \"expected-signing-user@example.com\"", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"oidcIssuer", "signedEmail"}, - }, - }, - } -} - -func schema_openshift_api_config_v1alpha1_PolicyIdentity(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PolicyIdentity defines image identity the signature claims about the image. When omitted, the default matchPolicy is \"MatchRepoDigestOrExact\".", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "matchPolicy": { - SchemaProps: spec.SchemaProps{ - Description: "matchPolicy sets the type of matching to be used. Valid values are \"MatchRepoDigestOrExact\", \"MatchRepository\", \"ExactRepository\", \"RemapIdentity\". When omitted, the default value is \"MatchRepoDigestOrExact\". If set matchPolicy to ExactRepository, then the exactRepository must be specified. If set matchPolicy to RemapIdentity, then the remapIdentity must be specified. \"MatchRepoDigestOrExact\" means that the identity in the signature must be in the same repository as the image identity if the image identity is referenced by a digest. Otherwise, the identity in the signature must be the same as the image identity. \"MatchRepository\" means that the identity in the signature must be in the same repository as the image identity. \"ExactRepository\" means that the identity in the signature must be in the same repository as a specific identity specified by \"repository\". \"RemapIdentity\" means that the signature must be in the same as the remapped image identity. Remapped image identity is obtained by replacing the \"prefix\" with the specified “signedPrefix” if the the image identity matches the specified remapPrefix.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "exactRepository": { - SchemaProps: spec.SchemaProps{ - Description: "exactRepository is required if matchPolicy is set to \"ExactRepository\".", - Ref: ref("github.com/openshift/api/config/v1alpha1.PolicyMatchExactRepository"), - }, - }, - "remapIdentity": { - SchemaProps: spec.SchemaProps{ - Description: "remapIdentity is required if matchPolicy is set to \"RemapIdentity\".", - Ref: ref("github.com/openshift/api/config/v1alpha1.PolicyMatchRemapIdentity"), - }, - }, - }, - Required: []string{"matchPolicy"}, - }, - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-unions": []interface{}{ - map[string]interface{}{ - "discriminator": "matchPolicy", - "fields-to-discriminateBy": map[string]interface{}{ - "exactRepository": "PolicyMatchExactRepository", - "remapIdentity": "PolicyMatchRemapIdentity", - }, - }, - }, - }, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.PolicyMatchExactRepository", "github.com/openshift/api/config/v1alpha1.PolicyMatchRemapIdentity"}, - } -} - -func schema_openshift_api_config_v1alpha1_PolicyMatchExactRepository(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "repository": { - SchemaProps: spec.SchemaProps{ - Description: "repository is the reference of the image identity to be matched. The value should be a repository name (by omitting the tag or digest) in a registry implementing the \"Docker Registry HTTP API V2\". For example, docker.io/library/busybox", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"repository"}, - }, - }, - } -} - -func schema_openshift_api_config_v1alpha1_PolicyMatchRemapIdentity(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "prefix": { - SchemaProps: spec.SchemaProps{ - Description: "prefix is the prefix of the image identity to be matched. If the image identity matches the specified prefix, that prefix is replaced by the specified “signedPrefix” (otherwise it is used as unchanged and no remapping takes place). This useful when verifying signatures for a mirror of some other repository namespace that preserves the vendor’s repository structure. The prefix and signedPrefix values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "signedPrefix": { - SchemaProps: spec.SchemaProps{ - Description: "signedPrefix is the prefix of the image identity to be matched in the signature. The format is the same as \"prefix\". The values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"prefix", "signedPrefix"}, - }, - }, - } -} - -func schema_openshift_api_config_v1alpha1_PolicyRootOfTrust(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PolicyRootOfTrust defines the root of trust based on the selected policyType.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "policyType": { - SchemaProps: spec.SchemaProps{ - Description: "policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust. \"PublicKey\" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification. \"FulcioCAWithRekor\" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification. \"PKI\" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "publicKey": { - SchemaProps: spec.SchemaProps{ - Description: "publicKey defines the root of trust based on a sigstore public key.", - Ref: ref("github.com/openshift/api/config/v1alpha1.ImagePolicyPublicKeyRootOfTrust"), - }, - }, - "fulcioCAWithRekor": { - SchemaProps: spec.SchemaProps{ - Description: "fulcioCAWithRekor defines the root of trust based on the Fulcio certificate and the Rekor public key. For more information about Fulcio and Rekor, please refer to the document at: https://github.com/sigstore/fulcio and https://github.com/sigstore/rekor", - Ref: ref("github.com/openshift/api/config/v1alpha1.ImagePolicyFulcioCAWithRekorRootOfTrust"), - }, - }, - "pki": { - SchemaProps: spec.SchemaProps{ - Description: "pki defines the root of trust based on Bring Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and corresponding intermediate certificates.", - Ref: ref("github.com/openshift/api/config/v1alpha1.ImagePolicyPKIRootOfTrust"), - }, - }, - }, - Required: []string{"policyType"}, - }, - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-unions": []interface{}{ - map[string]interface{}{ - "discriminator": "policyType", - "fields-to-discriminateBy": map[string]interface{}{ - "fulcioCAWithRekor": "FulcioCAWithRekor", - "pki": "PKI", - "publicKey": "PublicKey", - }, - }, - }, - }, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ImagePolicyFulcioCAWithRekorRootOfTrust", "github.com/openshift/api/config/v1alpha1.ImagePolicyPKIRootOfTrust", "github.com/openshift/api/config/v1alpha1.ImagePolicyPublicKeyRootOfTrust"}, - } -} - -func schema_openshift_api_config_v1alpha1_PrometheusOperatorAdmissionWebhookConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { +func schema_openshift_api_config_v1alpha1_PrometheusConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ SchemaProps: spec.SchemaProps{ - Description: "PrometheusOperatorAdmissionWebhookConfig provides configuration options for the admission webhook component of Prometheus Operator that runs in the `openshift-monitoring` namespace. The admission webhook validates PrometheusRule and AlertmanagerConfig objects, mutates PrometheusRule annotations, and converts AlertmanagerConfig objects between API versions.", + Description: "PrometheusConfig provides configuration options for the Prometheus instance. Use this configuration to control Prometheus deployment, pod scheduling, resource allocation, retention policies, and external integrations.", Type: []string{"object"}, Properties: map[string]spec.Schema{ - "resources": { + "additionalAlertmanagerConfigs": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ "x-kubernetes-list-map-keys": []interface{}{ @@ -24515,66 +24419,57 @@ func schema_openshift_api_config_v1alpha1_PrometheusOperatorAdmissionWebhookConf }, }, SchemaProps: spec.SchemaProps{ - Description: "resources defines the compute resource requests and limits for the prometheus-operator-admission-webhook container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 5m\n limit: null\n - name: memory\n request: 30Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + Description: "additionalAlertmanagerConfigs configures additional Alertmanager instances that receive alerts from the Prometheus component. This is useful for organizations that need to:\n - Send alerts to external monitoring systems (like PagerDuty, Slack, or custom webhooks)\n - Route different types of alerts to different teams or systems\n - Integrate with existing enterprise alerting infrastructure\n - Maintain separate alert routing for compliance or organizational requirements\nWhen omitted, no additional Alertmanager instances are configured (default behavior). When provided, at least one configuration must be specified (minimum 1, maximum 10 items). Entries must have unique names (name is the list key).", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + Ref: ref("github.com/openshift/api/config/v1alpha1.AdditionalAlertmanagerConfig"), }, }, }, }, }, - "topologySpreadConstraints": { + "enforcedBodySizeLimitBytes": { + SchemaProps: spec.SchemaProps{ + Description: "enforcedBodySizeLimitBytes enforces a body size limit (in bytes) for Prometheus scraped metrics. If a scraped target's body response is larger than the limit, the scrape will fail. This helps protect Prometheus from targets that return excessively large responses. The value is specified in bytes (e.g., 4194304 for 4MB, 1073741824 for 1GB). When omitted, the Cluster Monitoring Operator automatically calculates an appropriate limit based on cluster capacity. Set an explicit value to override the automatic calculation. Minimum value is 10240 (10kB). Maximum value is 1073741824 (1GB).", + Type: []string{"integer"}, + Format: "int64", + }, + }, + "externalLabels": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ "x-kubernetes-list-map-keys": []interface{}{ - "topologyKey", - "whenUnsatisfiable", + "key", }, "x-kubernetes-list-type": "map", }, }, SchemaProps: spec.SchemaProps{ - Description: "topologySpreadConstraints defines rules for how admission webhook Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", + Description: "externalLabels defines labels to be attached to time series and alerts when communicating with external systems such as federation, remote storage, and Alertmanager. These labels are not stored with metrics on disk; they are only added when data leaves Prometheus (e.g., during federation queries, remote write, or alert notifications). At least 1 label must be specified when set, with a maximum of 50 labels allowed. Each label key must be unique within this list. When omitted, no external labels are applied.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: map[string]interface{}{}, - Ref: ref(corev1.TopologySpreadConstraint{}.OpenAPIModelName()), + Ref: ref("github.com/openshift/api/config/v1alpha1.Label"), }, }, }, }, }, - }, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/config/v1alpha1.ContainerResource", corev1.TopologySpreadConstraint{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PrometheusOperatorConfig provides configuration options for the Prometheus Operator instance Use this configuration to control how the Prometheus Operator instance is deployed, how it logs, and how its pods are scheduled.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ "logLevel": { SchemaProps: spec.SchemaProps{ - Description: "logLevel defines the verbosity of logs emitted by Prometheus Operator. This field allows users to control the amount and severity of logs generated, which can be useful for debugging issues or reducing noise in production environments. Allowed values are Error, Warn, Info, and Debug. When set to Error, only errors will be logged. When set to Warn, both warnings and errors will be logged. When set to Info, general information, warnings, and errors will all be logged. When set to Debug, detailed debugging information will be logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Info`.", + Description: "logLevel defines the verbosity of logs emitted by Prometheus. This field allows users to control the amount and severity of logs generated, which can be useful for debugging issues or reducing noise in production environments. Allowed values are Error, Warn, Info, and Debug. When set to Error, only errors will be logged. When set to Warn, both warnings and errors will be logged. When set to Info, general information, warnings, and errors will all be logged. When set to Debug, detailed debugging information will be logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Info`.", Type: []string{"string"}, Format: "", }, }, "nodeSelector": { SchemaProps: spec.SchemaProps{ - Description: "nodeSelector defines the nodes on which the Pods are scheduled nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + Description: "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least one key-value pair (minimum of 1) and must not contain more than 10 entries.", Type: []string{"object"}, AdditionalProperties: &spec.SchemaOrBool{ Allows: true, @@ -24588,7 +24483,14 @@ func schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref common.Re }, }, }, - "resources": { + "queryLogFile": { + SchemaProps: spec.SchemaProps{ + Description: "queryLogFile specifies the file to which PromQL queries are logged. This setting can be either a filename, in which case the queries are saved to an `emptyDir` volume at `/var/log/prometheus`, or a full path to a location where an `emptyDir` volume will be mounted and the queries saved. Writing to `/dev/stderr`, `/dev/stdout` or `/dev/null` is supported, but writing to any other `/dev/` path is not supported. Relative paths are also not supported. By default, PromQL queries are not logged. Must be an absolute path starting with `/` or a simple filename without path separators. Must not contain consecutive slashes, end with a slash, or include '..' path traversal. Must contain only alphanumeric characters, '.', '_', '-', or '/'. Must be between 1 and 255 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "remoteWrite": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ "x-kubernetes-list-map-keys": []interface{}{ @@ -24598,41 +24500,245 @@ func schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref common.Re }, }, SchemaProps: spec.SchemaProps{ - Description: "resources defines the compute resource requests and limits for the Prometheus Operator container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 10. Minimum length for this list is 1. Each resource name must be unique within this list.", + Description: "remoteWrite defines the remote write configuration, including URL, authentication, and relabeling settings. Remote write allows Prometheus to send metrics it collects to external long-term storage systems. When omitted, no remote write endpoints are configured. When provided, at least one configuration must be specified (minimum 1, maximum 10 items). Entries must have unique names (name is the list key).", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + Ref: ref("github.com/openshift/api/config/v1alpha1.RemoteWriteSpec"), }, }, }, }, }, - "tolerations": { + "resources": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ - "x-kubernetes-list-type": "atomic", + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", }, }, SchemaProps: spec.SchemaProps{ - Description: "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + Description: "resources defines the compute resource requests and limits for the Prometheus container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ SchemaProps: spec.SchemaProps{ Default: map[string]interface{}{}, - Ref: ref(corev1.Toleration{}.OpenAPIModelName()), + Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), }, }, }, }, }, - "topologySpreadConstraints": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ + "retention": { + SchemaProps: spec.SchemaProps{ + Description: "retention configures how long Prometheus retains metrics data and how much storage it can use. When omitted, the platform chooses reasonable defaults (currently 15 days retention, no size limit).", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.Retention"), + }, + }, + "tolerations": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10 Minimum length for this list is 1", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.Toleration{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "topologySpreadConstraints": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "topologyKey", + "whenUnsatisfiable", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "topologySpreadConstraints defines rules for how Prometheus Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1 Entries must have unique topologyKey and whenUnsatisfiable pairs.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.TopologySpreadConstraint{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "collectionProfile": { + SchemaProps: spec.SchemaProps{ + Description: "collectionProfile defines the metrics collection profile that Prometheus uses to collect metrics from the platform components. Supported values are `Full` or `Minimal`. In the `Full` profile (default), Prometheus collects all metrics that are exposed by the platform components. In the `Minimal` profile, Prometheus only collects metrics necessary for the default platform alerts, recording rules, telemetry and console dashboards. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is `Full`.", + Type: []string{"string"}, + Format: "", + }, + }, + "volumeClaimTemplate": { + SchemaProps: spec.SchemaProps{ + Description: "volumeClaimTemplate defines persistent storage for Prometheus. Use this setting to configure the persistent volume claim, including storage class and volume size. If omitted, the Pod uses ephemeral storage and Prometheus data will not persist across restarts.", + Ref: ref(corev1.PersistentVolumeClaim{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.AdditionalAlertmanagerConfig", "github.com/openshift/api/config/v1alpha1.ContainerResource", "github.com/openshift/api/config/v1alpha1.Label", "github.com/openshift/api/config/v1alpha1.RemoteWriteSpec", "github.com/openshift/api/config/v1alpha1.Retention", corev1.PersistentVolumeClaim{}.OpenAPIModelName(), corev1.Toleration{}.OpenAPIModelName(), corev1.TopologySpreadConstraint{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_config_v1alpha1_PrometheusOperatorAdmissionWebhookConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PrometheusOperatorAdmissionWebhookConfig provides configuration options for the admission webhook component of Prometheus Operator that runs in the `openshift-monitoring` namespace. The admission webhook validates PrometheusRule and AlertmanagerConfig objects, mutates PrometheusRule annotations, and converts AlertmanagerConfig objects between API versions.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "resources": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "resources defines the compute resource requests and limits for the prometheus-operator-admission-webhook container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 5m\n limit: null\n - name: memory\n request: 30Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + }, + }, + }, + }, + }, + "topologySpreadConstraints": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "topologyKey", + "whenUnsatisfiable", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "topologySpreadConstraints defines rules for how admission webhook Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.TopologySpreadConstraint{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.ContainerResource", corev1.TopologySpreadConstraint{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PrometheusOperatorConfig provides configuration options for the Prometheus Operator instance Use this configuration to control how the Prometheus Operator instance is deployed, how it logs, and how its pods are scheduled.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "logLevel": { + SchemaProps: spec.SchemaProps{ + Description: "logLevel defines the verbosity of logs emitted by Prometheus Operator. This field allows users to control the amount and severity of logs generated, which can be useful for debugging issues or reducing noise in production environments. Allowed values are Error, Warn, Info, and Debug. When set to Error, only errors will be logged. When set to Warn, both warnings and errors will be logged. When set to Info, general information, warnings, and errors will all be logged. When set to Debug, detailed debugging information will be logged. When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. The current default value is `Info`.", + Type: []string{"string"}, + Format: "", + }, + }, + "nodeSelector": { + SchemaProps: spec.SchemaProps{ + Description: "nodeSelector defines the nodes on which the Pods are scheduled nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "resources": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "resources defines the compute resource requests and limits for the Prometheus Operator container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + }, + }, + }, + }, + }, + "tolerations": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.Toleration{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "topologySpreadConstraints": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ "topologyKey", "whenUnsatisfiable", }, @@ -24660,6 +24766,103 @@ func schema_openshift_api_config_v1alpha1_PrometheusOperatorConfig(ref common.Re } } +func schema_openshift_api_config_v1alpha1_PrometheusRemoteWriteHeader(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PrometheusRemoteWriteHeader defines a custom HTTP header for remote write requests. The header name must not be one of the reserved headers set by Prometheus (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate). Header names must contain only case-insensitive alphanumeric characters, hyphens (-), and underscores (_); other characters (e.g. emoji) are rejected by validation. Validation is enforced on the Headers field in RemoteWriteSpec.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is the HTTP header name. Must not be a reserved header (see type documentation). Must contain only alphanumeric characters, hyphens, and underscores; invalid characters are rejected. Must be between 1 and 256 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + "value": { + SchemaProps: spec.SchemaProps{ + Description: "value is the HTTP header value. Must be at most 4096 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"name", "value"}, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_QueueConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "QueueConfig allows tuning configuration for remote write queue parameters. Configure this when you need to control throughput, backpressure, or retry behavior—for example to avoid overloading the remote endpoint, to reduce memory usage, or to tune for high-cardinality workloads. Consider capacity, maxShards, and batchSendDeadlineSeconds for throughput; minBackoffMilliseconds and maxBackoffMilliseconds for retries; and rateLimitedAction when the remote returns HTTP 429.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "capacity": { + SchemaProps: spec.SchemaProps{ + Description: "capacity is the number of samples to buffer per shard before we start dropping them. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 10000. Minimum value is 1. Maximum value is 1000000.", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "maxShards": { + SchemaProps: spec.SchemaProps{ + Description: "maxShards is the maximum number of shards, i.e. amount of concurrency. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 200. Minimum value is 1. Maximum value is 10000.", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "minShards": { + SchemaProps: spec.SchemaProps{ + Description: "minShards is the minimum number of shards, i.e. amount of concurrency. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 1. Minimum value is 1. Maximum value is 10000.", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "maxSamplesPerSend": { + SchemaProps: spec.SchemaProps{ + Description: "maxSamplesPerSend is the maximum number of samples per send. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 1000. Minimum value is 1. Maximum value is 100000.", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "batchSendDeadlineSeconds": { + SchemaProps: spec.SchemaProps{ + Description: "batchSendDeadlineSeconds is the maximum time in seconds a sample will wait in buffer before being sent. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 second. Maximum value is 3600 seconds (1 hour).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "minBackoffMilliseconds": { + SchemaProps: spec.SchemaProps{ + Description: "minBackoffMilliseconds is the minimum retry delay in milliseconds. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 millisecond. Maximum value is 3600000 milliseconds (1 hour).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "maxBackoffMilliseconds": { + SchemaProps: spec.SchemaProps{ + Description: "maxBackoffMilliseconds is the maximum retry delay in milliseconds. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 millisecond. Maximum value is 3600000 milliseconds (1 hour).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "rateLimitedAction": { + SchemaProps: spec.SchemaProps{ + Description: "rateLimitedAction controls what to do when the remote write endpoint returns HTTP 429 (Too Many Requests). When omitted, no retries are performed on rate limit responses. When set to \"Retry\", Prometheus will retry such requests using the backoff settings above. Valid value when set is \"Retry\".", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + } +} + func schema_openshift_api_config_v1alpha1_RSAKeyConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -24681,6 +24884,411 @@ func schema_openshift_api_config_v1alpha1_RSAKeyConfig(ref common.ReferenceCallb } } +func schema_openshift_api_config_v1alpha1_RelabelActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "RelabelActionConfig represents the action to perform and its configuration. Exactly one action-specific configuration must be specified based on the action type.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "type": { + SchemaProps: spec.SchemaProps{ + Description: "type specifies the action to perform on the matched labels. Allowed values are Replace, Lowercase, Uppercase, Keep, Drop, KeepEqual, DropEqual, HashMod, LabelMap, LabelDrop, LabelKeep.\n\nWhen set to Replace, regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. If regex does not match, no replacement takes place.\n\nWhen set to Lowercase, the concatenated source_labels are mapped to their lower case. Requires Prometheus >= v2.36.0.\n\nWhen set to Uppercase, the concatenated source_labels are mapped to their upper case. Requires Prometheus >= v2.36.0.\n\nWhen set to Keep, targets for which regex does not match the concatenated source_labels are dropped.\n\nWhen set to Drop, targets for which regex matches the concatenated source_labels are dropped.\n\nWhen set to KeepEqual, targets for which the concatenated source_labels do not match target_label are dropped. Requires Prometheus >= v2.41.0.\n\nWhen set to DropEqual, targets for which the concatenated source_labels do match target_label are dropped. Requires Prometheus >= v2.41.0.\n\nWhen set to HashMod, target_label is set to the modulus of a hash of the concatenated source_labels.\n\nWhen set to LabelMap, regex is matched against all source label names (not just source_labels); matching label values are copied to new names given by replacement with ${1}, ${2}, ... substituted.\n\nWhen set to LabelDrop, regex is matched against all label names; any label that matches is removed.\n\nWhen set to LabelKeep, regex is matched against all label names; any label that does not match is removed.", + Type: []string{"string"}, + Format: "", + }, + }, + "replace": { + SchemaProps: spec.SchemaProps{ + Description: "replace configures the Replace action. Required when type is Replace, and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ReplaceActionConfig"), + }, + }, + "hashMod": { + SchemaProps: spec.SchemaProps{ + Description: "hashMod configures the HashMod action. Required when type is HashMod, and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.HashModActionConfig"), + }, + }, + "labelMap": { + SchemaProps: spec.SchemaProps{ + Description: "labelMap configures the LabelMap action. Required when type is LabelMap, and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.LabelMapActionConfig"), + }, + }, + "lowercase": { + SchemaProps: spec.SchemaProps{ + Description: "lowercase configures the Lowercase action. Required when type is Lowercase, and forbidden otherwise. Requires Prometheus >= v2.36.0.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.LowercaseActionConfig"), + }, + }, + "uppercase": { + SchemaProps: spec.SchemaProps{ + Description: "uppercase configures the Uppercase action. Required when type is Uppercase, and forbidden otherwise. Requires Prometheus >= v2.36.0.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.UppercaseActionConfig"), + }, + }, + "keepEqual": { + SchemaProps: spec.SchemaProps{ + Description: "keepEqual configures the KeepEqual action. Required when type is KeepEqual, and forbidden otherwise. Requires Prometheus >= v2.41.0.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.KeepEqualActionConfig"), + }, + }, + "dropEqual": { + SchemaProps: spec.SchemaProps{ + Description: "dropEqual configures the DropEqual action. Required when type is DropEqual, and forbidden otherwise. Requires Prometheus >= v2.41.0.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.DropEqualActionConfig"), + }, + }, + }, + Required: []string{"type"}, + }, + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-unions": []interface{}{ + map[string]interface{}{ + "discriminator": "type", + "fields-to-discriminateBy": map[string]interface{}{ + "dropEqual": "DropEqual", + "hashMod": "HashMod", + "keepEqual": "KeepEqual", + "labelMap": "LabelMap", + "lowercase": "Lowercase", + "replace": "Replace", + "uppercase": "Uppercase", + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.DropEqualActionConfig", "github.com/openshift/api/config/v1alpha1.HashModActionConfig", "github.com/openshift/api/config/v1alpha1.KeepEqualActionConfig", "github.com/openshift/api/config/v1alpha1.LabelMapActionConfig", "github.com/openshift/api/config/v1alpha1.LowercaseActionConfig", "github.com/openshift/api/config/v1alpha1.ReplaceActionConfig", "github.com/openshift/api/config/v1alpha1.UppercaseActionConfig"}, + } +} + +func schema_openshift_api_config_v1alpha1_RelabelConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "RelabelConfig represents a relabeling rule.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is a unique identifier for this relabel configuration. Must contain only alphanumeric characters, hyphens, and underscores. Must be between 1 and 63 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "sourceLabels": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "set", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "sourceLabels specifies which label names to extract from each series for this relabeling rule. The values of these labels are joined together using the configured separator, and the resulting string is then matched against the regular expression. If a referenced label does not exist on a series, Prometheus substitutes an empty string. When omitted, the rule operates without extracting source labels (useful for actions like labelmap). Minimum of 1 and maximum of 10 source labels can be specified, each between 1 and 128 characters. Each entry must be unique. Label names beginning with \"__\" (two underscores) are reserved for internal Prometheus use and are not allowed. Label names SHOULD start with a letter (a-z, A-Z) or underscore (_), followed by zero or more letters, digits (0-9), or underscores for best compatibility. While Prometheus supports UTF-8 characters in label names (since v3.0.0), using the recommended character set ensures better compatibility with the wider ecosystem (tooling, third-party instrumentation, etc.).", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "separator": { + SchemaProps: spec.SchemaProps{ + Description: "separator is the character sequence used to join source label values. Common examples: \";\", \",\", \"::\", \"|||\". When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \";\". Must be between 1 and 5 characters in length when specified.", + Type: []string{"string"}, + Format: "", + }, + }, + "regex": { + SchemaProps: spec.SchemaProps{ + Description: "regex is the regular expression to match against the concatenated source label values. Must be a valid RE2 regular expression (https://github.com/google/re2/wiki/Syntax). When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \"(.*)\" to match everything. Must be between 1 and 1000 characters in length when specified.", + Type: []string{"string"}, + Format: "", + }, + }, + "action": { + SchemaProps: spec.SchemaProps{ + Description: "action defines the action to perform on the matched labels and its configuration. Exactly one action-specific configuration must be specified based on the action type.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.RelabelActionConfig"), + }, + }, + }, + Required: []string{"name", "action"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.RelabelActionConfig"}, + } +} + +func schema_openshift_api_config_v1alpha1_RemoteWriteAuthorization(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "RemoteWriteAuthorization defines the authorization method for a remote write endpoint. Exactly one of the nested configs must be set according to the type discriminator.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "type": { + SchemaProps: spec.SchemaProps{ + Description: "type specifies the authorization method to use. Allowed values are BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, ServiceAccount.\n\nWhen set to BearerToken, the bearer token is read from a Secret referenced by the bearerToken field.\n\nWhen set to BasicAuth, HTTP basic authentication is used; the basicAuth field (username and password from Secrets) must be set.\n\nWhen set to OAuth2, OAuth2 client credentials flow is used; the oauth2 field (clientId, clientSecret, tokenUrl) must be set.\n\nWhen set to SigV4, AWS Signature Version 4 is used for authentication; the sigv4 field must be set.\n\nWhen set to SafeAuthorization, credentials are read from a single Secret key (Prometheus SafeAuthorization pattern). The secret key typically contains a Bearer token. Use the safeAuthorization field.\n\nWhen set to ServiceAccount, the pod's service account token is used for machine identity. No additional field is required; the operator configures the token path.", + Type: []string{"string"}, + Format: "", + }, + }, + "safeAuthorization": { + SchemaProps: spec.SchemaProps{ + Description: "safeAuthorization defines the secret reference containing the credentials for authentication (e.g. Bearer token). Required when type is \"SafeAuthorization\", and forbidden otherwise. Maps to Prometheus SafeAuthorization. The secret must exist in the openshift-monitoring namespace.", + Ref: ref(corev1.SecretKeySelector{}.OpenAPIModelName()), + }, + }, + "bearerToken": { + SchemaProps: spec.SchemaProps{ + Description: "bearerToken defines the secret reference containing the bearer token. Required when type is \"BearerToken\", and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "basicAuth": { + SchemaProps: spec.SchemaProps{ + Description: "basicAuth defines HTTP basic authentication credentials. Required when type is \"BasicAuth\", and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.BasicAuth"), + }, + }, + "oauth2": { + SchemaProps: spec.SchemaProps{ + Description: "oauth2 defines OAuth2 client credentials authentication. Required when type is \"OAuth2\", and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.OAuth2"), + }, + }, + "sigv4": { + SchemaProps: spec.SchemaProps{ + Description: "sigv4 defines AWS Signature Version 4 authentication. Required when type is \"SigV4\", and forbidden otherwise.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.Sigv4"), + }, + }, + }, + Required: []string{"type"}, + }, + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-unions": []interface{}{ + map[string]interface{}{ + "discriminator": "type", + "fields-to-discriminateBy": map[string]interface{}{ + "basicAuth": "BasicAuth", + "bearerToken": "BearerToken", + "oauth2": "OAuth2", + "safeAuthorization": "SafeAuthorization", + "sigv4": "Sigv4", + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.BasicAuth", "github.com/openshift/api/config/v1alpha1.OAuth2", "github.com/openshift/api/config/v1alpha1.SecretKeySelector", "github.com/openshift/api/config/v1alpha1.Sigv4", corev1.SecretKeySelector{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_config_v1alpha1_RemoteWriteSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "RemoteWriteSpec represents configuration for remote write endpoints.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "url": { + SchemaProps: spec.SchemaProps{ + Description: "url is the URL of the remote write endpoint. Must be a valid URL with http or https scheme and a non-empty hostname. Query parameters, fragments, and user information (e.g. user:password@host) are not allowed. Empty string is invalid. Must be between 1 and 2048 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is a required identifier for this remote write configuration (name is the list key for the remoteWrite list). This name is used in metrics and logging to differentiate remote write queues. Must contain only alphanumeric characters, hyphens, and underscores. Must be between 1 and 63 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "authorization": { + SchemaProps: spec.SchemaProps{ + Description: "authorization defines the authorization method for the remote write endpoint. When omitted, no authorization is performed. When set, type must be one of BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, or ServiceAccount; the corresponding nested config must be set (ServiceAccount has no config).", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.RemoteWriteAuthorization"), + }, + }, + "headers": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "headers specifies the custom HTTP headers to be sent along with each remote write request. Sending custom headers makes the configuration of a proxy in between optional and helps the receiver recognize the given source better. Clients MAY allow users to send custom HTTP headers; they MUST NOT allow users to configure them in such a way as to send reserved headers. Headers set by Prometheus cannot be overwritten. When omitted, no custom headers are sent. Maximum of 50 headers can be specified. Each header name must be unique. Each header name must contain only alphanumeric characters, hyphens, and underscores, and must not be a reserved Prometheus header (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate).", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.PrometheusRemoteWriteHeader"), + }, + }, + }, + }, + }, + "metadataConfig": { + SchemaProps: spec.SchemaProps{ + Description: "metadataConfig configures the sending of series metadata to remote storage. When omitted, no metadata is sent. When set to sendPolicy: Default, metadata is sent using platform-chosen defaults (e.g. send interval 30 seconds). When set to sendPolicy: Custom, metadata is sent using the settings in the custom field (e.g. custom.sendIntervalSeconds).", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.MetadataConfig"), + }, + }, + "proxyUrl": { + SchemaProps: spec.SchemaProps{ + Description: "proxyUrl defines an optional proxy URL. If the cluster-wide proxy is enabled, it replaces the proxyUrl setting. The cluster-wide proxy supports both HTTP and HTTPS proxies, with HTTPS taking precedence. When omitted, no proxy is used. Must be a valid URL with http or https scheme. Must be between 1 and 2048 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "queueConfig": { + SchemaProps: spec.SchemaProps{ + Description: "queueConfig allows tuning configuration for remote write queue parameters. When omitted, default queue configuration is used.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.QueueConfig"), + }, + }, + "remoteTimeoutSeconds": { + SchemaProps: spec.SchemaProps{ + Description: "remoteTimeoutSeconds defines the timeout in seconds for requests to the remote write endpoint. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Minimum value is 1 second. Maximum value is 600 seconds (10 minutes).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "exemplarsMode": { + SchemaProps: spec.SchemaProps{ + Description: "exemplarsMode controls whether exemplars are sent via remote write. Valid values are \"Send\", \"DoNotSend\" and omitted. When set to \"Send\", Prometheus is configured to store a maximum of 100,000 exemplars in memory and send them with remote write. Note that this setting only applies to user-defined monitoring. It is not applicable to default in-cluster monitoring. When omitted or set to \"DoNotSend\", exemplars are not sent.", + Type: []string{"string"}, + Format: "", + }, + }, + "tlsConfig": { + SchemaProps: spec.SchemaProps{ + Description: "tlsConfig defines TLS authentication settings for the remote write endpoint. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.TLSConfig"), + }, + }, + "writeRelabelConfigs": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "writeRelabelConfigs is a list of relabeling rules to apply before sending data to the remote endpoint. When omitted, no relabeling is performed and all metrics are sent as-is. Minimum of 1 and maximum of 10 relabeling rules can be specified. Each rule must have a unique name.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.RelabelConfig"), + }, + }, + }, + }, + }, + }, + Required: []string{"url", "name"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.MetadataConfig", "github.com/openshift/api/config/v1alpha1.PrometheusRemoteWriteHeader", "github.com/openshift/api/config/v1alpha1.QueueConfig", "github.com/openshift/api/config/v1alpha1.RelabelConfig", "github.com/openshift/api/config/v1alpha1.RemoteWriteAuthorization", "github.com/openshift/api/config/v1alpha1.TLSConfig"}, + } +} + +func schema_openshift_api_config_v1alpha1_ReplaceActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "ReplaceActionConfig configures the Replace action. Regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. No replacement if regex does not match.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "targetLabel": { + SchemaProps: spec.SchemaProps{ + Description: "targetLabel is the label name where the replacement result is written. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "replacement": { + SchemaProps: spec.SchemaProps{ + Description: "replacement is the value written to target_label when regex matches; match group references (${1}, ${2}, ...) are substituted. Required when using the Replace action so the intended behavior is explicit and the platform does not need to apply defaults. Use \"$1\" for the first capture group, \"$2\" for the second, etc. Use an empty string (\"\") to explicitly clear the target label value. Must be between 0 and 255 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"targetLabel", "replacement"}, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_Retention(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "Retention configures how long Prometheus retains metrics data and how much storage it can use.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "durationInDays": { + SchemaProps: spec.SchemaProps{ + Description: "durationInDays specifies how many days Prometheus will retain metrics data. Prometheus automatically deletes data older than this duration. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is 15. Minimum value is 1 day. Maximum value is 365 days (1 year).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + "sizeInGiB": { + SchemaProps: spec.SchemaProps{ + Description: "sizeInGiB specifies the maximum storage size in gibibytes (GiB) that Prometheus can use for data blocks and the write-ahead log (WAL). When the limit is reached, Prometheus will delete oldest data first. When omitted, no size limit is enforced and Prometheus uses available PersistentVolume capacity. Minimum value is 1 GiB. Maximum value is 16384 GiB (16 TiB).", + Type: []string{"integer"}, + Format: "int32", + }, + }, + }, + }, + }, + } +} + func schema_openshift_api_config_v1alpha1_RetentionNumberConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -24775,6 +25383,89 @@ func schema_openshift_api_config_v1alpha1_RetentionSizeConfig(ref common.Referen } } +func schema_openshift_api_config_v1alpha1_SecretKeySelector(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "SecretKeySelector selects a key of a Secret in the `openshift-monitoring` namespace.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is the name of the secret in the `openshift-monitoring` namespace to select from. Must be a valid Kubernetes secret name (lowercase alphanumeric, '-' or '.', start/end with alphanumeric). Must be between 1 and 253 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "key": { + SchemaProps: spec.SchemaProps{ + Description: "key is the key of the secret to select from. Must consist of alphanumeric characters, '-', '_', or '.'. Must be between 1 and 253 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"name", "key"}, + }, + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-map-type": "atomic", + }, + }, + }, + } +} + +func schema_openshift_api_config_v1alpha1_Sigv4(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "Sigv4 defines AWS Signature Version 4 authentication settings. At least one of region, accessKey/secretKey, profile, or roleArn must be set so the platform can perform authentication.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "region": { + SchemaProps: spec.SchemaProps{ + Description: "region is the AWS region. When omitted, the region is derived from the environment or instance metadata. Must be between 1 and 128 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + "accessKey": { + SchemaProps: spec.SchemaProps{ + Description: "accessKey defines the secret reference containing the AWS access key ID. The secret must exist in the openshift-monitoring namespace. When omitted, the access key is derived from the environment or instance metadata.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "secretKey": { + SchemaProps: spec.SchemaProps{ + Description: "secretKey defines the secret reference containing the AWS secret access key. The secret must exist in the openshift-monitoring namespace. When omitted, the secret key is derived from the environment or instance metadata.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "profile": { + SchemaProps: spec.SchemaProps{ + Description: "profile is the named AWS profile used to authenticate. When omitted, the default profile is used. Must be between 1 and 128 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + "roleArn": { + SchemaProps: spec.SchemaProps{ + Description: "roleArn is the AWS Role ARN, an alternative to using AWS API keys. When omitted, API keys are used for authentication. Must be a valid AWS ARN format (e.g., \"arn:aws:iam::123456789012:role/MyRole\"). Must be between 1 and 512 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.SecretKeySelector"}, + } +} + func schema_openshift_api_config_v1alpha1_Storage(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -24805,6 +25496,267 @@ func schema_openshift_api_config_v1alpha1_Storage(ref common.ReferenceCallback) } } +func schema_openshift_api_config_v1alpha1_TLSConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "TLSConfig represents TLS configuration for Alertmanager connections. At least one TLS configuration option must be specified. For mutual TLS (mTLS), both cert and key must be specified together, or both omitted.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "ca": { + SchemaProps: spec.SchemaProps{ + Description: "ca is an optional CA certificate to use for TLS connections. When omitted, the system's default CA bundle is used.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "cert": { + SchemaProps: spec.SchemaProps{ + Description: "cert is an optional client certificate to use for mutual TLS connections. When omitted, no client certificate is presented.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "key": { + SchemaProps: spec.SchemaProps{ + Description: "key is an optional client key to use for mutual TLS connections. When omitted, no client key is used.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.SecretKeySelector"), + }, + }, + "serverName": { + SchemaProps: spec.SchemaProps{ + Description: "serverName is an optional server name to use for TLS connections. When specified, must be a valid DNS subdomain as per RFC 1123. When omitted, the server name is derived from the URL. Must be between 1 and 253 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "certificateVerification": { + SchemaProps: spec.SchemaProps{ + Description: "certificateVerification determines the policy for TLS certificate verification. Allowed values are \"Verify\" (performs certificate verification, secure) and \"SkipVerify\" (skips verification, insecure). When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \"Verify\".", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.SecretKeySelector"}, + } +} + +func schema_openshift_api_config_v1alpha1_TelemeterClientConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "TelemeterClientConfig provides configuration options for the Telemeter Client component that runs in the `openshift-monitoring` namespace. The Telemeter Client collects selected monitoring metrics and forwards them to Red Hat for telemetry purposes. At least one field must be specified.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "nodeSelector": { + SchemaProps: spec.SchemaProps{ + Description: "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "resources": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "resources defines the compute resource requests and limits for the Telemeter Client container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 1m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + }, + }, + }, + }, + }, + "tolerations": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.Toleration{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "topologySpreadConstraints": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "topologyKey", + "whenUnsatisfiable", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "topologySpreadConstraints defines rules for how Telemeter Client Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Default is empty list. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.TopologySpreadConstraint{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.ContainerResource", corev1.Toleration{}.OpenAPIModelName(), corev1.TopologySpreadConstraint{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_config_v1alpha1_ThanosQuerierConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "ThanosQuerierConfig provides configuration options for the Thanos Querier component that runs in the `openshift-monitoring` namespace. At least one field must be specified; an empty thanosQuerierConfig object is not allowed.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "nodeSelector": { + SchemaProps: spec.SchemaProps{ + Description: "nodeSelector defines the nodes on which the Pods are scheduled. nodeSelector is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default value is `kubernetes.io/os: linux`. When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries.", + Type: []string{"object"}, + AdditionalProperties: &spec.SchemaOrBool{ + Allows: true, + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: "", + Type: []string{"string"}, + Format: "", + }, + }, + }, + }, + }, + "resources": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "resources defines the compute resource requests and limits for the Thanos Querier container. resources is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Requests cannot exceed limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 5m\n - name: memory\n request: 12Mi\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/config/v1alpha1.ContainerResource"), + }, + }, + }, + }, + }, + "tolerations": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.Toleration{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "topologySpreadConstraints": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "topologyKey", + "whenUnsatisfiable", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "topologySpreadConstraints defines rules for how Thanos Querier Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Defaults are empty/unset. Maximum length for this list is 10. Minimum length for this list is 1. Entries must have unique topologyKey and whenUnsatisfiable pairs.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(corev1.TopologySpreadConstraint{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/config/v1alpha1.ContainerResource", corev1.Toleration{}.OpenAPIModelName(), corev1.TopologySpreadConstraint{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_config_v1alpha1_UppercaseActionConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "UppercaseActionConfig configures the Uppercase action. Maps the concatenated source_labels to their upper case and writes to target_label. Requires Prometheus >= v2.36.0.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "targetLabel": { + SchemaProps: spec.SchemaProps{ + Description: "targetLabel is the label name where the upper-cased value is written. Must be between 1 and 128 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"targetLabel"}, + }, + }, + } +} + func schema_openshift_api_config_v1alpha1_UserDefinedMonitoring(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -27175,6 +28127,403 @@ func schema_openshift_api_console_v1_NamespaceDashboardSpec(ref common.Reference } } +func schema_openshift_api_etcd_v1_PacemakerCluster(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerCluster represents the current state of the pacemaker cluster as reported by the pcs status command. PacemakerCluster is a cluster-scoped singleton resource. The name of this instance is \"cluster\". This resource provides a view into the health and status of a pacemaker-managed cluster in Two Node OpenShift with Fencing deployments.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "kind": { + SchemaProps: spec.SchemaProps{ + Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + Type: []string{"string"}, + Format: "", + }, + }, + "apiVersion": { + SchemaProps: spec.SchemaProps{ + Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + Type: []string{"string"}, + Format: "", + }, + }, + "metadata": { + SchemaProps: spec.SchemaProps{ + Description: "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + Default: map[string]interface{}{}, + Ref: ref(metav1.ObjectMeta{}.OpenAPIModelName()), + }, + }, + "status": { + SchemaProps: spec.SchemaProps{ + Description: "status contains the actual pacemaker cluster status information collected from the cluster. The goal of this status is to be able to quickly identify if pacemaker is in a healthy state. In Two Node OpenShift with Fencing, a healthy pacemaker cluster has 2 nodes, both of which have healthy kubelet, etcd, and fencing resources. This field is optional on creation - the status collector populates it immediately after creating the resource via the status subresource.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/etcd/v1.PacemakerClusterStatus"), + }, + }, + }, + Required: []string{"metadata"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/etcd/v1.PacemakerClusterStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_etcd_v1_PacemakerClusterFencingAgentStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerClusterFencingAgentStatus represents the status of a fencing agent that can fence a node. Fencing agents are STONITH (Shoot The Other Node In The Head) devices used to isolate failed nodes. Unlike regular pacemaker resources, fencing agents are mapped to their target node (the node they can fence), not the node where their monitoring operations are scheduled.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "conditions": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "type", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "conditions represent the observations of the fencing agent's current state. Known condition types are: \"Healthy\", \"InService\", \"Managed\", \"Enabled\", \"Operational\", \"Active\", \"Started\", \"Schedulable\". The \"Healthy\" condition is an aggregate that tracks the overall health of the fencing agent. The \"InService\" condition tracks whether the fencing agent is in service (not in maintenance mode). The \"Managed\" condition tracks whether the fencing agent is managed by pacemaker. The \"Enabled\" condition tracks whether the fencing agent is enabled. The \"Operational\" condition tracks whether the fencing agent is operational (not failed). The \"Active\" condition tracks whether the fencing agent is active (available to be used). The \"Started\" condition tracks whether the fencing agent is started. The \"Schedulable\" condition tracks whether the fencing agent is schedulable (not blocked). Each of these conditions is required, so the array must contain at least 8 items.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(metav1.Condition{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is the unique identifier for this fencing agent (e.g., \"master-0_redfish\"). The name must be unique within the fencingAgents array for this node. It may contain alphanumeric characters, dots, hyphens, and underscores. Maximum length is 300 characters, providing headroom beyond the typical format of _ (253 for RFC 1123 node name + 1 underscore + type).", + Type: []string{"string"}, + Format: "", + }, + }, + "method": { + SchemaProps: spec.SchemaProps{ + Description: "method is the fencing method used by this agent. Valid values are \"Redfish\" and \"IPMI\". Redfish is a standard RESTful API for server management. IPMI (Intelligent Platform Management Interface) is a hardware management interface.\n\nPossible enum values:\n - `\"IPMI\"` uses IPMI (Intelligent Platform Management Interface), a hardware management interface.\n - `\"Redfish\"` uses Redfish, a standard RESTful API for server management.", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"IPMI", "Redfish"}, + }, + }, + }, + Required: []string{"conditions", "name", "method"}, + }, + }, + Dependencies: []string{ + metav1.Condition{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_etcd_v1_PacemakerClusterList(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerClusterList contains a list of PacemakerCluster objects. PacemakerCluster is a cluster-scoped singleton resource; only one instance named \"cluster\" may exist. This list type exists only to satisfy Kubernetes API conventions.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "kind": { + SchemaProps: spec.SchemaProps{ + Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + Type: []string{"string"}, + Format: "", + }, + }, + "apiVersion": { + SchemaProps: spec.SchemaProps{ + Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + Type: []string{"string"}, + Format: "", + }, + }, + "metadata": { + SchemaProps: spec.SchemaProps{ + Description: "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + Default: map[string]interface{}{}, + Ref: ref(metav1.ListMeta{}.OpenAPIModelName()), + }, + }, + "items": { + SchemaProps: spec.SchemaProps{ + Description: "items is a list of PacemakerCluster objects.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/etcd/v1.PacemakerCluster"), + }, + }, + }, + }, + }, + }, + Required: []string{"items"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/etcd/v1.PacemakerCluster", metav1.ListMeta{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_etcd_v1_PacemakerClusterNodeStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerClusterNodeStatus represents the status of a single node in the pacemaker cluster including the node's conditions and the health of critical resources running on that node.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "conditions": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "type", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "conditions represent the observations of the node's current state. Known condition types are: \"Healthy\", \"Online\", \"InService\", \"Active\", \"Ready\", \"Clean\", \"Member\", \"FencingAvailable\", \"FencingHealthy\". The \"Healthy\" condition is an aggregate that tracks the overall health of the node. The \"Online\" condition tracks whether the node is online. The \"InService\" condition tracks whether the node is in service (not in maintenance mode). The \"Active\" condition tracks whether the node is active (not in standby mode). The \"Ready\" condition tracks whether the node is ready (not in a pending state). The \"Clean\" condition tracks whether the node is in a clean (status known) state. The \"Member\" condition tracks whether the node is a member of the cluster. The \"FencingAvailable\" condition tracks whether this node can be fenced by at least one healthy agent. The \"FencingHealthy\" condition tracks whether all fencing agents for this node are healthy. Each of these conditions is required, so the array must contain at least 9 items.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(metav1.Condition{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "nodeName": { + SchemaProps: spec.SchemaProps{ + Description: "nodeName is the name of the node. This is expected to match the Kubernetes node's name, which must be a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.", + Type: []string{"string"}, + Format: "", + }, + }, + "addresses": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-type": "atomic", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "addresses is a list of IP addresses for the node. Pacemaker allows multiple IP addresses for Corosync communication between nodes. The first address in this list is used for IP-based peer URLs for etcd membership. Each address must be a valid global unicast IPv4 or IPv6 address in canonical form (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). This excludes loopback, link-local, and multicast addresses.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/etcd/v1.PacemakerNodeAddress"), + }, + }, + }, + }, + }, + "resources": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "resources contains the status of pacemaker resources scheduled on this node. Each resource entry includes the resource name and its health conditions. For Two Node OpenShift with Fencing, we track Kubelet and Etcd resources per node. Both resources are required to be present, so the array must contain at least 2 items. Valid resource names are \"Kubelet\" and \"Etcd\". Fencing agents are tracked separately in the fencingAgents field.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/etcd/v1.PacemakerClusterResourceStatus"), + }, + }, + }, + }, + }, + "fencingAgents": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "name", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. A healthy node is expected to have at least 1 fencing agent, but the list may be empty when fencing agent discovery fails. Names must be unique within this array.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/etcd/v1.PacemakerClusterFencingAgentStatus"), + }, + }, + }, + }, + }, + }, + Required: []string{"conditions", "nodeName", "addresses", "resources", "fencingAgents"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/etcd/v1.PacemakerClusterFencingAgentStatus", "github.com/openshift/api/etcd/v1.PacemakerClusterResourceStatus", "github.com/openshift/api/etcd/v1.PacemakerNodeAddress", metav1.Condition{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_etcd_v1_PacemakerClusterResourceStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerClusterResourceStatus represents the status of a pacemaker resource scheduled on a node. A pacemaker resource is a unit of work managed by pacemaker. In pacemaker terminology, resources are services or applications that pacemaker monitors, starts, stops, and moves between nodes to maintain high availability. For Two Node OpenShift with Fencing, we track two resources per node:\n - Kubelet (the Kubernetes node agent and a prerequisite for etcd)\n - Etcd (the distributed key-value store)\n\nFencing agents are tracked separately in the fencingAgents field because they are mapped to their target node (the node they can fence), not the node where monitoring operations are scheduled.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "conditions": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "type", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "conditions represent the observations of the resource's current state. Known condition types are: \"Healthy\", \"InService\", \"Managed\", \"Enabled\", \"Operational\", \"Active\", \"Started\", \"Schedulable\". The \"Healthy\" condition is an aggregate that tracks the overall health of the resource. The \"InService\" condition tracks whether the resource is in service (not in maintenance mode). The \"Managed\" condition tracks whether the resource is managed by pacemaker. The \"Enabled\" condition tracks whether the resource is enabled. The \"Operational\" condition tracks whether the resource is operational (not failed). The \"Active\" condition tracks whether the resource is active (available to be used). The \"Started\" condition tracks whether the resource is started. The \"Schedulable\" condition tracks whether the resource is schedulable (not blocked). Each of these conditions is required, so the array must contain at least 8 items.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(metav1.Condition{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is the name of the pacemaker resource. Valid values are \"Kubelet\" and \"Etcd\". The Kubelet resource is a prerequisite for etcd in Two Node OpenShift with Fencing deployments. The Etcd resource may temporarily transition to stopped during pacemaker quorum-recovery operations. Fencing agents are tracked separately in the node's fencingAgents field.\n\nPossible enum values:\n - `\"Etcd\"` is the etcd pacemaker resource. The etcd resource may temporarily transition to stopped during pacemaker quorum-recovery operations.\n - `\"Kubelet\"` is the kubelet pacemaker resource. The kubelet resource is a prerequisite for etcd in Two Node OpenShift with Fencing deployments.", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"Etcd", "Kubelet"}, + }, + }, + }, + Required: []string{"conditions", "name"}, + }, + }, + Dependencies: []string{ + metav1.Condition{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_etcd_v1_PacemakerClusterStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerClusterStatus contains the actual pacemaker cluster status information. As part of validating the status object, we need to ensure that the lastUpdated timestamp may not be set to an earlier timestamp than the current value. The validation rule checks if oldSelf has lastUpdated before comparing, to handle the initial status creation case.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "conditions": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "type", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "conditions represent the observations of the pacemaker cluster's current state. Known condition types are: \"Healthy\", \"InService\", \"NodeCountAsExpected\". The \"Healthy\" condition is an aggregate that tracks the overall health of the cluster. The \"InService\" condition tracks whether the cluster is in service (not in maintenance mode). The \"NodeCountAsExpected\" condition tracks whether the expected number of nodes are present. Each of these conditions is required, so the array must contain at least 3 items.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref(metav1.Condition{}.OpenAPIModelName()), + }, + }, + }, + }, + }, + "lastUpdated": { + SchemaProps: spec.SchemaProps{ + Description: "lastUpdated is the timestamp when this status was last updated. This is useful for identifying stale status reports. It must be a valid timestamp in RFC3339 format. Once set, this field cannot be removed and cannot be set to an earlier timestamp than the current value.", + Ref: ref(metav1.Time{}.OpenAPIModelName()), + }, + }, + "nodes": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "nodeName", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "nodes provides detailed status for each control-plane node in the Pacemaker cluster. While Pacemaker supports up to 32 nodes, the limit is set to 5 (max OpenShift control-plane nodes). For Two Node OpenShift with Fencing, exactly 2 nodes are expected in a healthy cluster. An empty list indicates a catastrophic failure where Pacemaker reports no nodes.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/etcd/v1.PacemakerClusterNodeStatus"), + }, + }, + }, + }, + }, + }, + Required: []string{"conditions", "lastUpdated", "nodes"}, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/etcd/v1.PacemakerClusterNodeStatus", metav1.Condition{}.OpenAPIModelName(), metav1.Time{}.OpenAPIModelName()}, + } +} + +func schema_openshift_api_etcd_v1_PacemakerNodeAddress(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "PacemakerNodeAddress contains information for a node's address. This is similar to corev1.NodeAddress but adds validation for IP addresses.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "type": { + SchemaProps: spec.SchemaProps{ + Description: "type is the type of node address. Currently only \"InternalIP\" is supported.\n\nPossible enum values:\n - `\"InternalIP\"` is an internal IP address assigned to the node. This is typically the IP address used for intra-cluster communication.", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"InternalIP"}, + }, + }, + "address": { + SchemaProps: spec.SchemaProps{ + Description: "address is the node address. For InternalIP, this must be a valid global unicast IPv4 or IPv6 address in canonical form. Canonical form means the shortest standard representation (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). Maximum length is 39 characters (full IPv6 address). Global unicast includes private/RFC1918 addresses but excludes loopback, link-local, and multicast.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"type", "address"}, + }, + }, + } +} + func schema_openshift_api_etcd_v1alpha1_PacemakerCluster(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -27410,7 +28759,7 @@ func schema_openshift_api_etcd_v1alpha1_PacemakerClusterNodeStatus(ref common.Re }, }, SchemaProps: spec.SchemaProps{ - Description: "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. Expected to have 1 fencing agent per node, but up to 8 are supported for redundancy. Names must be unique within this array.", + Description: "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. A healthy node is expected to have at least 1 fencing agent, but the list may be empty when fencing agent discovery fails. Names must be unique within this array.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ @@ -45607,342 +46956,6 @@ func schema_openshift_api_machineconfiguration_v1alpha1_InternalReleaseImageStat } } -func schema_openshift_api_machineconfiguration_v1alpha1_MCOObjectReference(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MCOObjectReference holds information about an object the MCO either owns or modifies in some way", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "name": { - SchemaProps: spec.SchemaProps{ - Description: "name is the name of the object being referenced. For example, this can represent a machine config pool or node name. Must be a lowercase RFC-1123 subdomain name (https://tools.ietf.org/html/rfc1123) consisting of only lowercase alphanumeric characters, hyphens (-), and periods (.), and must start and end with an alphanumeric character, and be at most 253 characters in length.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"name"}, - }, - }, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNode(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNode describes the health of the Machines on the system Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard object metadata.", - Default: map[string]interface{}{}, - Ref: ref(metav1.ObjectMeta{}.OpenAPIModelName()), - }, - }, - "spec": { - SchemaProps: spec.SchemaProps{ - Description: "spec describes the configuration of the machine config node.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeSpec"), - }, - }, - "status": { - SchemaProps: spec.SchemaProps{ - Description: "status describes the last observed state of this machine config node.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatus"), - }, - }, - }, - Required: []string{"spec"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeSpec", "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeList(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNodeList describes all of the MachinesStates on the system\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard list metadata.", - Default: map[string]interface{}{}, - Ref: ref(metav1.ListMeta{}.OpenAPIModelName()), - }, - }, - "items": { - SchemaProps: spec.SchemaProps{ - Description: "items contains a collection of MachineConfigNode resources.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNode"), - }, - }, - }, - }, - }, - }, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNode", metav1.ListMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNodeSpec describes the MachineConfigNode we are managing.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "node": { - SchemaProps: spec.SchemaProps{ - Description: "node contains a reference to the node for this machine config node.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MCOObjectReference"), - }, - }, - "pool": { - SchemaProps: spec.SchemaProps{ - Description: "pool contains a reference to the machine config pool that this machine config node's referenced node belongs to.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MCOObjectReference"), - }, - }, - "configVersion": { - SchemaProps: spec.SchemaProps{ - Description: "configVersion holds the desired config version for the node targeted by this machine config node resource. The desired version represents the machine config the node will attempt to update to and gets set before the machine config operator validates the new machine config against the current machine config.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeSpecMachineConfigVersion"), - }, - }, - }, - Required: []string{"node", "pool", "configVersion"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.MCOObjectReference", "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeSpecMachineConfigVersion"}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeSpecMachineConfigVersion(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNodeSpecMachineConfigVersion holds the desired config version for the current observed machine config node. When Current is not equal to Desired, the MachineConfigOperator is in an upgrade phase and the machine config node will take account of upgrade related events. Otherwise, they will be ignored given that certain operations happen both during the MCO's upgrade mode and the daily operations mode.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "desired": { - SchemaProps: spec.SchemaProps{ - Description: "desired is the name of the machine config that the the node should be upgraded to. This value is set when the machine config pool generates a new version of its rendered configuration. When this value is changed, the machine config daemon starts the node upgrade process. This value gets set in the machine config node spec once the machine config has been targeted for upgrade and before it is validated. Must be a lowercase RFC-1123 subdomain name (https://tools.ietf.org/html/rfc1123) consisting of only lowercase alphanumeric characters, hyphens (-), and periods (.), and must start and end with an alphanumeric character, and be at most 253 characters in length.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"desired"}, - }, - }, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNodeStatus holds the reported information on a particular machine config node.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "conditions": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ - "type", - }, - "x-kubernetes-list-type": "map", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "conditions represent the observations of a machine config node's current state.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(metav1.Condition{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - "observedGeneration": { - SchemaProps: spec.SchemaProps{ - Description: "observedGeneration represents the generation of the MachineConfigNode object observed by the Machine Config Operator's controller. This field is updated when the controller observes a change to the desiredConfig in the configVersion of the machine config node spec.", - Type: []string{"integer"}, - Format: "int64", - }, - }, - "configVersion": { - SchemaProps: spec.SchemaProps{ - Description: "configVersion describes the current and desired machine config version for this node.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatusMachineConfigVersion"), - }, - }, - "pinnedImageSets": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ - "name", - }, - "x-kubernetes-list-type": "map", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "pinnedImageSets describes the current and desired pinned image sets for this node.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatusPinnedImageSet"), - }, - }, - }, - }, - }, - }, - Required: []string{"configVersion"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatusMachineConfigVersion", "github.com/openshift/api/machineconfiguration/v1alpha1.MachineConfigNodeStatusPinnedImageSet", metav1.Condition{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeStatusMachineConfigVersion(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNodeStatusMachineConfigVersion holds the current and desired config versions as last updated in the MCN status. When the current and desired versions do not match, the machine config pool is processing an upgrade and the machine config node will monitor the upgrade process. When the current and desired versions do match, the machine config node will ignore these events given that certain operations happen both during the MCO's upgrade mode and the daily operations mode.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "current": { - SchemaProps: spec.SchemaProps{ - Description: "current is the name of the machine config currently in use on the node. This value is updated once the machine config daemon has completed the update of the configuration for the node. This value should match the desired version unless an upgrade is in progress. Must be a lowercase RFC-1123 subdomain name (https://tools.ietf.org/html/rfc1123) consisting of only lowercase alphanumeric characters, hyphens (-), and periods (.), and must start and end with an alphanumeric character, and be at most 253 characters in length.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "desired": { - SchemaProps: spec.SchemaProps{ - Description: "desired is the MachineConfig the node wants to upgrade to. This value gets set in the machine config node status once the machine config has been validated against the current machine config. Must be a lowercase RFC-1123 subdomain name (https://tools.ietf.org/html/rfc1123) consisting of only lowercase alphanumeric characters, hyphens (-), and periods (.), and must start and end with an alphanumeric character, and be at most 253 characters in length.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"desired"}, - }, - }, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_MachineConfigNodeStatusPinnedImageSet(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "MachineConfigNodeStatusPinnedImageSet holds information about the current, desired, and failed pinned image sets for the observed machine config node.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "name": { - SchemaProps: spec.SchemaProps{ - Description: "name is the name of the pinned image set. Must be a lowercase RFC-1123 subdomain name (https://tools.ietf.org/html/rfc1123) consisting of only lowercase alphanumeric characters, hyphens (-), and periods (.), and must start and end with an alphanumeric character, and be at most 253 characters in length.", - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - "currentGeneration": { - SchemaProps: spec.SchemaProps{ - Description: "currentGeneration is the generation of the pinned image set that has most recently been successfully pulled and pinned on this node.", - Type: []string{"integer"}, - Format: "int32", - }, - }, - "desiredGeneration": { - SchemaProps: spec.SchemaProps{ - Description: "desiredGeneration is the generation of the pinned image set that is targeted to be pulled and pinned on this node.", - Type: []string{"integer"}, - Format: "int32", - }, - }, - "lastFailedGeneration": { - SchemaProps: spec.SchemaProps{ - Description: "lastFailedGeneration is the generation of the most recent pinned image set that failed to be pulled and pinned on this node.", - Type: []string{"integer"}, - Format: "int32", - }, - }, - "lastFailedGenerationError": { - SchemaProps: spec.SchemaProps{ - Description: "lastFailedGenerationError is the error explaining why the desired images failed to be pulled and pinned. The error is an empty string if the image pull and pin is successful.", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"name"}, - }, - }, - } -} - func schema_openshift_api_machineconfiguration_v1alpha1_OSImageStream(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -46086,7 +47099,7 @@ func schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamSpec(ref co Properties: map[string]spec.Schema{ "defaultStream": { SchemaProps: spec.SchemaProps{ - Description: "defaultStream is the desired name of the stream that should be used as the default when no specific stream is requested by a MachineConfigPool.\n\nThis field is set by the installer during installation. Users may need to update it if the currently selected stream is no longer available, for example when the stream has reached its End of Life. The MachineConfigOperator uses this value to determine which stream from status.availableStreams to apply as the default for MachineConfigPools that do not specify a stream override.\n\nWhen status.availableStreams has been populated by the operator, updating this field requires that the new value references the name of one of the streams in status.availableStreams. Status-only updates by the operator are not subject to this constraint, allowing the operator to update availableStreams independently of this field. During initial creation, before the operator has populated status, any valid value is accepted.\n\nWhen omitted, the operator determines the default stream automatically.\n\nIt must be a valid RFC 1123 subdomain between 1 and 253 characters in length, consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').", + Description: "defaultStream is the desired name of the stream that should be used as the default when no specific stream is requested by a MachineConfigPool.\n\nThis field is set by the installer during installation. Users may need to update it if the currently selected stream is no longer available, for example when the stream has reached its End of Life. The MachineConfigOperator uses this value to determine which stream from status.availableStreams to apply as the default for MachineConfigPools that do not specify a stream override.\n\nWhen status.availableStreams has been populated by the operator, updating this field requires that the new value references the name of one of the streams in status.availableStreams. Status-only updates by the operator are not subject to this constraint, allowing the operator to update availableStreams independently of this field. During initial creation, before the operator has populated status, any valid value is accepted.\n\nWhen omitted, the operator determines the default stream automatically. Once set, this field cannot be removed.\n\nIt must be a valid RFC 1123 subdomain between 1 and 253 characters in length, consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').", Type: []string{"string"}, Format: "", }, @@ -46142,201 +47155,6 @@ func schema_openshift_api_machineconfiguration_v1alpha1_OSImageStreamStatus(ref } } -func schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageRef(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "name": { - SchemaProps: spec.SchemaProps{ - Description: "name is an OCI Image referenced by digest. The format of the image pull spec is: host[:port][/namespace]/name@sha256:, where the digest must be 64 characters long, and consist only of lowercase hexadecimal characters, a-f and 0-9. The length of the whole spec must be between 1 to 447 characters.", - Type: []string{"string"}, - Format: "", - }, - }, - }, - Required: []string{"name"}, - }, - }, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSet(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PinnedImageSet describes a set of images that should be pinned by CRI-O and pulled to the nodes which are members of the declared MachineConfigPools.\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(metav1.ObjectMeta{}.OpenAPIModelName()), - }, - }, - "spec": { - SchemaProps: spec.SchemaProps{ - Description: "spec describes the configuration of this pinned image set.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetSpec"), - }, - }, - "status": { - SchemaProps: spec.SchemaProps{ - Description: "status describes the last observed state of this pinned image set.", - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetStatus"), - }, - }, - }, - Required: []string{"spec"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetSpec", "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSetStatus", metav1.ObjectMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSetList(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PinnedImageSetList is a list of PinnedImageSet resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "metadata": { - SchemaProps: spec.SchemaProps{ - Description: "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - Default: map[string]interface{}{}, - Ref: ref(metav1.ListMeta{}.OpenAPIModelName()), - }, - }, - "items": { - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSet"), - }, - }, - }, - }, - }, - }, - Required: []string{"metadata", "items"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageSet", metav1.ListMeta{}.OpenAPIModelName()}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSetSpec(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PinnedImageSetSpec defines the desired state of a PinnedImageSet.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "pinnedImages": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ - "name", - }, - "x-kubernetes-list-type": "map", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "pinnedImages is a list of OCI Image referenced by digest that should be pinned and pre-loaded by the nodes of a MachineConfigPool. Translates into a new file inside the /etc/crio/crio.conf.d directory with content similar to this:\n\n pinned_images = [\n \"quay.io/openshift-release-dev/ocp-release@sha256:...\",\n \"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...\",\n \"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...\",\n ...\n ]\n\nThese image references should all be by digest, tags aren't allowed.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref("github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageRef"), - }, - }, - }, - }, - }, - }, - Required: []string{"pinnedImages"}, - }, - }, - Dependencies: []string{ - "github.com/openshift/api/machineconfiguration/v1alpha1.PinnedImageRef"}, - } -} - -func schema_openshift_api_machineconfiguration_v1alpha1_PinnedImageSetStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "PinnedImageSetStatus describes the current state of a PinnedImageSet.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "conditions": { - VendorExtensible: spec.VendorExtensible{ - Extensions: spec.Extensions{ - "x-kubernetes-list-map-keys": []interface{}{ - "type", - }, - "x-kubernetes-list-type": "map", - }, - }, - SchemaProps: spec.SchemaProps{ - Description: "conditions represent the observations of a pinned image set's current state.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: map[string]interface{}{}, - Ref: ref(metav1.Condition{}.OpenAPIModelName()), - }, - }, - }, - }, - }, - }, - }, - }, - Dependencies: []string{ - metav1.Condition{}.OpenAPIModelName()}, - } -} - func schema_openshift_api_monitoring_v1_AlertRelabelConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -50124,7 +50942,7 @@ func schema_openshift_api_operator_v1_AWSCSIDriverConfigSpec(ref common.Referenc Properties: map[string]spec.Schema{ "kmsKeyARN": { SchemaProps: spec.SchemaProps{ - Description: "kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key.", + Description: "kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key.\n\nThe ARN must follow the format: arn::kms:::(key|alias)/, where: is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), is the AWS region, is a 12-digit numeric identifier for the AWS account, is the KMS key ID or alias name.", Type: []string{"string"}, Format: "", }, @@ -50863,6 +51681,35 @@ func schema_openshift_api_operator_v1_AzureDiskEncryptionSet(ref common.Referenc } } +func schema_openshift_api_operator_v1_BGPManagedConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "BGPManagedConfig contains configuration options for BGP when routing is \"Managed\".", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "asNumber": { + SchemaProps: spec.SchemaProps{ + Description: "asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) to be used in the generated FRR configuration. Valid values are 1 to 4294967295. When omitted, this defaults to 64512.", + Default: 64512, + Type: []string{"integer"}, + Format: "int64", + }, + }, + "bgpTopology": { + SchemaProps: spec.SchemaProps{ + Description: "bgpTopology defines the BGP topology to be used. Allowed values are \"FullMesh\". When set to \"FullMesh\", every node peers directly with every other node via BGP. This field is required when BGPManagedConfig is specified.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"bgpTopology"}, + }, + }, + } +} + func schema_openshift_api_operator_v1_BootImageSkewEnforcementConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -55525,6 +56372,14 @@ func schema_openshift_api_operator_v1_IngressControllerTuningOptions(ref common. Ref: ref(metav1.Duration{}.OpenAPIModelName()), }, }, + "configurationManagement": { + SchemaProps: spec.SchemaProps{ + Description: "configurationManagement specifies how OpenShift router should update the HAProxy configuration. The following values are valid for this field:\n\n* \"ForkAndReload\". * \"Dynamic\".\n\nOmitting this field means that the user has no opinion and the platform may choose a reasonable default. This default is subject to change over time. The current default is \"ForkAndReload\".\n\n\"ForkAndReload\" means that OpenShift router should rewrite the HAProxy configuration file and instruct HAProxy to fork and reload. This is OpenShift router's traditional approach.\n\n\"Dynamic\" means that OpenShift router may use HAProxy's control socket for some configuration updates and fall back to fork and reload for other configuration updates. This is a newer approach, which may be less mature than ForkAndReload. This setting can improve load-balancing fairness and metrics accuracy and reduce CPU and memory usage if HAProxy has frequent configuration updates for route and endpoints updates.\n\nNote: The \"Dynamic\" option is currently experimental and should not be enabled on production clusters.\n\n\nPossible enum values:\n - `\"Dynamic\"`\n - `\"ForkAndReload\"`", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"Dynamic", "ForkAndReload"}, + }, + }, }, }, }, @@ -58221,6 +59076,34 @@ func schema_openshift_api_operator_v1_NetworkStatus(ref common.ReferenceCallback } } +func schema_openshift_api_operator_v1_NoOverlayConfig(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "NoOverlayConfig contains configuration options for networks operating in no-overlay mode.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "outboundSNAT": { + SchemaProps: spec.SchemaProps{ + Description: "outboundSNAT defines the SNAT behavior for outbound traffic from pods. Allowed values are \"Enabled\" and \"Disabled\". When set to \"Enabled\", SNAT is performed on outbound traffic from pods. When set to \"Disabled\", SNAT is not performed and pod IPs are preserved in outbound traffic. This field is required when the network operates in no-overlay mode. This field can be set to any value at installation time and can be changed afterwards.", + Type: []string{"string"}, + Format: "", + }, + }, + "routing": { + SchemaProps: spec.SchemaProps{ + Description: "routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. Allowed values are \"Managed\" and \"Unmanaged\". When set to \"Managed\", OVN-Kubernetes manages the pod network routing configuration through BGP. When set to \"Unmanaged\", users are responsible for configuring the pod network routing. This field is required when the network operates in no-overlay mode. This field is immutable once set.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"outboundSNAT", "routing"}, + }, + }, + } +} + func schema_openshift_api_operator_v1_NodeDisruptionPolicyClusterStatus(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -59210,11 +60093,32 @@ func schema_openshift_api_operator_v1_OVNKubernetesConfig(ref common.ReferenceCa Format: "", }, }, + "transport": { + SchemaProps: spec.SchemaProps{ + Description: "transport sets the transport mode for pods on the default network. Allowed values are \"NoOverlay\" and \"Geneve\". \"NoOverlay\" avoids tunnel encapsulation, routing pod traffic directly between nodes. \"Geneve\" encapsulates pod traffic using Geneve tunnels between nodes. When omitted, this means the user has no opinion and the platform chooses a reasonable default which is subject to change over time. The current default is \"Geneve\". \"NoOverlay\" can only be set at installation time and cannot be changed afterwards. \"Geneve\" may be set explicitly at any time to lock in the current default.", + Type: []string{"string"}, + Format: "", + }, + }, + "noOverlayConfig": { + SchemaProps: spec.SchemaProps{ + Description: "noOverlayConfig contains configuration for no-overlay mode. This configuration applies to the default network only. It is required when transport is \"NoOverlay\". When omitted, this means the user does not configure no-overlay mode options.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/operator/v1.NoOverlayConfig"), + }, + }, + "bgpManagedConfig": { + SchemaProps: spec.SchemaProps{ + Description: "bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) in no-overlay mode that specify routing=\"Managed\" in their noOverlayConfig. It is required when noOverlayConfig.routing is set to \"Managed\". When omitted, this means the user does not configure BGP for managed routing. This field can be set at installation time or on day 2, and can be modified at any time.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/operator/v1.BGPManagedConfig"), + }, + }, }, }, }, Dependencies: []string{ - "github.com/openshift/api/operator/v1.EgressIPConfig", "github.com/openshift/api/operator/v1.GatewayConfig", "github.com/openshift/api/operator/v1.HybridOverlayConfig", "github.com/openshift/api/operator/v1.IPsecConfig", "github.com/openshift/api/operator/v1.IPv4OVNKubernetesConfig", "github.com/openshift/api/operator/v1.IPv6OVNKubernetesConfig", "github.com/openshift/api/operator/v1.PolicyAuditConfig"}, + "github.com/openshift/api/operator/v1.BGPManagedConfig", "github.com/openshift/api/operator/v1.EgressIPConfig", "github.com/openshift/api/operator/v1.GatewayConfig", "github.com/openshift/api/operator/v1.HybridOverlayConfig", "github.com/openshift/api/operator/v1.IPsecConfig", "github.com/openshift/api/operator/v1.IPv4OVNKubernetesConfig", "github.com/openshift/api/operator/v1.IPv6OVNKubernetesConfig", "github.com/openshift/api/operator/v1.NoOverlayConfig", "github.com/openshift/api/operator/v1.PolicyAuditConfig"}, } } @@ -62274,6 +63178,13 @@ func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponent(ref com Description: "ClusterAPIInstallerComponent defines a component which will be installed by this revision.", Type: []string{"object"}, Properties: map[string]spec.Schema{ + "name": { + SchemaProps: spec.SchemaProps{ + Description: "name is the human-readable name of the component. The value has no effect, and will not be set if the component does not define a name in its manifests. If set it must consist of alphanumeric characters, or '-', and may not exceed 255 characters.", + Type: []string{"string"}, + Format: "", + }, + }, "type": { SchemaProps: spec.SchemaProps{ Description: "type is the source type of the component. The only valid value is Image. When set to Image, the image field must be set and will define an image source for the component.\n\nPossible enum values:\n - `\"Image\"` is an image source for a component.", @@ -62338,6 +63249,49 @@ func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponentImage(re } } +func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerComponentSource(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "ClusterAPIInstallerComponentSource defines the source of a component which will be installed by this revision.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "type": { + SchemaProps: spec.SchemaProps{ + Description: "type is the source type of the component. The only valid value is Image. When set to Image, the image field must be set and will define an image source for the component.\n\nPossible enum values:\n - `\"Image\"` is an image source for a component.", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"Image"}, + }, + }, + "image": { + SchemaProps: spec.SchemaProps{ + Description: "image defines an image source for a component. The image must contain a /capi-operator-installer directory containing the component manifests.", + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponentImage"), + }, + }, + }, + Required: []string{"type"}, + }, + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-unions": []interface{}{ + map[string]interface{}{ + "discriminator": "type", + "fields-to-discriminateBy": map[string]interface{}{ + "image": "Image", + }, + }, + }, + }, + }, + }, + Dependencies: []string{ + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponentImage"}, + } +} + func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevision(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -62385,6 +63339,28 @@ func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevision(ref comm }, }, }, + "manifestSubstitutions": { + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-list-map-keys": []interface{}{ + "key", + }, + "x-kubernetes-list-type": "map", + }, + }, + SchemaProps: spec.SchemaProps{ + Description: "manifestSubstitutions is a list of envsubst style substitutions which will be applied to manifests in the revision during rendering. If defined it must not be empty, and may not contain more than 32 items. Each manifest substitution must have a unique key.", + Type: []string{"array"}, + Items: &spec.SchemaOrArray{ + Schema: &spec.Schema{ + SchemaProps: spec.SchemaProps{ + Default: map[string]interface{}{}, + Ref: ref("github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerRevisionManifestSubstitution"), + }, + }, + }, + }, + }, "components": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ @@ -62414,7 +63390,35 @@ func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevision(ref comm }, }, Dependencies: []string{ - "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponent"}, + "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerComponent", "github.com/openshift/api/operator/v1alpha1.ClusterAPIInstallerRevisionManifestSubstitution"}, + } +} + +func schema_openshift_api_operator_v1alpha1_ClusterAPIInstallerRevisionManifestSubstitution(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "ClusterAPIInstallerRevisionManifestSubstitution defines an envsubst style substitution which will be applied to manifests in a revision during rendering.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "key": { + SchemaProps: spec.SchemaProps{ + Description: "key is the name of the envsubst variable to substitute. It must be a valid envsubst variable name, consisting of letters, digits, and underscores, and must start with a letter or underscore. The key must not be empty, and must not exceed 255 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + "value": { + SchemaProps: spec.SchemaProps{ + Description: "value is the value to substitute for the envsubst variable. It may be empty, in which case the variable will be substituted with an empty string. The value must not exceed 4096 characters.", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"key", "value"}, + }, + }, } } @@ -62542,6 +63546,13 @@ func schema_openshift_api_operator_v1alpha1_ClusterAPIStatus(ref common.Referenc }, }, }, + "observedRevisionGeneration": { + SchemaProps: spec.SchemaProps{ + Description: "observedRevisionGeneration is the generation of the ClusterAPI object that was last observed by the revision controller. If specified it must be greater than or equal to 1, and less than 2^53. It may not decrease or be unset once set.", + Type: []string{"integer"}, + Format: "int64", + }, + }, }, Required: []string{"desiredRevision", "revisions"}, }, diff --git a/vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.go b/vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.go index 53c71aabb6..52f5db78d5 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.go +++ b/vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.go @@ -163,7 +163,15 @@ type AWSCSIDriverConfigSpec struct { // kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, // rather than the default KMS key used by AWS. // The value may be either the ARN or Alias ARN of a KMS key. - // +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)\/.*$` + // + // The ARN must follow the format: arn::kms:::(key|alias)/, where: + // is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + // is the AWS region, + // is a 12-digit numeric identifier for the AWS account, + // is the KMS key ID or alias name. + // + // +openshift:validation:FeatureGateAwareXValidation:featureGate="",rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')`,message=`kmsKeyARN must be a valid AWS KMS key ARN in the format: arn::kms:::(key|alias)/` + // +openshift:validation:FeatureGateAwareXValidation:featureGate=AWSEuropeanSovereignCloudInstall,rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')`,message=`kmsKeyARN must be a valid AWS KMS key ARN in the format: arn::kms:::(key|alias)/` // +optional KMSKeyARN string `json:"kmsKeyARN,omitempty"` diff --git a/vendor/github.com/openshift/api/operator/v1/types_ingress.go b/vendor/github.com/openshift/api/operator/v1/types_ingress.go index d54352f2ce..0c5cf919e1 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_ingress.go +++ b/vendor/github.com/openshift/api/operator/v1/types_ingress.go @@ -2068,8 +2068,51 @@ type IngressControllerTuningOptions struct { // +kubebuilder:validation:Type:=string // +optional ReloadInterval metav1.Duration `json:"reloadInterval,omitempty"` + + // configurationManagement specifies how OpenShift router should update + // the HAProxy configuration. The following values are valid for this + // field: + // + // * "ForkAndReload". + // * "Dynamic". + // + // Omitting this field means that the user has no opinion and the + // platform may choose a reasonable default. This default is subject to + // change over time. The current default is "ForkAndReload". + // + // "ForkAndReload" means that OpenShift router should rewrite the + // HAProxy configuration file and instruct HAProxy to fork and reload. + // This is OpenShift router's traditional approach. + // + // "Dynamic" means that OpenShift router may use HAProxy's control + // socket for some configuration updates and fall back to fork and + // reload for other configuration updates. This is a newer approach, + // which may be less mature than ForkAndReload. This setting can + // improve load-balancing fairness and metrics accuracy and reduce CPU + // and memory usage if HAProxy has frequent configuration updates for + // route and endpoints updates. + // + // Note: The "Dynamic" option is currently experimental and should not + // be enabled on production clusters. + // + // +openshift:enable:FeatureGate=IngressControllerDynamicConfigurationManager + // +optional + ConfigurationManagement IngressControllerConfigurationManagement `json:"configurationManagement,omitempty"` } +// IngressControllerConfigurationManagement specifies whether always to use +// fork-and-reload to update the HAProxy configuration or whether to use +// HAProxy's control socket for some configuration updates. +// +// +enum +// +kubebuilder:validation:Enum=Dynamic;ForkAndReload +type IngressControllerConfigurationManagement string + +const ( + IngressControllerConfigurationManagementDynamic IngressControllerConfigurationManagement = "Dynamic" + IngressControllerConfigurationManagementForkAndReload IngressControllerConfigurationManagement = "ForkAndReload" +) + // HTTPEmptyRequestsPolicy indicates how HTTP connections for which no request // is received should be handled. // +kubebuilder:validation:Enum=Respond;Ignore diff --git a/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go b/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go index f5836af0f8..f0c1e01c78 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go +++ b/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go @@ -47,7 +47,6 @@ type MachineConfigurationSpec struct { // and the platform is left to choose a reasonable default, which is subject to change over time. // The default for each machine manager mode is All for GCP and AWS platforms, and None for all // other platforms. - // +openshift:enable:FeatureGate=ManagedBootImages // +optional ManagedBootImages ManagedBootImages `json:"managedBootImages"` @@ -288,7 +287,6 @@ type MachineConfigurationStatus struct { // managedBootImagesStatus reflects what the latest cluster-validated boot image configuration is // and will be used by Machine Config Controller while performing boot image updates. - // +openshift:enable:FeatureGate=ManagedBootImages // +optional ManagedBootImagesStatus ManagedBootImages `json:"managedBootImagesStatus"` @@ -367,7 +365,7 @@ type ManagedBootImages struct { // MachineManager describes a target machine resource that is registered for boot image updates. It stores identifying information // such as the resource type and the API Group of the resource. It also provides granular control via the selection field. -// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=ManagedBootImages;ManagedBootImagesCPMS,rule="self.resource != 'controlplanemachinesets' || self.selection.mode == 'All' || self.selection.mode == 'None'", message="Only All or None selection mode is permitted for ControlPlaneMachineSets" +// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=ManagedBootImagesCPMS,rule="self.resource != 'controlplanemachinesets' || self.selection.mode == 'All' || self.selection.mode == 'None'", message="Only All or None selection mode is permitted for ControlPlaneMachineSets" type MachineManager struct { // resource is the machine management resource's type. // Valid values are machinesets and controlplanemachinesets. @@ -431,8 +429,8 @@ const ( // MachineManagerManagedResourceType is a string enum used in the MachineManager type to describe the resource // type to be registered. -// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=ManagedBootImages,enum=machinesets -// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=ManagedBootImages;ManagedBootImagesCPMS,enum=machinesets;controlplanemachinesets +// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=machinesets +// +openshift:validation:FeatureGateAwareEnum:featureGate=ManagedBootImagesCPMS,enum=machinesets;controlplanemachinesets type MachineManagerMachineSetsResourceType string const ( diff --git a/vendor/github.com/openshift/api/operator/v1/types_network.go b/vendor/github.com/openshift/api/operator/v1/types_network.go index 1cf56f549b..cd2e2f9e38 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_network.go +++ b/vendor/github.com/openshift/api/operator/v1/types_network.go @@ -398,6 +398,12 @@ type OpenShiftSDNConfig struct { // ovnKubernetesConfig contains the configuration parameters for networks // using the ovn-kubernetes network project +// +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="self.?transport.orValue('') == 'NoOverlay' ? self.?routeAdvertisements.orValue('') == 'Enabled' : true",message="routeAdvertisements must be Enabled when transport is NoOverlay" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="self.?transport.orValue('') == 'NoOverlay' ? has(self.noOverlayConfig) : !has(self.noOverlayConfig)",message="noOverlayConfig must be set if transport is NoOverlay, and is forbidden otherwise" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="self.?noOverlayConfig.routing.orValue('') == 'Managed' ? has(self.bgpManagedConfig) : true",message="bgpManagedConfig is required when noOverlayConfig.routing is Managed" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="!has(self.transport) || self.transport == 'Geneve' || has(oldSelf.transport)",message="transport can only be set to Geneve after installation" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="!has(oldSelf.transport) || has(self.transport)",message="transport may not be removed once set" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="!has(oldSelf.noOverlayConfig) || has(self.noOverlayConfig)",message="noOverlayConfig may not be removed once set" type OVNKubernetesConfig struct { // mtu is the MTU to use for the tunnel interface. This must be 100 // bytes smaller than the uplink mtu. @@ -466,6 +472,38 @@ type OVNKubernetesConfig struct { // current default is "Disabled". // +optional RouteAdvertisements RouteAdvertisementsEnablement `json:"routeAdvertisements,omitempty"` + + // transport sets the transport mode for pods on the default network. + // Allowed values are "NoOverlay" and "Geneve". + // "NoOverlay" avoids tunnel encapsulation, routing pod traffic directly between nodes. + // "Geneve" encapsulates pod traffic using Geneve tunnels between nodes. + // When omitted, this means the user has no opinion and the platform chooses + // a reasonable default which is subject to change over time. + // The current default is "Geneve". + // "NoOverlay" can only be set at installation time and cannot be changed afterwards. + // "Geneve" may be set explicitly at any time to lock in the current default. + // +openshift:enable:FeatureGate=NoOverlayMode + // +kubebuilder:validation:Enum=NoOverlay;Geneve + // +openshift:validation:FeatureGateAwareXValidation:featureGate=NoOverlayMode,rule="self == oldSelf",message="transport is immutable once set" + // +optional + Transport TransportOption `json:"transport,omitempty"` + + // noOverlayConfig contains configuration for no-overlay mode. + // This configuration applies to the default network only. + // It is required when transport is "NoOverlay". + // When omitted, this means the user does not configure no-overlay mode options. + // +openshift:enable:FeatureGate=NoOverlayMode + // +optional + NoOverlayConfig NoOverlayConfig `json:"noOverlayConfig,omitzero,omitempty"` + + // bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) + // in no-overlay mode that specify routing="Managed" in their noOverlayConfig. + // It is required when noOverlayConfig.routing is set to "Managed". + // When omitted, this means the user does not configure BGP for managed routing. + // This field can be set at installation time or on day 2, and can be modified at any time. + // +openshift:enable:FeatureGate=NoOverlayMode + // +optional + BGPManagedConfig BGPManagedConfig `json:"bgpManagedConfig,omitzero,omitempty"` } type IPv4OVNKubernetesConfig struct { @@ -896,3 +934,80 @@ type AdditionalRoutingCapabilities struct { // +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x == y))" Providers []RoutingCapabilitiesProvider `json:"providers"` } + +// TransportOption is the type for network transport options +type TransportOption string + +// SNATOption is the type for SNAT configuration options +type SNATOption string + +// RoutingOption is the type for routing configuration options +type RoutingOption string + +// BGPTopology is the type for BGP topology configuration +type BGPTopology string + +const ( + // TransportOptionNoOverlay indicates the network operates in no-overlay mode + TransportOptionNoOverlay TransportOption = "NoOverlay" + // TransportOptionGeneve indicates the network uses Geneve overlay + TransportOptionGeneve TransportOption = "Geneve" + + // SNATEnabled indicates outbound SNAT is enabled + SNATEnabled SNATOption = "Enabled" + // SNATDisabled indicates outbound SNAT is disabled + SNATDisabled SNATOption = "Disabled" + + // RoutingManaged indicates routing is managed by OVN-Kubernetes + RoutingManaged RoutingOption = "Managed" + // RoutingUnmanaged indicates routing is managed by users + RoutingUnmanaged RoutingOption = "Unmanaged" + + // BGPTopologyFullMesh indicates a full mesh BGP topology where every node peers directly with every other node + BGPTopologyFullMesh BGPTopology = "FullMesh" +) + +// NoOverlayConfig contains configuration options for networks operating in no-overlay mode. +type NoOverlayConfig struct { + // outboundSNAT defines the SNAT behavior for outbound traffic from pods. + // Allowed values are "Enabled" and "Disabled". + // When set to "Enabled", SNAT is performed on outbound traffic from pods. + // When set to "Disabled", SNAT is not performed and pod IPs are preserved in outbound traffic. + // This field is required when the network operates in no-overlay mode. + // This field can be set to any value at installation time and can be changed afterwards. + // +kubebuilder:validation:Enum=Enabled;Disabled + // +required + OutboundSNAT SNATOption `json:"outboundSNAT,omitempty"` + + // routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. + // Allowed values are "Managed" and "Unmanaged". + // When set to "Managed", OVN-Kubernetes manages the pod network routing configuration through BGP. + // When set to "Unmanaged", users are responsible for configuring the pod network routing. + // This field is required when the network operates in no-overlay mode. + // This field is immutable once set. + // +kubebuilder:validation:Enum=Managed;Unmanaged + // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="routing is immutable once set" + // +required + Routing RoutingOption `json:"routing,omitempty"` +} + +// BGPManagedConfig contains configuration options for BGP when routing is "Managed". +type BGPManagedConfig struct { + // asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) + // to be used in the generated FRR configuration. + // Valid values are 1 to 4294967295. + // When omitted, this defaults to 64512. + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=4294967295 + // +default=64512 + // +optional + ASNumber int64 `json:"asNumber,omitempty"` + + // bgpTopology defines the BGP topology to be used. + // Allowed values are "FullMesh". + // When set to "FullMesh", every node peers directly with every other node via BGP. + // This field is required when BGPManagedConfig is specified. + // +kubebuilder:validation:Enum=FullMesh + // +required + BGPTopology BGPTopology `json:"bgpTopology,omitempty"` +} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-Default.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-Default.crd.yaml deleted file mode 100644 index 3e7c51dc6f..0000000000 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-Default.crd.yaml +++ /dev/null @@ -1,335 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.openshift.io: https://github.com/openshift/api/pull/475 - api.openshift.io/merged-by-featuregates: "true" - include.release.openshift.io/ibm-cloud-managed: "true" - include.release.openshift.io/self-managed-high-availability: "true" - release.openshift.io/feature-set: Default - name: kubeapiservers.operator.openshift.io -spec: - group: operator.openshift.io - names: - categories: - - coreoperators - kind: KubeAPIServer - listKind: KubeAPIServerList - plural: kubeapiservers - singular: kubeapiserver - scope: Cluster - versions: - - name: v1 - schema: - openAPIV3Schema: - description: |- - KubeAPIServer provides information to configure an operator to manage kube-apiserver. - - Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: spec is the specification of the desired behavior of the - Kubernetes API Server - properties: - failedRevisionLimit: - description: |- - failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - forceRedeploymentReason: - description: |- - forceRedeploymentReason can be used to force the redeployment of the operand by providing a unique string. - This provides a mechanism to kick a previously failed deployment and provide a reason why you think it will work - this time instead of failing again on the same config. - type: string - logLevel: - default: Normal - description: |- - logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for their operands. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - managementState: - description: managementState indicates whether and how the operator - should manage the component - pattern: ^(Managed|Force)$ - type: string - observedConfig: - description: |- - observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because - it is an input to the level for the operator - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - operatorLogLevel: - default: Normal - description: |- - operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for themselves. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - succeededRevisionLimit: - description: |- - succeededRevisionLimit is the number of successful static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - unsupportedConfigOverrides: - description: |- - unsupportedConfigOverrides overrides the final configuration that was computed by the operator. - Red Hat does not support the use of this field. - Misuse of this field could lead to unexpected behavior or conflict with other configuration options. - Seek guidance from the Red Hat support before using this field. - Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - status: - description: status is the most recently observed status of the Kubernetes - API Server - properties: - conditions: - description: conditions is a list of conditions and their status - items: - description: OperatorCondition is just the standard condition fields. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - type: string - reason: - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - generations: - description: generations are used to determine when an item needs - to be reconciled or has changed in a way that needs a reaction. - items: - description: GenerationStatus keeps track of the generation for - a given resource so that decisions about forced updates can be - made. - properties: - group: - description: group is the group of the thing you're tracking - type: string - hash: - description: hash is an optional field set for resources without - generation that are content sensitive like secrets and configmaps - type: string - lastGeneration: - description: lastGeneration is the last generation of the workload - controller involved - format: int64 - type: integer - name: - description: name is the name of the thing you're tracking - type: string - namespace: - description: namespace is where the thing you're tracking is - type: string - resource: - description: resource is the resource type of the thing you're - tracking - type: string - required: - - group - - name - - namespace - - resource - type: object - type: array - x-kubernetes-list-map-keys: - - group - - resource - - namespace - - name - x-kubernetes-list-type: map - latestAvailableRevision: - description: latestAvailableRevision is the deploymentID of the most - recent deployment - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - latestAvailableRevisionReason: - description: latestAvailableRevisionReason describe the detailed reason - for the most recent deployment - type: string - nodeStatuses: - description: nodeStatuses track the deployment values and errors across - individual nodes - items: - description: NodeStatus provides information about the current state - of a particular node managed by this operator. - properties: - currentRevision: - description: |- - currentRevision is the generation of the most recently successful deployment. - Can not be set on creation of a nodeStatus. Updates must only increase the value. - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - lastFailedCount: - description: lastFailedCount is how often the installer pod - of the last failed revision failed. - type: integer - lastFailedReason: - description: lastFailedReason is a machine readable failure - reason string. - type: string - lastFailedRevision: - description: lastFailedRevision is the generation of the deployment - we tried and failed to deploy. - format: int32 - type: integer - lastFailedRevisionErrors: - description: lastFailedRevisionErrors is a list of human readable - errors during the failed deployment referenced in lastFailedRevision. - items: - type: string - type: array - x-kubernetes-list-type: atomic - lastFailedTime: - description: lastFailedTime is the time the last failed revision - failed the last time. - format: date-time - type: string - lastFallbackCount: - description: lastFallbackCount is how often a fallback to a - previous revision happened. - type: integer - nodeName: - description: nodeName is the name of the node - type: string - targetRevision: - description: |- - targetRevision is the generation of the deployment we're trying to apply. - Can not be set on creation of a nodeStatus. - format: int32 - type: integer - required: - - nodeName - type: object - x-kubernetes-validations: - - fieldPath: .currentRevision - message: cannot be unset once set - rule: has(self.currentRevision) || !has(oldSelf.currentRevision) - - fieldPath: .currentRevision - message: currentRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.currentRevision) - - fieldPath: .targetRevision - message: targetRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.targetRevision) - type: array - x-kubernetes-list-map-keys: - - nodeName - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: no more than 1 node status may have a nonzero targetRevision - rule: size(self.filter(status, status.?targetRevision.orValue(0) - != 0)) <= 1 - observedGeneration: - description: observedGeneration is the last generation change you've - dealt with - format: int64 - type: integer - readyReplicas: - description: readyReplicas indicates how many replicas are ready and - at the desired state - format: int32 - type: integer - serviceAccountIssuers: - description: |- - serviceAccountIssuers tracks history of used service account issuers. - The item without expiration time represents the currently used service account issuer. - The other items represents service account issuers that were used previously and are still being trusted. - The default expiration for the items is set by the platform and it defaults to 24h. - see: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection - items: - properties: - expirationTime: - description: |- - expirationTime is the time after which this service account issuer will be pruned and removed from the trusted list - of service account issuers. - format: date-time - type: string - name: - description: name is the name of the service account issuer - type: string - type: object - type: array - x-kubernetes-list-type: atomic - version: - description: version is the level this availability applies to - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml deleted file mode 100644 index b0d11038de..0000000000 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml +++ /dev/null @@ -1,349 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.openshift.io: https://github.com/openshift/api/pull/475 - api.openshift.io/merged-by-featuregates: "true" - include.release.openshift.io/ibm-cloud-managed: "true" - include.release.openshift.io/self-managed-high-availability: "true" - release.openshift.io/feature-set: DevPreviewNoUpgrade - name: kubeapiservers.operator.openshift.io -spec: - group: operator.openshift.io - names: - categories: - - coreoperators - kind: KubeAPIServer - listKind: KubeAPIServerList - plural: kubeapiservers - singular: kubeapiserver - scope: Cluster - versions: - - name: v1 - schema: - openAPIV3Schema: - description: |- - KubeAPIServer provides information to configure an operator to manage kube-apiserver. - - Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: spec is the specification of the desired behavior of the - Kubernetes API Server - properties: - eventTTLMinutes: - description: |- - eventTTLMinutes specifies the amount of time that the events are stored before being deleted. - The TTL is allowed between 5 minutes minimum up to a maximum of 180 minutes (3 hours). - - Lowering this value will reduce the storage required in etcd. Note that this setting will only apply - to new events being created and will not update existing events. - - When omitted this means no opinion, and the platform is left to choose a reasonable default, which is subject to change over time. - The current default value is 3h (180 minutes). - format: int32 - maximum: 180 - minimum: 5 - type: integer - failedRevisionLimit: - description: |- - failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - forceRedeploymentReason: - description: |- - forceRedeploymentReason can be used to force the redeployment of the operand by providing a unique string. - This provides a mechanism to kick a previously failed deployment and provide a reason why you think it will work - this time instead of failing again on the same config. - type: string - logLevel: - default: Normal - description: |- - logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for their operands. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - managementState: - description: managementState indicates whether and how the operator - should manage the component - pattern: ^(Managed|Force)$ - type: string - observedConfig: - description: |- - observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because - it is an input to the level for the operator - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - operatorLogLevel: - default: Normal - description: |- - operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for themselves. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - succeededRevisionLimit: - description: |- - succeededRevisionLimit is the number of successful static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - unsupportedConfigOverrides: - description: |- - unsupportedConfigOverrides overrides the final configuration that was computed by the operator. - Red Hat does not support the use of this field. - Misuse of this field could lead to unexpected behavior or conflict with other configuration options. - Seek guidance from the Red Hat support before using this field. - Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - status: - description: status is the most recently observed status of the Kubernetes - API Server - properties: - conditions: - description: conditions is a list of conditions and their status - items: - description: OperatorCondition is just the standard condition fields. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - type: string - reason: - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - generations: - description: generations are used to determine when an item needs - to be reconciled or has changed in a way that needs a reaction. - items: - description: GenerationStatus keeps track of the generation for - a given resource so that decisions about forced updates can be - made. - properties: - group: - description: group is the group of the thing you're tracking - type: string - hash: - description: hash is an optional field set for resources without - generation that are content sensitive like secrets and configmaps - type: string - lastGeneration: - description: lastGeneration is the last generation of the workload - controller involved - format: int64 - type: integer - name: - description: name is the name of the thing you're tracking - type: string - namespace: - description: namespace is where the thing you're tracking is - type: string - resource: - description: resource is the resource type of the thing you're - tracking - type: string - required: - - group - - name - - namespace - - resource - type: object - type: array - x-kubernetes-list-map-keys: - - group - - resource - - namespace - - name - x-kubernetes-list-type: map - latestAvailableRevision: - description: latestAvailableRevision is the deploymentID of the most - recent deployment - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - latestAvailableRevisionReason: - description: latestAvailableRevisionReason describe the detailed reason - for the most recent deployment - type: string - nodeStatuses: - description: nodeStatuses track the deployment values and errors across - individual nodes - items: - description: NodeStatus provides information about the current state - of a particular node managed by this operator. - properties: - currentRevision: - description: |- - currentRevision is the generation of the most recently successful deployment. - Can not be set on creation of a nodeStatus. Updates must only increase the value. - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - lastFailedCount: - description: lastFailedCount is how often the installer pod - of the last failed revision failed. - type: integer - lastFailedReason: - description: lastFailedReason is a machine readable failure - reason string. - type: string - lastFailedRevision: - description: lastFailedRevision is the generation of the deployment - we tried and failed to deploy. - format: int32 - type: integer - lastFailedRevisionErrors: - description: lastFailedRevisionErrors is a list of human readable - errors during the failed deployment referenced in lastFailedRevision. - items: - type: string - type: array - x-kubernetes-list-type: atomic - lastFailedTime: - description: lastFailedTime is the time the last failed revision - failed the last time. - format: date-time - type: string - lastFallbackCount: - description: lastFallbackCount is how often a fallback to a - previous revision happened. - type: integer - nodeName: - description: nodeName is the name of the node - type: string - targetRevision: - description: |- - targetRevision is the generation of the deployment we're trying to apply. - Can not be set on creation of a nodeStatus. - format: int32 - type: integer - required: - - nodeName - type: object - x-kubernetes-validations: - - fieldPath: .currentRevision - message: cannot be unset once set - rule: has(self.currentRevision) || !has(oldSelf.currentRevision) - - fieldPath: .currentRevision - message: currentRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.currentRevision) - - fieldPath: .targetRevision - message: targetRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.targetRevision) - type: array - x-kubernetes-list-map-keys: - - nodeName - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: no more than 1 node status may have a nonzero targetRevision - rule: size(self.filter(status, status.?targetRevision.orValue(0) - != 0)) <= 1 - observedGeneration: - description: observedGeneration is the last generation change you've - dealt with - format: int64 - type: integer - readyReplicas: - description: readyReplicas indicates how many replicas are ready and - at the desired state - format: int32 - type: integer - serviceAccountIssuers: - description: |- - serviceAccountIssuers tracks history of used service account issuers. - The item without expiration time represents the currently used service account issuer. - The other items represents service account issuers that were used previously and are still being trusted. - The default expiration for the items is set by the platform and it defaults to 24h. - see: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection - items: - properties: - expirationTime: - description: |- - expirationTime is the time after which this service account issuer will be pruned and removed from the trusted list - of service account issuers. - format: date-time - type: string - name: - description: name is the name of the service account issuer - type: string - type: object - type: array - x-kubernetes-list-type: atomic - version: - description: version is the level this availability applies to - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-OKD.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-OKD.crd.yaml deleted file mode 100644 index ac96531975..0000000000 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-OKD.crd.yaml +++ /dev/null @@ -1,335 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.openshift.io: https://github.com/openshift/api/pull/475 - api.openshift.io/merged-by-featuregates: "true" - include.release.openshift.io/ibm-cloud-managed: "true" - include.release.openshift.io/self-managed-high-availability: "true" - release.openshift.io/feature-set: OKD - name: kubeapiservers.operator.openshift.io -spec: - group: operator.openshift.io - names: - categories: - - coreoperators - kind: KubeAPIServer - listKind: KubeAPIServerList - plural: kubeapiservers - singular: kubeapiserver - scope: Cluster - versions: - - name: v1 - schema: - openAPIV3Schema: - description: |- - KubeAPIServer provides information to configure an operator to manage kube-apiserver. - - Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: spec is the specification of the desired behavior of the - Kubernetes API Server - properties: - failedRevisionLimit: - description: |- - failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - forceRedeploymentReason: - description: |- - forceRedeploymentReason can be used to force the redeployment of the operand by providing a unique string. - This provides a mechanism to kick a previously failed deployment and provide a reason why you think it will work - this time instead of failing again on the same config. - type: string - logLevel: - default: Normal - description: |- - logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for their operands. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - managementState: - description: managementState indicates whether and how the operator - should manage the component - pattern: ^(Managed|Force)$ - type: string - observedConfig: - description: |- - observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because - it is an input to the level for the operator - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - operatorLogLevel: - default: Normal - description: |- - operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for themselves. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - succeededRevisionLimit: - description: |- - succeededRevisionLimit is the number of successful static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - unsupportedConfigOverrides: - description: |- - unsupportedConfigOverrides overrides the final configuration that was computed by the operator. - Red Hat does not support the use of this field. - Misuse of this field could lead to unexpected behavior or conflict with other configuration options. - Seek guidance from the Red Hat support before using this field. - Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - status: - description: status is the most recently observed status of the Kubernetes - API Server - properties: - conditions: - description: conditions is a list of conditions and their status - items: - description: OperatorCondition is just the standard condition fields. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - type: string - reason: - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - generations: - description: generations are used to determine when an item needs - to be reconciled or has changed in a way that needs a reaction. - items: - description: GenerationStatus keeps track of the generation for - a given resource so that decisions about forced updates can be - made. - properties: - group: - description: group is the group of the thing you're tracking - type: string - hash: - description: hash is an optional field set for resources without - generation that are content sensitive like secrets and configmaps - type: string - lastGeneration: - description: lastGeneration is the last generation of the workload - controller involved - format: int64 - type: integer - name: - description: name is the name of the thing you're tracking - type: string - namespace: - description: namespace is where the thing you're tracking is - type: string - resource: - description: resource is the resource type of the thing you're - tracking - type: string - required: - - group - - name - - namespace - - resource - type: object - type: array - x-kubernetes-list-map-keys: - - group - - resource - - namespace - - name - x-kubernetes-list-type: map - latestAvailableRevision: - description: latestAvailableRevision is the deploymentID of the most - recent deployment - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - latestAvailableRevisionReason: - description: latestAvailableRevisionReason describe the detailed reason - for the most recent deployment - type: string - nodeStatuses: - description: nodeStatuses track the deployment values and errors across - individual nodes - items: - description: NodeStatus provides information about the current state - of a particular node managed by this operator. - properties: - currentRevision: - description: |- - currentRevision is the generation of the most recently successful deployment. - Can not be set on creation of a nodeStatus. Updates must only increase the value. - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - lastFailedCount: - description: lastFailedCount is how often the installer pod - of the last failed revision failed. - type: integer - lastFailedReason: - description: lastFailedReason is a machine readable failure - reason string. - type: string - lastFailedRevision: - description: lastFailedRevision is the generation of the deployment - we tried and failed to deploy. - format: int32 - type: integer - lastFailedRevisionErrors: - description: lastFailedRevisionErrors is a list of human readable - errors during the failed deployment referenced in lastFailedRevision. - items: - type: string - type: array - x-kubernetes-list-type: atomic - lastFailedTime: - description: lastFailedTime is the time the last failed revision - failed the last time. - format: date-time - type: string - lastFallbackCount: - description: lastFallbackCount is how often a fallback to a - previous revision happened. - type: integer - nodeName: - description: nodeName is the name of the node - type: string - targetRevision: - description: |- - targetRevision is the generation of the deployment we're trying to apply. - Can not be set on creation of a nodeStatus. - format: int32 - type: integer - required: - - nodeName - type: object - x-kubernetes-validations: - - fieldPath: .currentRevision - message: cannot be unset once set - rule: has(self.currentRevision) || !has(oldSelf.currentRevision) - - fieldPath: .currentRevision - message: currentRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.currentRevision) - - fieldPath: .targetRevision - message: targetRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.targetRevision) - type: array - x-kubernetes-list-map-keys: - - nodeName - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: no more than 1 node status may have a nonzero targetRevision - rule: size(self.filter(status, status.?targetRevision.orValue(0) - != 0)) <= 1 - observedGeneration: - description: observedGeneration is the last generation change you've - dealt with - format: int64 - type: integer - readyReplicas: - description: readyReplicas indicates how many replicas are ready and - at the desired state - format: int32 - type: integer - serviceAccountIssuers: - description: |- - serviceAccountIssuers tracks history of used service account issuers. - The item without expiration time represents the currently used service account issuer. - The other items represents service account issuers that were used previously and are still being trusted. - The default expiration for the items is set by the platform and it defaults to 24h. - see: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection - items: - properties: - expirationTime: - description: |- - expirationTime is the time after which this service account issuer will be pruned and removed from the trusted list - of service account issuers. - format: date-time - type: string - name: - description: name is the name of the service account issuer - type: string - type: object - type: array - x-kubernetes-list-type: atomic - version: - description: version is the level this availability applies to - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml deleted file mode 100644 index 48d0d6a709..0000000000 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml +++ /dev/null @@ -1,349 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.openshift.io: https://github.com/openshift/api/pull/475 - api.openshift.io/merged-by-featuregates: "true" - include.release.openshift.io/ibm-cloud-managed: "true" - include.release.openshift.io/self-managed-high-availability: "true" - release.openshift.io/feature-set: TechPreviewNoUpgrade - name: kubeapiservers.operator.openshift.io -spec: - group: operator.openshift.io - names: - categories: - - coreoperators - kind: KubeAPIServer - listKind: KubeAPIServerList - plural: kubeapiservers - singular: kubeapiserver - scope: Cluster - versions: - - name: v1 - schema: - openAPIV3Schema: - description: |- - KubeAPIServer provides information to configure an operator to manage kube-apiserver. - - Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: spec is the specification of the desired behavior of the - Kubernetes API Server - properties: - eventTTLMinutes: - description: |- - eventTTLMinutes specifies the amount of time that the events are stored before being deleted. - The TTL is allowed between 5 minutes minimum up to a maximum of 180 minutes (3 hours). - - Lowering this value will reduce the storage required in etcd. Note that this setting will only apply - to new events being created and will not update existing events. - - When omitted this means no opinion, and the platform is left to choose a reasonable default, which is subject to change over time. - The current default value is 3h (180 minutes). - format: int32 - maximum: 180 - minimum: 5 - type: integer - failedRevisionLimit: - description: |- - failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - forceRedeploymentReason: - description: |- - forceRedeploymentReason can be used to force the redeployment of the operand by providing a unique string. - This provides a mechanism to kick a previously failed deployment and provide a reason why you think it will work - this time instead of failing again on the same config. - type: string - logLevel: - default: Normal - description: |- - logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for their operands. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - managementState: - description: managementState indicates whether and how the operator - should manage the component - pattern: ^(Managed|Force)$ - type: string - observedConfig: - description: |- - observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because - it is an input to the level for the operator - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - operatorLogLevel: - default: Normal - description: |- - operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a - simple way to manage coarse grained logging choices that operators have to interpret for themselves. - - Valid values are: "Normal", "Debug", "Trace", "TraceAll". - Defaults to "Normal". - enum: - - "" - - Normal - - Debug - - Trace - - TraceAll - type: string - succeededRevisionLimit: - description: |- - succeededRevisionLimit is the number of successful static pod installer revisions to keep on disk and in the api - -1 = unlimited, 0 or unset = 5 (default) - format: int32 - type: integer - unsupportedConfigOverrides: - description: |- - unsupportedConfigOverrides overrides the final configuration that was computed by the operator. - Red Hat does not support the use of this field. - Misuse of this field could lead to unexpected behavior or conflict with other configuration options. - Seek guidance from the Red Hat support before using this field. - Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. - nullable: true - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - status: - description: status is the most recently observed status of the Kubernetes - API Server - properties: - conditions: - description: conditions is a list of conditions and their status - items: - description: OperatorCondition is just the standard condition fields. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - type: string - reason: - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - generations: - description: generations are used to determine when an item needs - to be reconciled or has changed in a way that needs a reaction. - items: - description: GenerationStatus keeps track of the generation for - a given resource so that decisions about forced updates can be - made. - properties: - group: - description: group is the group of the thing you're tracking - type: string - hash: - description: hash is an optional field set for resources without - generation that are content sensitive like secrets and configmaps - type: string - lastGeneration: - description: lastGeneration is the last generation of the workload - controller involved - format: int64 - type: integer - name: - description: name is the name of the thing you're tracking - type: string - namespace: - description: namespace is where the thing you're tracking is - type: string - resource: - description: resource is the resource type of the thing you're - tracking - type: string - required: - - group - - name - - namespace - - resource - type: object - type: array - x-kubernetes-list-map-keys: - - group - - resource - - namespace - - name - x-kubernetes-list-type: map - latestAvailableRevision: - description: latestAvailableRevision is the deploymentID of the most - recent deployment - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - latestAvailableRevisionReason: - description: latestAvailableRevisionReason describe the detailed reason - for the most recent deployment - type: string - nodeStatuses: - description: nodeStatuses track the deployment values and errors across - individual nodes - items: - description: NodeStatus provides information about the current state - of a particular node managed by this operator. - properties: - currentRevision: - description: |- - currentRevision is the generation of the most recently successful deployment. - Can not be set on creation of a nodeStatus. Updates must only increase the value. - format: int32 - type: integer - x-kubernetes-validations: - - message: must only increase - rule: self >= oldSelf - lastFailedCount: - description: lastFailedCount is how often the installer pod - of the last failed revision failed. - type: integer - lastFailedReason: - description: lastFailedReason is a machine readable failure - reason string. - type: string - lastFailedRevision: - description: lastFailedRevision is the generation of the deployment - we tried and failed to deploy. - format: int32 - type: integer - lastFailedRevisionErrors: - description: lastFailedRevisionErrors is a list of human readable - errors during the failed deployment referenced in lastFailedRevision. - items: - type: string - type: array - x-kubernetes-list-type: atomic - lastFailedTime: - description: lastFailedTime is the time the last failed revision - failed the last time. - format: date-time - type: string - lastFallbackCount: - description: lastFallbackCount is how often a fallback to a - previous revision happened. - type: integer - nodeName: - description: nodeName is the name of the node - type: string - targetRevision: - description: |- - targetRevision is the generation of the deployment we're trying to apply. - Can not be set on creation of a nodeStatus. - format: int32 - type: integer - required: - - nodeName - type: object - x-kubernetes-validations: - - fieldPath: .currentRevision - message: cannot be unset once set - rule: has(self.currentRevision) || !has(oldSelf.currentRevision) - - fieldPath: .currentRevision - message: currentRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.currentRevision) - - fieldPath: .targetRevision - message: targetRevision can not be set on creation of a nodeStatus - optionalOldSelf: true - rule: oldSelf.hasValue() || !has(self.targetRevision) - type: array - x-kubernetes-list-map-keys: - - nodeName - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: no more than 1 node status may have a nonzero targetRevision - rule: size(self.filter(status, status.?targetRevision.orValue(0) - != 0)) <= 1 - observedGeneration: - description: observedGeneration is the last generation change you've - dealt with - format: int64 - type: integer - readyReplicas: - description: readyReplicas indicates how many replicas are ready and - at the desired state - format: int32 - type: integer - serviceAccountIssuers: - description: |- - serviceAccountIssuers tracks history of used service account issuers. - The item without expiration time represents the currently used service account issuer. - The other items represents service account issuers that were used previously and are still being trusted. - The default expiration for the items is set by the platform and it defaults to 24h. - see: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection - items: - properties: - expirationTime: - description: |- - expirationTime is the time after which this service account issuer will be pruned and removed from the trusted list - of service account issuers. - format: date-time - type: string - name: - description: name is the name of the service account issuer - type: string - type: object - type: array - x-kubernetes-list-type: atomic - version: - description: version is the level this availability applies to - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers.crd.yaml similarity index 99% rename from vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml rename to vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers.crd.yaml index ba2587dc9d..6d2d44026a 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers.crd.yaml @@ -6,7 +6,6 @@ metadata: api.openshift.io/merged-by-featuregates: "true" include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" - release.openshift.io/feature-set: CustomNoUpgrade name: kubeapiservers.operator.openshift.io spec: group: operator.openshift.io diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yaml index 45486c2700..19b319fcb8 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yaml @@ -125,8 +125,17 @@ spec: kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key. - pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)\/.*$ + + The ARN must follow the format: arn::kms:::(key|alias)/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + is the AWS region, + is a 12-digit numeric identifier for the AWS account, + is the KMS key ID or alias name. type: string + x-kubernetes-validations: + - message: 'kmsKeyARN must be a valid AWS KMS key ARN in the + format: arn::kms:::(key|alias)/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$') type: object azure: description: azure is used to configure the Azure CSI driver. diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-Default.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-Default.crd.yaml index 1b64e9e9a1..5bb6bdddcf 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-Default.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-Default.crd.yaml @@ -125,8 +125,17 @@ spec: kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key. - pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)\/.*$ + + The ARN must follow the format: arn::kms:::(key|alias)/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + is the AWS region, + is a 12-digit numeric identifier for the AWS account, + is the KMS key ID or alias name. type: string + x-kubernetes-validations: + - message: 'kmsKeyARN must be a valid AWS KMS key ARN in the + format: arn::kms:::(key|alias)/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$') type: object azure: description: azure is used to configure the Azure CSI driver. diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yaml index 7029b1bde6..a03dd7d88d 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yaml @@ -125,8 +125,17 @@ spec: kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key. - pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)\/.*$ + + The ARN must follow the format: arn::kms:::(key|alias)/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + is the AWS region, + is a 12-digit numeric identifier for the AWS account, + is the KMS key ID or alias name. type: string + x-kubernetes-validations: + - message: 'kmsKeyARN must be a valid AWS KMS key ARN in the + format: arn::kms:::(key|alias)/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$') type: object azure: description: azure is used to configure the Azure CSI driver. diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-OKD.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-OKD.crd.yaml index 04758b7a19..0e925a7511 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-OKD.crd.yaml @@ -125,8 +125,17 @@ spec: kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key. - pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)\/.*$ + + The ARN must follow the format: arn::kms:::(key|alias)/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + is the AWS region, + is a 12-digit numeric identifier for the AWS account, + is the KMS key ID or alias name. type: string + x-kubernetes-validations: + - message: 'kmsKeyARN must be a valid AWS KMS key ARN in the + format: arn::kms:::(key|alias)/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$') type: object azure: description: azure is used to configure the Azure CSI driver. diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yaml index 04052c180e..3dc68028e0 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yaml @@ -125,8 +125,17 @@ spec: kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key. - pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)\/.*$ + + The ARN must follow the format: arn::kms:::(key|alias)/, where: + is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + is the AWS region, + is a 12-digit numeric identifier for the AWS account, + is the KMS key ID or alias name. type: string + x-kubernetes-validations: + - message: 'kmsKeyARN must be a valid AWS KMS key ARN in the + format: arn::kms:::(key|alias)/' + rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$') type: object azure: description: azure is used to configure the Azure CSI driver. diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml new file mode 100644 index 0000000000..fdf10772dd --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml @@ -0,0 +1,3317 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/616 + api.openshift.io/merged-by-featuregates: "true" + capability.openshift.io/name: Ingress + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: CustomNoUpgrade + name: ingresscontrollers.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: IngressController + listKind: IngressControllerList + plural: ingresscontrollers + singular: ingresscontroller + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + IngressController describes a managed ingress controller for the cluster. The + controller can service OpenShift Route and Kubernetes Ingress resources. + + When an IngressController is created, a new ingress controller deployment is + created to allow external traffic to reach the services that expose Ingress + or Route resources. Updating this resource may lead to disruption for public + facing network connections as a new ingress controller revision may be rolled + out. + + https://kubernetes.io/docs/concepts/services-networking/ingress-controllers + + Whenever possible, sensible defaults for the platform are used. See each + field for more details. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the specification of the desired behavior of the + IngressController. + properties: + clientTLS: + description: |- + clientTLS specifies settings for requesting and verifying client + certificates, which can be used to enable mutual TLS for + edge-terminated and reencrypt routes. + properties: + allowedSubjectPatterns: + description: |- + allowedSubjectPatterns specifies a list of regular expressions that + should be matched against the distinguished name on a valid client + certificate to filter requests. The regular expressions must use + PCRE syntax. If this list is empty, no filtering is performed. If + the list is nonempty, then at least one pattern must match a client + certificate's distinguished name or else the ingress controller + rejects the certificate and denies the connection. + items: + type: string + type: array + x-kubernetes-list-type: atomic + clientCA: + description: |- + clientCA specifies a configmap containing the PEM-encoded CA + certificate bundle that should be used to verify a client's + certificate. The administrator must create this configmap in the + openshift-config namespace. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + clientCertificatePolicy: + description: |- + clientCertificatePolicy specifies whether the ingress controller + requires clients to provide certificates. This field accepts the + values "Required" or "Optional". + + Note that the ingress controller only checks client certificates for + edge-terminated and reencrypt TLS routes; it cannot check + certificates for cleartext HTTP or passthrough TLS routes. + enum: + - "" + - Required + - Optional + type: string + required: + - clientCA + - clientCertificatePolicy + type: object + closedClientConnectionPolicy: + default: Continue + description: |- + closedClientConnectionPolicy controls how the IngressController + behaves when the client closes the TCP connection while the TLS + handshake or HTTP request is in progress. This option maps directly + to HAProxy’s "abortonclose" option. + + Valid values are: "Abort" and "Continue". + The default value is "Continue". + + When set to "Abort", the router will stop processing the TLS handshake + if it is in progress, and it will not send an HTTP request to the backend server + if the request has not yet been sent when the client closes the connection. + + When set to "Continue", the router will complete the TLS handshake + if it is in progress, or send an HTTP request to the backend server + and wait for the backend server's response, regardless of + whether the client has closed the connection. + + Setting "Abort" can help free CPU resources otherwise spent on TLS computation + for connections the client has already closed, and can reduce request queue + size, thereby reducing the load on saturated backend servers. + + Important Considerations: + + - The default policy ("Continue") is HTTP-compliant, and requests + for aborted client connections will still be served. + Use the "Continue" policy to allow a client to send a request + and then immediately close its side of the connection while + still receiving a response on the half-closed connection. + + - When clients use keep-alive connections, the most common case for premature + closure is when the user wants to cancel the transfer or when a timeout + occurs. In that case, the "Abort" policy may be used to reduce resource consumption. + + - Using RSA keys larger than 2048 bits can significantly slow down + TLS computations. Consider using the "Abort" policy to reduce CPU usage. + enum: + - Abort + - Continue + type: string + defaultCertificate: + description: |- + defaultCertificate is a reference to a secret containing the default + certificate served by the ingress controller. When Routes don't specify + their own certificate, defaultCertificate is used. + + The secret must contain the following keys and data: + + tls.crt: certificate file contents + tls.key: key file contents + + If unset, a wildcard certificate is automatically generated and used. The + certificate is valid for the ingress controller domain (and subdomains) and + the generated certificate's CA will be automatically integrated with the + cluster's trust store. + + If a wildcard certificate is used and shared by multiple + HTTP/2 enabled routes (which implies ALPN) then clients + (i.e., notably browsers) are at liberty to reuse open + connections. This means a client can reuse a connection to + another route and that is likely to fail. This behaviour is + generally known as connection coalescing. + + The in-use certificate (whether generated or user-specified) will be + automatically integrated with OpenShift's built-in OAuth server. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + domain: + description: |- + domain is a DNS name serviced by the ingress controller and is used to + configure multiple features: + + * For the LoadBalancerService endpoint publishing strategy, domain is + used to configure DNS records. See endpointPublishingStrategy. + + * When using a generated default certificate, the certificate will be valid + for domain and its subdomains. See defaultCertificate. + + * The value is published to individual Route statuses so that end-users + know where to target external DNS records. + + domain must be unique among all IngressControllers, and cannot be + updated. + + If empty, defaults to ingress.config.openshift.io/cluster .spec.domain. + + The domain value must be a valid DNS name. It must consist of lowercase + alphanumeric characters, '-' or '.', and each label must start and end + with an alphanumeric character and not exceed 63 characters. Maximum + length of a valid DNS domain is 253 characters. + + The implementation may add a prefix such as "router-default." to the domain + when constructing the router canonical hostname. To ensure the resulting + hostname does not exceed the DNS maximum length of 253 characters, + the domain length is additionally validated at the IngressController object + level. For the maximum length of the domain value itself, the shortest + possible variant of the prefix and the ingress controller name was considered + for example "router-a." + maxLength: 244 + type: string + x-kubernetes-validations: + - message: domain must consist of lower case alphanumeric characters, + '-' or '.', and must start and end with an alphanumeric character + rule: '!format.dns1123Subdomain().validate(self).hasValue()' + - message: each DNS label must not exceed 63 characters + rule: self.split('.').all(label, size(label) <= 63) + endpointPublishingStrategy: + description: |- + endpointPublishingStrategy is used to publish the ingress controller + endpoints to other networks, enable load balancer integrations, etc. + + If unset, the default is based on + infrastructure.config.openshift.io/cluster .status.platform: + + AWS: LoadBalancerService (with External scope) + Azure: LoadBalancerService (with External scope) + GCP: LoadBalancerService (with External scope) + IBMCloud: LoadBalancerService (with External scope) + AlibabaCloud: LoadBalancerService (with External scope) + Libvirt: HostNetwork + + Any other platform types (including None) default to HostNetwork. + + endpointPublishingStrategy cannot be updated. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + httpCompression: + description: |- + httpCompression defines a policy for HTTP traffic compression. + By default, there is no HTTP compression. + properties: + mimeTypes: + description: |- + mimeTypes is a list of MIME types that should have compression applied. + This list can be empty, in which case the ingress controller does not apply compression. + + Note: Not all MIME types benefit from compression, but HAProxy will still use resources + to try to compress if instructed to. Generally speaking, text (html, css, js, etc.) + formats benefit from compression, but formats that are already compressed (image, + audio, video, etc.) benefit little in exchange for the time and cpu spent on compressing + again. See https://joehonton.medium.com/the-gzip-penalty-d31bd697f1a2 + items: + description: |- + CompressionMIMEType defines the format of a single MIME type. + E.g. "text/css; charset=utf-8", "text/html", "text/*", "image/svg+xml", + "application/octet-stream", "X-custom/customsub", etc. + + The format should follow the Content-Type definition in RFC 1341: + Content-Type := type "/" subtype *[";" parameter] + - The type in Content-Type can be one of: + application, audio, image, message, multipart, text, video, or a custom + type preceded by "X-" and followed by a token as defined below. + - The token is a string of at least one character, and not containing white + space, control characters, or any of the characters in the tspecials set. + - The tspecials set contains the characters ()<>@,;:\"/[]?.= + - The subtype in Content-Type is also a token. + - The optional parameter/s following the subtype are defined as: + token "=" (token / quoted-string) + - The quoted-string, as defined in RFC 822, is surrounded by double quotes + and can contain white space plus any character EXCEPT \, ", and CR. + It can also contain any single ASCII character as long as it is escaped by \. + pattern: ^(?i)(x-[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|application|audio|image|message|multipart|text|video)/[^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+(; *[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+=([^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|"(\\[\x00-\x7F]|[^\x0D"\\])*"))*$ + type: string + type: array + x-kubernetes-list-type: set + type: object + httpEmptyRequestsPolicy: + default: Respond + description: |- + httpEmptyRequestsPolicy describes how HTTP connections should be + handled if the connection times out before a request is received. + Allowed values for this field are "Respond" and "Ignore". If the + field is set to "Respond", the ingress controller sends an HTTP 400 + or 408 response, logs the connection (if access logging is enabled), + and counts the connection in the appropriate metrics. If the field + is set to "Ignore", the ingress controller closes the connection + without sending a response, logging the connection, or incrementing + metrics. The default value is "Respond". + + Typically, these connections come from load balancers' health probes + or Web browsers' speculative connections ("preconnect") and can be + safely ignored. However, these requests may also be caused by + network errors, and so setting this field to "Ignore" may impede + detection and diagnosis of problems. In addition, these requests may + be caused by port scans, in which case logging empty requests may aid + in detecting intrusion attempts. + enum: + - Respond + - Ignore + type: string + httpErrorCodePages: + description: |- + httpErrorCodePages specifies a configmap with custom error pages. + The administrator must create this configmap in the openshift-config namespace. + This configmap should have keys in the format "error-page-.http", + where is an HTTP error code. + For example, "error-page-503.http" defines an error page for HTTP 503 responses. + Currently only error pages for 503 and 404 responses can be customized. + Each value in the configmap should be the full response, including HTTP headers. + Eg- https://raw.githubusercontent.com/openshift/router/fadab45747a9b30cc3f0a4b41ad2871f95827a93/images/router/haproxy/conf/error-page-503.http + If this field is empty, the ingress controller uses the default error pages. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + httpHeaders: + description: |- + httpHeaders defines policy for HTTP headers. + + If this field is empty, the default values are used. + properties: + actions: + description: |- + actions specifies options for modifying headers and their values. + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be modified for TLS passthrough + connections. + Setting the HSTS (`Strict-Transport-Security`) header is not supported via actions. `Strict-Transport-Security` + may only be configured using the "haproxy.router.openshift.io/hsts_header" route annotation, and only in + accordance with the policy specified in Ingress.Spec.RequiredHSTSPolicies. + Any actions defined here are applied after any actions related to the following other fields: + cache-control, spec.clientTLS, + spec.httpHeaders.forwardedHeaderPolicy, spec.httpHeaders.uniqueId, + and spec.httpHeaders.headerNameCaseAdjustments. + In case of HTTP request headers, the actions specified in spec.httpHeaders.actions on the Route will be executed after + the actions specified in the IngressController's spec.httpHeaders.actions field. + In case of HTTP response headers, the actions specified in spec.httpHeaders.actions on the IngressController will be + executed after the actions specified in the Route's spec.httpHeaders.actions field. + Headers set using this API cannot be captured for use in access logs. + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. Please refer to the documentation + for that API field for more details. + properties: + request: + description: |- + request is a list of HTTP request headers to modify. + Actions defined here will modify the request headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for request headers will be executed before Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 request header actions may be configured. + Sample fetchers allowed are "req.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[req.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are req.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:req\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + response: + description: |- + response is a list of HTTP response headers to modify. + Actions defined here will modify the response headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for response headers will be executed after Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 response header actions may be configured. + Sample fetchers allowed are "res.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[res.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are res.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:res\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + type: object + forwardedHeaderPolicy: + description: |- + forwardedHeaderPolicy specifies when and how the IngressController + sets the Forwarded, X-Forwarded-For, X-Forwarded-Host, + X-Forwarded-Port, X-Forwarded-Proto, and X-Forwarded-Proto-Version + HTTP headers. The value may be one of the following: + + * "Append", which specifies that the IngressController appends the + headers, preserving existing headers. + + * "Replace", which specifies that the IngressController sets the + headers, replacing any existing Forwarded or X-Forwarded-* headers. + + * "IfNone", which specifies that the IngressController sets the + headers if they are not already set. + + * "Never", which specifies that the IngressController never sets the + headers, preserving any existing headers. + + By default, the policy is "Append". + enum: + - Append + - Replace + - IfNone + - Never + type: string + headerNameCaseAdjustments: + description: |- + headerNameCaseAdjustments specifies case adjustments that can be + applied to HTTP header names. Each adjustment is specified as an + HTTP header name with the desired capitalization. For example, + specifying "X-Forwarded-For" indicates that the "x-forwarded-for" + HTTP header should be adjusted to have the specified capitalization. + + These adjustments are only applied to cleartext, edge-terminated, and + re-encrypt routes, and only when using HTTP/1. + + For request headers, these adjustments are applied only for routes + that have the haproxy.router.openshift.io/h1-adjust-case=true + annotation. For response headers, these adjustments are applied to + all HTTP responses. + + If this field is empty, no request headers are adjusted. + items: + description: |- + IngressControllerHTTPHeaderNameCaseAdjustment is the name of an HTTP header + (for example, "X-Forwarded-For") in the desired capitalization. The value + must be a valid HTTP header name as defined in RFC 2616 section 4.2. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + uniqueId: + description: |- + uniqueId describes configuration for a custom HTTP header that the + ingress controller should inject into incoming HTTP requests. + Typically, this header is configured to have a value that is unique + to the HTTP request. The header can be used by applications or + included in access logs to facilitate tracing individual HTTP + requests. + + If this field is empty, no such header is injected into requests. + properties: + format: + description: |- + format specifies the format for the injected HTTP header's value. + This field has no effect unless name is specified. For the + HAProxy-based ingress controller implementation, this format uses the + same syntax as the HTTP log format. If the field is empty, the + default value is "%{+X}o\\ %ci:%cp_%fi:%fp_%Ts_%rt:%pid"; see the + corresponding HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + maxLength: 1024 + minLength: 0 + pattern: ^(%(%|(\{[-+]?[QXE](,[-+]?[QXE])*\})?([A-Za-z]+|\[[.0-9A-Z_a-z]+(\([^)]+\))?(,[.0-9A-Z_a-z]+(\([^)]+\))?)*\]))|[^%[:cntrl:]])*$ + type: string + name: + description: |- + name specifies the name of the HTTP header (for example, "unique-id") + that the ingress controller should inject into HTTP requests. The + field's value must be a valid HTTP header name as defined in RFC 2616 + section 4.2. If the field is empty, no header is injected. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + type: object + type: object + idleConnectionTerminationPolicy: + default: Immediate + description: |- + idleConnectionTerminationPolicy maps directly to HAProxy's + idle-close-on-response option and controls whether HAProxy + keeps idle frontend connections open during a soft stop + (router reload). + + Allowed values for this field are "Immediate" and + "Deferred". The default value is "Immediate". + + When set to "Immediate", idle connections are closed + immediately during router reloads. This ensures immediate + propagation of route changes but may impact clients + sensitive to connection resets. + + When set to "Deferred", HAProxy will maintain idle + connections during a soft reload instead of closing them + immediately. These connections remain open until any of the + following occurs: + + - A new request is received on the connection, in which + case HAProxy handles it in the old process and closes + the connection after sending the response. + + - HAProxy's `timeout http-keep-alive` duration expires. + By default this is 300 seconds, but it can be changed + using httpKeepAliveTimeout tuning option. + + - The client's keep-alive timeout expires, causing the + client to close the connection. + + Setting Deferred can help prevent errors in clients or load + balancers that do not properly handle connection resets. + Additionally, this option allows you to retain the pre-2.4 + HAProxy behaviour: in HAProxy version 2.2 (OpenShift + versions < 4.14), maintaining idle connections during a + soft reload was the default behaviour, but starting with + HAProxy 2.4, the default changed to closing idle + connections immediately. + + Important Consideration: + + - Using Deferred will result in temporary inconsistencies + for the first request on each persistent connection + after a route update and router reload. This request + will be processed by the old HAProxy process using its + old configuration. Subsequent requests will use the + updated configuration. + + Operational Considerations: + + - Keeping idle connections open during reloads may lead + to an accumulation of old HAProxy processes if + connections remain idle for extended periods, + especially in environments where frequent reloads + occur. + + - Consider monitoring the number of HAProxy processes in + the router pods when Deferred is set. + + - You may need to enable or adjust the + `ingress.operator.openshift.io/hard-stop-after` + duration (configured via an annotation on the + IngressController resource) in environments with + frequent reloads to prevent resource exhaustion. + enum: + - Immediate + - Deferred + type: string + logging: + description: |- + logging defines parameters for what should be logged where. If this + field is empty, operational logs are enabled but access logs are + disabled. + properties: + access: + description: |- + access describes how the client requests should be logged. + + If this field is empty, access logging is disabled. + properties: + destination: + description: destination is where access logs go. + properties: + container: + description: |- + container holds parameters for the Container logging destination. + Present only if type is Container. + properties: + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 8192, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 8192 + minimum: 480 + type: integer + type: object + syslog: + description: |- + syslog holds parameters for a syslog endpoint. Present only if + type is Syslog. + oneOf: + - properties: + address: + format: ipv4 + - properties: + address: + format: ipv6 + properties: + address: + description: |- + address is the IP address of the syslog endpoint that receives log + messages. + type: string + facility: + description: |- + facility specifies the syslog facility of log messages. + + If this field is empty, the facility is "local1". + enum: + - kern + - user + - mail + - daemon + - auth + - syslog + - lpr + - news + - uucp + - cron + - auth2 + - ftp + - ntp + - audit + - alert + - cron2 + - local0 + - local1 + - local2 + - local3 + - local4 + - local5 + - local6 + - local7 + type: string + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 4096, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 4096 + minimum: 480 + type: integer + port: + description: |- + port is the UDP port number of the syslog endpoint that receives log + messages. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - address + - port + type: object + type: + description: |- + type is the type of destination for logs. It must be one of the + following: + + * Container + + The ingress operator configures the sidecar container named "logs" on + the ingress controller pod and configures the ingress controller to + write logs to the sidecar. The logs are then available as container + logs. The expectation is that the administrator configures a custom + logging solution that reads logs from this sidecar. Note that using + container logs means that logs may be dropped if the rate of logs + exceeds the container runtime's or the custom logging solution's + capacity. + + * Syslog + + Logs are sent to a syslog endpoint. The administrator must specify + an endpoint that can receive syslog messages. The expectation is + that the administrator has configured a custom syslog instance. + enum: + - Container + - Syslog + type: string + required: + - type + type: object + httpCaptureCookies: + description: |- + httpCaptureCookies specifies HTTP cookies that should be captured in + access logs. If this field is empty, no cookies are captured. + items: + description: |- + IngressControllerCaptureHTTPCookie describes an HTTP cookie that should be + captured. + properties: + matchType: + description: |- + matchType specifies the type of match to be performed on the cookie + name. Allowed values are "Exact" for an exact string match and + "Prefix" for a string prefix match. If "Exact" is specified, a name + must be specified in the name field. If "Prefix" is provided, a + prefix must be specified in the namePrefix field. For example, + specifying matchType "Prefix" and namePrefix "foo" will capture a + cookie named "foo" or "foobar" but not one named "bar". The first + matching cookie is captured. + enum: + - Exact + - Prefix + type: string + maxLength: + description: |- + maxLength specifies a maximum length of the string that will be + logged, which includes the cookie name, cookie value, and + one-character delimiter. If the log entry exceeds this length, the + value will be truncated in the log message. Note that the ingress + controller may impose a separate bound on the total length of HTTP + headers in a request. + maximum: 1024 + minimum: 1 + type: integer + name: + description: |- + name specifies a cookie name. Its value must be a valid HTTP cookie + name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + namePrefix: + description: |- + namePrefix specifies a cookie name prefix. Its value must be a valid + HTTP cookie name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + required: + - matchType + - maxLength + type: object + maxItems: 1 + nullable: true + type: array + x-kubernetes-list-type: atomic + httpCaptureHeaders: + description: |- + httpCaptureHeaders defines HTTP headers that should be captured in + access logs. If this field is empty, no headers are captured. + + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be captured for TLS passthrough + connections. + properties: + request: + description: |- + request specifies which HTTP request headers to capture. + + If this field is empty, no request headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + response: + description: |- + response specifies which HTTP response headers to capture. + + If this field is empty, no response headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + type: object + httpLogFormat: + description: |- + httpLogFormat specifies the format of the log message for an HTTP + request. + + If this field is empty, log messages use the implementation's default + HTTP log format. For HAProxy's default HTTP log format, see the + HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + + Note that this format only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). It does not affect the log format for TLS passthrough + connections. + type: string + logEmptyRequests: + default: Log + description: |- + logEmptyRequests specifies how connections on which no request is + received should be logged. Typically, these empty requests come from + load balancers' health probes or Web browsers' speculative + connections ("preconnect"), in which case logging these requests may + be undesirable. However, these requests may also be caused by + network errors, in which case logging empty requests may be useful + for diagnosing the errors. In addition, these requests may be caused + by port scans, in which case logging empty requests may aid in + detecting intrusion attempts. Allowed values for this field are + "Log" and "Ignore". The default value is "Log". + enum: + - Log + - Ignore + type: string + required: + - destination + type: object + type: object + namespaceSelector: + description: |- + namespaceSelector is used to filter the set of namespaces serviced by the + ingress controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodePlacement: + description: |- + nodePlacement enables explicit control over the scheduling of the ingress + controller. + + If unset, defaults are used. See NodePlacement for more details. + properties: + nodeSelector: + description: |- + nodeSelector is the node selector applied to ingress controller + deployments. + + If set, the specified selector is used and replaces the default. + + If unset, the default depends on the value of the defaultPlacement + field in the cluster config.openshift.io/v1/ingresses status. + + When defaultPlacement is Workers, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/worker: '' + + When defaultPlacement is ControlPlane, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/master: '' + + These defaults are subject to change. + + Note that using nodeSelector.matchExpressions is not supported. Only + nodeSelector.matchLabels may be used. This is a limitation of the + Kubernetes API: the pod spec does not allow complex expressions for + node selectors. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tolerations: + description: |- + tolerations is a list of tolerations applied to ingress controller + deployments. + + The default is an empty list. + + See https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + replicas: + description: |- + replicas is the desired number of ingress controller replicas. If unset, + the default depends on the value of the defaultPlacement field in the + cluster config.openshift.io/v1/ingresses status. + + The value of replicas is set based on the value of a chosen field in the + Infrastructure CR. If defaultPlacement is set to ControlPlane, the + chosen field will be controlPlaneTopology. If it is set to Workers the + chosen field will be infrastructureTopology. Replicas will then be set to 1 + or 2 based whether the chosen field's value is SingleReplica or + HighlyAvailable, respectively. + + These defaults are subject to change. + format: int32 + type: integer + routeAdmission: + description: |- + routeAdmission defines a policy for handling new route claims (for example, + to allow or deny claims across namespaces). + + If empty, defaults will be applied. See specific routeAdmission fields + for details about their defaults. + properties: + namespaceOwnership: + description: |- + namespaceOwnership describes how host name claims across namespaces should + be handled. + + Value must be one of: + + - Strict: Do not allow routes in different namespaces to claim the same host. + + - InterNamespaceAllowed: Allow routes to claim different paths of the same + host name across namespaces. + + If empty, the default is Strict. + enum: + - InterNamespaceAllowed + - Strict + type: string + wildcardPolicy: + description: |- + wildcardPolicy describes how routes with wildcard policies should + be handled for the ingress controller. WildcardPolicy controls use + of routes [1] exposed by the ingress controller based on the route's + wildcard policy. + + [1] https://github.com/openshift/api/blob/master/route/v1/types.go + + Note: Updating WildcardPolicy from WildcardsAllowed to WildcardsDisallowed + will cause admitted routes with a wildcard policy of Subdomain to stop + working. These routes must be updated to a wildcard policy of None to be + readmitted by the ingress controller. + + WildcardPolicy supports WildcardsAllowed and WildcardsDisallowed values. + + If empty, defaults to "WildcardsDisallowed". + enum: + - WildcardsAllowed + - WildcardsDisallowed + type: string + type: object + routeSelector: + description: |- + routeSelector is used to filter the set of Routes serviced by the ingress + controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tlsSecurityProfile: + description: |- + tlsSecurityProfile specifies settings for TLS connections for ingresscontrollers. + + If unset, the default is based on the apiservers.config.openshift.io/cluster resource. + + Note that when using the Old, Intermediate, and Modern profile types, the effective + profile configuration is subject to change between releases. For example, given + a specification to use the Intermediate profile deployed on release X.Y.Z, an upgrade + to release X.Y.Z+1 may cause a new profile configuration to be applied to the ingress + controller, resulting in a rollout. + properties: + custom: + description: |- + custom is a user-defined TLS security profile. Be extremely careful using a custom + profile as invalid configurations can be catastrophic. An example custom profile + looks like this: + + minTLSVersion: VersionTLS11 + ciphers: + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + nullable: true + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + intermediate: + description: |- + intermediate is a TLS profile for use when you do not need compatibility with + legacy clients and want to remain highly secure while being compatible with + most clients currently in use. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS12 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + nullable: true + type: object + modern: + description: |- + modern is a TLS security profile for use with clients that support TLS 1.3 and + do not need backward compatibility for older clients. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS13 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + nullable: true + type: object + old: + description: |- + old is a TLS profile for use when services need to be accessed by very old + clients or libraries and should be used only as a last resort. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS10 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-ECDSA-AES128-SHA256 + - ECDHE-RSA-AES128-SHA256 + - ECDHE-ECDSA-AES128-SHA + - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA + - ECDHE-RSA-AES256-SHA + - AES128-GCM-SHA256 + - AES256-GCM-SHA384 + - AES128-SHA256 + - AES128-SHA + - AES256-SHA + - DES-CBC3-SHA + nullable: true + type: object + type: + description: |- + type is one of Old, Intermediate, Modern or Custom. Custom provides the + ability to specify individual TLS security profile parameters. + + The profiles are based on version 5.7 of the Mozilla Server Side TLS + configuration guidelines. The cipher lists consist of the configuration's + "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.7.json + + The profiles are intent based, so they may change over time as new ciphers are + developed and existing ciphers are found to be insecure. Depending on + precisely which ciphers are available to a process, the list may be reduced. + enum: + - Old + - Intermediate + - Modern + - Custom + type: string + type: object + tuningOptions: + anyOf: + - properties: + maxConnections: + enum: + - -1 + - 0 + - properties: + maxConnections: + format: int32 + maximum: 2000000 + minimum: 2000 + description: |- + tuningOptions defines parameters for adjusting the performance of + ingress controller pods. All fields are optional and will use their + respective defaults if not set. See specific tuningOptions fields for + more details. + + Setting fields within tuningOptions is generally not recommended. The + default values are suitable for most configurations. + properties: + clientFinTimeout: + description: |- + clientFinTimeout defines how long a connection will be held open while + waiting for the client response to the server/backend closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + clientTimeout: + description: |- + clientTimeout defines how long a connection will be held open while + waiting for a client response. + + If unset, the default timeout is 30s + format: duration + type: string + configurationManagement: + description: |- + configurationManagement specifies how OpenShift router should update + the HAProxy configuration. The following values are valid for this + field: + + * "ForkAndReload". + * "Dynamic". + + Omitting this field means that the user has no opinion and the + platform may choose a reasonable default. This default is subject to + change over time. The current default is "ForkAndReload". + + "ForkAndReload" means that OpenShift router should rewrite the + HAProxy configuration file and instruct HAProxy to fork and reload. + This is OpenShift router's traditional approach. + + "Dynamic" means that OpenShift router may use HAProxy's control + socket for some configuration updates and fall back to fork and + reload for other configuration updates. This is a newer approach, + which may be less mature than ForkAndReload. This setting can + improve load-balancing fairness and metrics accuracy and reduce CPU + and memory usage if HAProxy has frequent configuration updates for + route and endpoints updates. + + Note: The "Dynamic" option is currently experimental and should not + be enabled on production clusters. + enum: + - Dynamic + - ForkAndReload + type: string + connectTimeout: + description: |- + connectTimeout defines the maximum time to wait for + a connection attempt to a server/backend to succeed. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 5s. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + headerBufferBytes: + description: |- + headerBufferBytes describes how much memory should be reserved + (in bytes) for IngressController connection sessions. + Note that this value must be at least 16384 if HTTP/2 is + enabled for the IngressController (https://tools.ietf.org/html/rfc7540). + If this field is empty, the IngressController will use a default value + of 32768 bytes. + + Setting this field is generally not recommended as headerBufferBytes + values that are too small may break the IngressController and + headerBufferBytes values that are too large could cause the + IngressController to use significantly more memory than necessary. + format: int32 + minimum: 16384 + type: integer + headerBufferMaxRewriteBytes: + description: |- + headerBufferMaxRewriteBytes describes how much memory should be reserved + (in bytes) from headerBufferBytes for HTTP header rewriting + and appending for IngressController connection sessions. + Note that incoming HTTP requests will be limited to + (headerBufferBytes - headerBufferMaxRewriteBytes) bytes, meaning + headerBufferBytes must be greater than headerBufferMaxRewriteBytes. + If this field is empty, the IngressController will use a default value + of 8192 bytes. + + Setting this field is generally not recommended as + headerBufferMaxRewriteBytes values that are too small may break the + IngressController and headerBufferMaxRewriteBytes values that are too + large could cause the IngressController to use significantly more memory + than necessary. + format: int32 + minimum: 4096 + type: integer + healthCheckInterval: + description: |- + healthCheckInterval defines how long the router waits between two consecutive + health checks on its configured backends. This value is applied globally as + a default for all routes, but may be overridden per-route by the route annotation + "router.openshift.io/haproxy.health.check.interval". + + Expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, eg "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Setting this to less than 5s can cause excess traffic due to too frequent + TCP health checks and accompanying SYN packet storms. Alternatively, setting + this too high can result in increased latency, due to backend servers that are no + longer available, but haven't yet been detected as such. + + An empty or zero healthCheckInterval means no opinion and IngressController chooses + a default, which is subject to change over time. + Currently the default healthCheckInterval value is 5s. + + Currently the minimum allowed value is 1s and the maximum allowed value is + 2147483647ms (24.85 days). Both are subject to change over time. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + httpKeepAliveTimeout: + description: |- + httpKeepAliveTimeout defines the maximum allowed time to wait for + a new HTTP request to appear on a connection from the client to the router. + + This field expects an unsigned duration string of a decimal number, with optional + fraction and a unit suffix, e.g. "300ms", "1.5s" or "2m45s". + Valid time units are "ms", "s", "m". + The allowed range is from 1 millisecond to 15 minutes. + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 300s. + + Low values (tens of milliseconds or less) can cause clients to close and reopen connections + for each request, leading to reduced connection sharing. + For HTTP/2, special care should be taken with low values. + A few seconds is a reasonable starting point to avoid holding idle connections open + while still allowing subsequent requests to reuse the connection. + + High values (minutes or more) favor connection reuse but may cause idle + connections to linger longer. + maxLength: 16 + minLength: 1 + type: string + x-kubernetes-validations: + - message: httpKeepAliveTimeout must be a valid duration string + composed of an unsigned integer value, optionally followed + by a decimal fraction and a unit suffix (ms, s, m) + rule: self.matches('^([0-9]+(\\.[0-9]+)?(ms|s|m))+$') + - message: httpKeepAliveTimeout must be less than or equal to + 15 minutes + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) <= duration(''15m'')' + - message: httpKeepAliveTimeout must be greater than or equal + to 1 millisecond + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) >= duration(''1ms'')' + maxConnections: + description: |- + maxConnections defines the maximum number of simultaneous + connections that can be established per HAProxy process. + Increasing this value allows each ingress controller pod to + handle more connections but at the cost of additional + system resources being consumed. + + Permitted values are: empty, 0, -1, and the range + 2000-2000000. + + If this field is empty or 0, the IngressController will use + the default value of 50000, but the default is subject to + change in future releases. + + If the value is -1 then HAProxy will dynamically compute a + maximum value based on the available ulimits in the running + container. Selecting -1 (i.e., auto) will result in a large + value being computed (~520000 on OpenShift >=4.10 clusters) + and therefore each HAProxy process will incur significant + memory usage compared to the current default of 50000. + + Setting a value that is greater than the current operating + system limit will prevent the HAProxy process from + starting. + + If you choose a discrete value (e.g., 750000) and the + router pod is migrated to a new node, there's no guarantee + that that new node has identical ulimits configured. In + such a scenario the pod would fail to start. If you have + nodes with different ulimits configured (e.g., different + tuned profiles) and you choose a discrete value then the + guidance is to use -1 and let the value be computed + dynamically at runtime. + + You can monitor memory usage for router containers with the + following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}'. + + You can monitor memory usage of individual HAProxy + processes in router containers with the following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}/container_processes{container="router",namespace="openshift-ingress"}'. + format: int32 + type: integer + reloadInterval: + description: |- + reloadInterval defines the minimum interval at which the router is allowed to reload + to accept new changes. Increasing this value can prevent the accumulation of + HAProxy processes, depending on the scenario. Increasing this interval can + also lessen load imbalance on a backend's servers when using the roundrobin + balancing algorithm. Alternatively, decreasing this value may decrease latency + since updates to HAProxy's configuration can take effect more quickly. + + The value must be a time duration value; see . + Currently, the minimum value allowed is 1s, and the maximum allowed value is + 120s. Minimum and maximum allowed values may change in future versions of OpenShift. + Note that if a duration outside of these bounds is provided, the value of reloadInterval + will be capped/floored and not rejected (e.g. a duration of over 120s will be capped to + 120s; the IngressController will not reject and replace this disallowed value with + the default). + + A zero value for reloadInterval tells the IngressController to choose the default, + which is currently 5s and subject to change without notice. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Note: Setting a value significantly larger than the default of 5s can cause latency + in observing updates to routes and their endpoints. HAProxy's configuration will + be reloaded less frequently, and newly created routes will not be served until the + subsequent reload. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + serverFinTimeout: + description: |- + serverFinTimeout defines how long a connection will be held open while + waiting for the server/backend response to the client closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + serverTimeout: + description: |- + serverTimeout defines how long a connection will be held open while + waiting for a server/backend response. + + If unset, the default timeout is 30s + format: duration + type: string + threadCount: + description: |- + threadCount defines the number of threads created per HAProxy process. + Creating more threads allows each ingress controller pod to handle more + connections, at the cost of more system resources being used. HAProxy + currently supports up to 64 threads. If this field is empty, the + IngressController will use the default value. The current default is 4 + threads, but this may change in future releases. + + Setting this field is generally not recommended. Increasing the number + of HAProxy threads allows ingress controller pods to utilize more CPU + time under load, potentially starving other pods if set too high. + Reducing the number of threads may cause the ingress controller to + perform poorly. + format: int32 + maximum: 64 + minimum: 1 + type: integer + tlsInspectDelay: + description: |- + tlsInspectDelay defines how long the router can hold data to find a + matching route. + + Setting this too short can cause the router to fall back to the default + certificate for edge-terminated or reencrypt routes even when a better + matching certificate could be used. + + If unset, the default inspect delay is 5s + format: duration + type: string + tunnelTimeout: + description: |- + tunnelTimeout defines how long a tunnel connection (including + websockets) will be held open while the tunnel is idle. + + If unset, the default timeout is 1h + format: duration + type: string + type: object + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides allows specifying unsupported + configuration options. Its use is unsupported. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + status: + description: status is the most recently observed status of the IngressController. + properties: + availableReplicas: + description: |- + availableReplicas is number of observed available replicas according to the + ingress controller deployment. + format: int32 + type: integer + conditions: + description: |- + conditions is a list of conditions and their status. + + Available means the ingress controller deployment is available and + servicing route and ingress resources (i.e, .status.availableReplicas + equals .spec.replicas) + + There are additional conditions which indicate the status of other + ingress controller features and capabilities. + + * LoadBalancerManaged + - True if the following conditions are met: + * The endpoint publishing strategy requires a service load balancer. + - False if any of those conditions are unsatisfied. + + * LoadBalancerReady + - True if the following conditions are met: + * A load balancer is managed. + * The load balancer is ready. + - False if any of those conditions are unsatisfied. + + * DNSManaged + - True if the following conditions are met: + * The endpoint publishing strategy and platform support DNS. + * The ingress controller domain is set. + * dns.config.openshift.io/cluster configures DNS zones. + - False if any of those conditions are unsatisfied. + + * DNSReady + - True if the following conditions are met: + * DNS is managed. + * DNS records have been successfully created. + - False if any of those conditions are unsatisfied. + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + domain: + description: domain is the actual domain in use. + type: string + endpointPublishingStrategy: + description: endpointPublishingStrategy is the actual strategy in + use. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + namespaceSelector: + description: namespaceSelector is the actual namespaceSelector in + use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + observedGeneration: + description: observedGeneration is the most recent generation observed. + format: int64 + type: integer + routeSelector: + description: routeSelector is the actual routeSelector in use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + selector: + description: |- + selector is a label selector, in string format, for ingress controller pods + corresponding to the IngressController. The number of matching pods should + equal the value of availableReplicas. + type: string + tlsProfile: + description: tlsProfile is the TLS connection configuration that is + in effect. + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + type: object + type: object + x-kubernetes-validations: + - message: The combined 'router-' + metadata.name + '.' + .spec.domain cannot + exceed 253 characters + rule: '!has(self.spec.domain) || size(''router-'' + self.metadata.name + + ''.'' + self.spec.domain) <= 253' + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.availableReplicas + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml new file mode 100644 index 0000000000..97c3ca8c40 --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -0,0 +1,3286 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/616 + api.openshift.io/merged-by-featuregates: "true" + capability.openshift.io/name: Ingress + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: Default + name: ingresscontrollers.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: IngressController + listKind: IngressControllerList + plural: ingresscontrollers + singular: ingresscontroller + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + IngressController describes a managed ingress controller for the cluster. The + controller can service OpenShift Route and Kubernetes Ingress resources. + + When an IngressController is created, a new ingress controller deployment is + created to allow external traffic to reach the services that expose Ingress + or Route resources. Updating this resource may lead to disruption for public + facing network connections as a new ingress controller revision may be rolled + out. + + https://kubernetes.io/docs/concepts/services-networking/ingress-controllers + + Whenever possible, sensible defaults for the platform are used. See each + field for more details. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the specification of the desired behavior of the + IngressController. + properties: + clientTLS: + description: |- + clientTLS specifies settings for requesting and verifying client + certificates, which can be used to enable mutual TLS for + edge-terminated and reencrypt routes. + properties: + allowedSubjectPatterns: + description: |- + allowedSubjectPatterns specifies a list of regular expressions that + should be matched against the distinguished name on a valid client + certificate to filter requests. The regular expressions must use + PCRE syntax. If this list is empty, no filtering is performed. If + the list is nonempty, then at least one pattern must match a client + certificate's distinguished name or else the ingress controller + rejects the certificate and denies the connection. + items: + type: string + type: array + x-kubernetes-list-type: atomic + clientCA: + description: |- + clientCA specifies a configmap containing the PEM-encoded CA + certificate bundle that should be used to verify a client's + certificate. The administrator must create this configmap in the + openshift-config namespace. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + clientCertificatePolicy: + description: |- + clientCertificatePolicy specifies whether the ingress controller + requires clients to provide certificates. This field accepts the + values "Required" or "Optional". + + Note that the ingress controller only checks client certificates for + edge-terminated and reencrypt TLS routes; it cannot check + certificates for cleartext HTTP or passthrough TLS routes. + enum: + - "" + - Required + - Optional + type: string + required: + - clientCA + - clientCertificatePolicy + type: object + closedClientConnectionPolicy: + default: Continue + description: |- + closedClientConnectionPolicy controls how the IngressController + behaves when the client closes the TCP connection while the TLS + handshake or HTTP request is in progress. This option maps directly + to HAProxy’s "abortonclose" option. + + Valid values are: "Abort" and "Continue". + The default value is "Continue". + + When set to "Abort", the router will stop processing the TLS handshake + if it is in progress, and it will not send an HTTP request to the backend server + if the request has not yet been sent when the client closes the connection. + + When set to "Continue", the router will complete the TLS handshake + if it is in progress, or send an HTTP request to the backend server + and wait for the backend server's response, regardless of + whether the client has closed the connection. + + Setting "Abort" can help free CPU resources otherwise spent on TLS computation + for connections the client has already closed, and can reduce request queue + size, thereby reducing the load on saturated backend servers. + + Important Considerations: + + - The default policy ("Continue") is HTTP-compliant, and requests + for aborted client connections will still be served. + Use the "Continue" policy to allow a client to send a request + and then immediately close its side of the connection while + still receiving a response on the half-closed connection. + + - When clients use keep-alive connections, the most common case for premature + closure is when the user wants to cancel the transfer or when a timeout + occurs. In that case, the "Abort" policy may be used to reduce resource consumption. + + - Using RSA keys larger than 2048 bits can significantly slow down + TLS computations. Consider using the "Abort" policy to reduce CPU usage. + enum: + - Abort + - Continue + type: string + defaultCertificate: + description: |- + defaultCertificate is a reference to a secret containing the default + certificate served by the ingress controller. When Routes don't specify + their own certificate, defaultCertificate is used. + + The secret must contain the following keys and data: + + tls.crt: certificate file contents + tls.key: key file contents + + If unset, a wildcard certificate is automatically generated and used. The + certificate is valid for the ingress controller domain (and subdomains) and + the generated certificate's CA will be automatically integrated with the + cluster's trust store. + + If a wildcard certificate is used and shared by multiple + HTTP/2 enabled routes (which implies ALPN) then clients + (i.e., notably browsers) are at liberty to reuse open + connections. This means a client can reuse a connection to + another route and that is likely to fail. This behaviour is + generally known as connection coalescing. + + The in-use certificate (whether generated or user-specified) will be + automatically integrated with OpenShift's built-in OAuth server. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + domain: + description: |- + domain is a DNS name serviced by the ingress controller and is used to + configure multiple features: + + * For the LoadBalancerService endpoint publishing strategy, domain is + used to configure DNS records. See endpointPublishingStrategy. + + * When using a generated default certificate, the certificate will be valid + for domain and its subdomains. See defaultCertificate. + + * The value is published to individual Route statuses so that end-users + know where to target external DNS records. + + domain must be unique among all IngressControllers, and cannot be + updated. + + If empty, defaults to ingress.config.openshift.io/cluster .spec.domain. + + The domain value must be a valid DNS name. It must consist of lowercase + alphanumeric characters, '-' or '.', and each label must start and end + with an alphanumeric character and not exceed 63 characters. Maximum + length of a valid DNS domain is 253 characters. + + The implementation may add a prefix such as "router-default." to the domain + when constructing the router canonical hostname. To ensure the resulting + hostname does not exceed the DNS maximum length of 253 characters, + the domain length is additionally validated at the IngressController object + level. For the maximum length of the domain value itself, the shortest + possible variant of the prefix and the ingress controller name was considered + for example "router-a." + maxLength: 244 + type: string + x-kubernetes-validations: + - message: domain must consist of lower case alphanumeric characters, + '-' or '.', and must start and end with an alphanumeric character + rule: '!format.dns1123Subdomain().validate(self).hasValue()' + - message: each DNS label must not exceed 63 characters + rule: self.split('.').all(label, size(label) <= 63) + endpointPublishingStrategy: + description: |- + endpointPublishingStrategy is used to publish the ingress controller + endpoints to other networks, enable load balancer integrations, etc. + + If unset, the default is based on + infrastructure.config.openshift.io/cluster .status.platform: + + AWS: LoadBalancerService (with External scope) + Azure: LoadBalancerService (with External scope) + GCP: LoadBalancerService (with External scope) + IBMCloud: LoadBalancerService (with External scope) + AlibabaCloud: LoadBalancerService (with External scope) + Libvirt: HostNetwork + + Any other platform types (including None) default to HostNetwork. + + endpointPublishingStrategy cannot be updated. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + httpCompression: + description: |- + httpCompression defines a policy for HTTP traffic compression. + By default, there is no HTTP compression. + properties: + mimeTypes: + description: |- + mimeTypes is a list of MIME types that should have compression applied. + This list can be empty, in which case the ingress controller does not apply compression. + + Note: Not all MIME types benefit from compression, but HAProxy will still use resources + to try to compress if instructed to. Generally speaking, text (html, css, js, etc.) + formats benefit from compression, but formats that are already compressed (image, + audio, video, etc.) benefit little in exchange for the time and cpu spent on compressing + again. See https://joehonton.medium.com/the-gzip-penalty-d31bd697f1a2 + items: + description: |- + CompressionMIMEType defines the format of a single MIME type. + E.g. "text/css; charset=utf-8", "text/html", "text/*", "image/svg+xml", + "application/octet-stream", "X-custom/customsub", etc. + + The format should follow the Content-Type definition in RFC 1341: + Content-Type := type "/" subtype *[";" parameter] + - The type in Content-Type can be one of: + application, audio, image, message, multipart, text, video, or a custom + type preceded by "X-" and followed by a token as defined below. + - The token is a string of at least one character, and not containing white + space, control characters, or any of the characters in the tspecials set. + - The tspecials set contains the characters ()<>@,;:\"/[]?.= + - The subtype in Content-Type is also a token. + - The optional parameter/s following the subtype are defined as: + token "=" (token / quoted-string) + - The quoted-string, as defined in RFC 822, is surrounded by double quotes + and can contain white space plus any character EXCEPT \, ", and CR. + It can also contain any single ASCII character as long as it is escaped by \. + pattern: ^(?i)(x-[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|application|audio|image|message|multipart|text|video)/[^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+(; *[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+=([^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|"(\\[\x00-\x7F]|[^\x0D"\\])*"))*$ + type: string + type: array + x-kubernetes-list-type: set + type: object + httpEmptyRequestsPolicy: + default: Respond + description: |- + httpEmptyRequestsPolicy describes how HTTP connections should be + handled if the connection times out before a request is received. + Allowed values for this field are "Respond" and "Ignore". If the + field is set to "Respond", the ingress controller sends an HTTP 400 + or 408 response, logs the connection (if access logging is enabled), + and counts the connection in the appropriate metrics. If the field + is set to "Ignore", the ingress controller closes the connection + without sending a response, logging the connection, or incrementing + metrics. The default value is "Respond". + + Typically, these connections come from load balancers' health probes + or Web browsers' speculative connections ("preconnect") and can be + safely ignored. However, these requests may also be caused by + network errors, and so setting this field to "Ignore" may impede + detection and diagnosis of problems. In addition, these requests may + be caused by port scans, in which case logging empty requests may aid + in detecting intrusion attempts. + enum: + - Respond + - Ignore + type: string + httpErrorCodePages: + description: |- + httpErrorCodePages specifies a configmap with custom error pages. + The administrator must create this configmap in the openshift-config namespace. + This configmap should have keys in the format "error-page-.http", + where is an HTTP error code. + For example, "error-page-503.http" defines an error page for HTTP 503 responses. + Currently only error pages for 503 and 404 responses can be customized. + Each value in the configmap should be the full response, including HTTP headers. + Eg- https://raw.githubusercontent.com/openshift/router/fadab45747a9b30cc3f0a4b41ad2871f95827a93/images/router/haproxy/conf/error-page-503.http + If this field is empty, the ingress controller uses the default error pages. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + httpHeaders: + description: |- + httpHeaders defines policy for HTTP headers. + + If this field is empty, the default values are used. + properties: + actions: + description: |- + actions specifies options for modifying headers and their values. + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be modified for TLS passthrough + connections. + Setting the HSTS (`Strict-Transport-Security`) header is not supported via actions. `Strict-Transport-Security` + may only be configured using the "haproxy.router.openshift.io/hsts_header" route annotation, and only in + accordance with the policy specified in Ingress.Spec.RequiredHSTSPolicies. + Any actions defined here are applied after any actions related to the following other fields: + cache-control, spec.clientTLS, + spec.httpHeaders.forwardedHeaderPolicy, spec.httpHeaders.uniqueId, + and spec.httpHeaders.headerNameCaseAdjustments. + In case of HTTP request headers, the actions specified in spec.httpHeaders.actions on the Route will be executed after + the actions specified in the IngressController's spec.httpHeaders.actions field. + In case of HTTP response headers, the actions specified in spec.httpHeaders.actions on the IngressController will be + executed after the actions specified in the Route's spec.httpHeaders.actions field. + Headers set using this API cannot be captured for use in access logs. + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. Please refer to the documentation + for that API field for more details. + properties: + request: + description: |- + request is a list of HTTP request headers to modify. + Actions defined here will modify the request headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for request headers will be executed before Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 request header actions may be configured. + Sample fetchers allowed are "req.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[req.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are req.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:req\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + response: + description: |- + response is a list of HTTP response headers to modify. + Actions defined here will modify the response headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for response headers will be executed after Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 response header actions may be configured. + Sample fetchers allowed are "res.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[res.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are res.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:res\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + type: object + forwardedHeaderPolicy: + description: |- + forwardedHeaderPolicy specifies when and how the IngressController + sets the Forwarded, X-Forwarded-For, X-Forwarded-Host, + X-Forwarded-Port, X-Forwarded-Proto, and X-Forwarded-Proto-Version + HTTP headers. The value may be one of the following: + + * "Append", which specifies that the IngressController appends the + headers, preserving existing headers. + + * "Replace", which specifies that the IngressController sets the + headers, replacing any existing Forwarded or X-Forwarded-* headers. + + * "IfNone", which specifies that the IngressController sets the + headers if they are not already set. + + * "Never", which specifies that the IngressController never sets the + headers, preserving any existing headers. + + By default, the policy is "Append". + enum: + - Append + - Replace + - IfNone + - Never + type: string + headerNameCaseAdjustments: + description: |- + headerNameCaseAdjustments specifies case adjustments that can be + applied to HTTP header names. Each adjustment is specified as an + HTTP header name with the desired capitalization. For example, + specifying "X-Forwarded-For" indicates that the "x-forwarded-for" + HTTP header should be adjusted to have the specified capitalization. + + These adjustments are only applied to cleartext, edge-terminated, and + re-encrypt routes, and only when using HTTP/1. + + For request headers, these adjustments are applied only for routes + that have the haproxy.router.openshift.io/h1-adjust-case=true + annotation. For response headers, these adjustments are applied to + all HTTP responses. + + If this field is empty, no request headers are adjusted. + items: + description: |- + IngressControllerHTTPHeaderNameCaseAdjustment is the name of an HTTP header + (for example, "X-Forwarded-For") in the desired capitalization. The value + must be a valid HTTP header name as defined in RFC 2616 section 4.2. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + uniqueId: + description: |- + uniqueId describes configuration for a custom HTTP header that the + ingress controller should inject into incoming HTTP requests. + Typically, this header is configured to have a value that is unique + to the HTTP request. The header can be used by applications or + included in access logs to facilitate tracing individual HTTP + requests. + + If this field is empty, no such header is injected into requests. + properties: + format: + description: |- + format specifies the format for the injected HTTP header's value. + This field has no effect unless name is specified. For the + HAProxy-based ingress controller implementation, this format uses the + same syntax as the HTTP log format. If the field is empty, the + default value is "%{+X}o\\ %ci:%cp_%fi:%fp_%Ts_%rt:%pid"; see the + corresponding HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + maxLength: 1024 + minLength: 0 + pattern: ^(%(%|(\{[-+]?[QXE](,[-+]?[QXE])*\})?([A-Za-z]+|\[[.0-9A-Z_a-z]+(\([^)]+\))?(,[.0-9A-Z_a-z]+(\([^)]+\))?)*\]))|[^%[:cntrl:]])*$ + type: string + name: + description: |- + name specifies the name of the HTTP header (for example, "unique-id") + that the ingress controller should inject into HTTP requests. The + field's value must be a valid HTTP header name as defined in RFC 2616 + section 4.2. If the field is empty, no header is injected. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + type: object + type: object + idleConnectionTerminationPolicy: + default: Immediate + description: |- + idleConnectionTerminationPolicy maps directly to HAProxy's + idle-close-on-response option and controls whether HAProxy + keeps idle frontend connections open during a soft stop + (router reload). + + Allowed values for this field are "Immediate" and + "Deferred". The default value is "Immediate". + + When set to "Immediate", idle connections are closed + immediately during router reloads. This ensures immediate + propagation of route changes but may impact clients + sensitive to connection resets. + + When set to "Deferred", HAProxy will maintain idle + connections during a soft reload instead of closing them + immediately. These connections remain open until any of the + following occurs: + + - A new request is received on the connection, in which + case HAProxy handles it in the old process and closes + the connection after sending the response. + + - HAProxy's `timeout http-keep-alive` duration expires. + By default this is 300 seconds, but it can be changed + using httpKeepAliveTimeout tuning option. + + - The client's keep-alive timeout expires, causing the + client to close the connection. + + Setting Deferred can help prevent errors in clients or load + balancers that do not properly handle connection resets. + Additionally, this option allows you to retain the pre-2.4 + HAProxy behaviour: in HAProxy version 2.2 (OpenShift + versions < 4.14), maintaining idle connections during a + soft reload was the default behaviour, but starting with + HAProxy 2.4, the default changed to closing idle + connections immediately. + + Important Consideration: + + - Using Deferred will result in temporary inconsistencies + for the first request on each persistent connection + after a route update and router reload. This request + will be processed by the old HAProxy process using its + old configuration. Subsequent requests will use the + updated configuration. + + Operational Considerations: + + - Keeping idle connections open during reloads may lead + to an accumulation of old HAProxy processes if + connections remain idle for extended periods, + especially in environments where frequent reloads + occur. + + - Consider monitoring the number of HAProxy processes in + the router pods when Deferred is set. + + - You may need to enable or adjust the + `ingress.operator.openshift.io/hard-stop-after` + duration (configured via an annotation on the + IngressController resource) in environments with + frequent reloads to prevent resource exhaustion. + enum: + - Immediate + - Deferred + type: string + logging: + description: |- + logging defines parameters for what should be logged where. If this + field is empty, operational logs are enabled but access logs are + disabled. + properties: + access: + description: |- + access describes how the client requests should be logged. + + If this field is empty, access logging is disabled. + properties: + destination: + description: destination is where access logs go. + properties: + container: + description: |- + container holds parameters for the Container logging destination. + Present only if type is Container. + properties: + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 8192, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 8192 + minimum: 480 + type: integer + type: object + syslog: + description: |- + syslog holds parameters for a syslog endpoint. Present only if + type is Syslog. + oneOf: + - properties: + address: + format: ipv4 + - properties: + address: + format: ipv6 + properties: + address: + description: |- + address is the IP address of the syslog endpoint that receives log + messages. + type: string + facility: + description: |- + facility specifies the syslog facility of log messages. + + If this field is empty, the facility is "local1". + enum: + - kern + - user + - mail + - daemon + - auth + - syslog + - lpr + - news + - uucp + - cron + - auth2 + - ftp + - ntp + - audit + - alert + - cron2 + - local0 + - local1 + - local2 + - local3 + - local4 + - local5 + - local6 + - local7 + type: string + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 4096, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 4096 + minimum: 480 + type: integer + port: + description: |- + port is the UDP port number of the syslog endpoint that receives log + messages. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - address + - port + type: object + type: + description: |- + type is the type of destination for logs. It must be one of the + following: + + * Container + + The ingress operator configures the sidecar container named "logs" on + the ingress controller pod and configures the ingress controller to + write logs to the sidecar. The logs are then available as container + logs. The expectation is that the administrator configures a custom + logging solution that reads logs from this sidecar. Note that using + container logs means that logs may be dropped if the rate of logs + exceeds the container runtime's or the custom logging solution's + capacity. + + * Syslog + + Logs are sent to a syslog endpoint. The administrator must specify + an endpoint that can receive syslog messages. The expectation is + that the administrator has configured a custom syslog instance. + enum: + - Container + - Syslog + type: string + required: + - type + type: object + httpCaptureCookies: + description: |- + httpCaptureCookies specifies HTTP cookies that should be captured in + access logs. If this field is empty, no cookies are captured. + items: + description: |- + IngressControllerCaptureHTTPCookie describes an HTTP cookie that should be + captured. + properties: + matchType: + description: |- + matchType specifies the type of match to be performed on the cookie + name. Allowed values are "Exact" for an exact string match and + "Prefix" for a string prefix match. If "Exact" is specified, a name + must be specified in the name field. If "Prefix" is provided, a + prefix must be specified in the namePrefix field. For example, + specifying matchType "Prefix" and namePrefix "foo" will capture a + cookie named "foo" or "foobar" but not one named "bar". The first + matching cookie is captured. + enum: + - Exact + - Prefix + type: string + maxLength: + description: |- + maxLength specifies a maximum length of the string that will be + logged, which includes the cookie name, cookie value, and + one-character delimiter. If the log entry exceeds this length, the + value will be truncated in the log message. Note that the ingress + controller may impose a separate bound on the total length of HTTP + headers in a request. + maximum: 1024 + minimum: 1 + type: integer + name: + description: |- + name specifies a cookie name. Its value must be a valid HTTP cookie + name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + namePrefix: + description: |- + namePrefix specifies a cookie name prefix. Its value must be a valid + HTTP cookie name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + required: + - matchType + - maxLength + type: object + maxItems: 1 + nullable: true + type: array + x-kubernetes-list-type: atomic + httpCaptureHeaders: + description: |- + httpCaptureHeaders defines HTTP headers that should be captured in + access logs. If this field is empty, no headers are captured. + + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be captured for TLS passthrough + connections. + properties: + request: + description: |- + request specifies which HTTP request headers to capture. + + If this field is empty, no request headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + response: + description: |- + response specifies which HTTP response headers to capture. + + If this field is empty, no response headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + type: object + httpLogFormat: + description: |- + httpLogFormat specifies the format of the log message for an HTTP + request. + + If this field is empty, log messages use the implementation's default + HTTP log format. For HAProxy's default HTTP log format, see the + HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + + Note that this format only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). It does not affect the log format for TLS passthrough + connections. + type: string + logEmptyRequests: + default: Log + description: |- + logEmptyRequests specifies how connections on which no request is + received should be logged. Typically, these empty requests come from + load balancers' health probes or Web browsers' speculative + connections ("preconnect"), in which case logging these requests may + be undesirable. However, these requests may also be caused by + network errors, in which case logging empty requests may be useful + for diagnosing the errors. In addition, these requests may be caused + by port scans, in which case logging empty requests may aid in + detecting intrusion attempts. Allowed values for this field are + "Log" and "Ignore". The default value is "Log". + enum: + - Log + - Ignore + type: string + required: + - destination + type: object + type: object + namespaceSelector: + description: |- + namespaceSelector is used to filter the set of namespaces serviced by the + ingress controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodePlacement: + description: |- + nodePlacement enables explicit control over the scheduling of the ingress + controller. + + If unset, defaults are used. See NodePlacement for more details. + properties: + nodeSelector: + description: |- + nodeSelector is the node selector applied to ingress controller + deployments. + + If set, the specified selector is used and replaces the default. + + If unset, the default depends on the value of the defaultPlacement + field in the cluster config.openshift.io/v1/ingresses status. + + When defaultPlacement is Workers, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/worker: '' + + When defaultPlacement is ControlPlane, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/master: '' + + These defaults are subject to change. + + Note that using nodeSelector.matchExpressions is not supported. Only + nodeSelector.matchLabels may be used. This is a limitation of the + Kubernetes API: the pod spec does not allow complex expressions for + node selectors. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tolerations: + description: |- + tolerations is a list of tolerations applied to ingress controller + deployments. + + The default is an empty list. + + See https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + replicas: + description: |- + replicas is the desired number of ingress controller replicas. If unset, + the default depends on the value of the defaultPlacement field in the + cluster config.openshift.io/v1/ingresses status. + + The value of replicas is set based on the value of a chosen field in the + Infrastructure CR. If defaultPlacement is set to ControlPlane, the + chosen field will be controlPlaneTopology. If it is set to Workers the + chosen field will be infrastructureTopology. Replicas will then be set to 1 + or 2 based whether the chosen field's value is SingleReplica or + HighlyAvailable, respectively. + + These defaults are subject to change. + format: int32 + type: integer + routeAdmission: + description: |- + routeAdmission defines a policy for handling new route claims (for example, + to allow or deny claims across namespaces). + + If empty, defaults will be applied. See specific routeAdmission fields + for details about their defaults. + properties: + namespaceOwnership: + description: |- + namespaceOwnership describes how host name claims across namespaces should + be handled. + + Value must be one of: + + - Strict: Do not allow routes in different namespaces to claim the same host. + + - InterNamespaceAllowed: Allow routes to claim different paths of the same + host name across namespaces. + + If empty, the default is Strict. + enum: + - InterNamespaceAllowed + - Strict + type: string + wildcardPolicy: + description: |- + wildcardPolicy describes how routes with wildcard policies should + be handled for the ingress controller. WildcardPolicy controls use + of routes [1] exposed by the ingress controller based on the route's + wildcard policy. + + [1] https://github.com/openshift/api/blob/master/route/v1/types.go + + Note: Updating WildcardPolicy from WildcardsAllowed to WildcardsDisallowed + will cause admitted routes with a wildcard policy of Subdomain to stop + working. These routes must be updated to a wildcard policy of None to be + readmitted by the ingress controller. + + WildcardPolicy supports WildcardsAllowed and WildcardsDisallowed values. + + If empty, defaults to "WildcardsDisallowed". + enum: + - WildcardsAllowed + - WildcardsDisallowed + type: string + type: object + routeSelector: + description: |- + routeSelector is used to filter the set of Routes serviced by the ingress + controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tlsSecurityProfile: + description: |- + tlsSecurityProfile specifies settings for TLS connections for ingresscontrollers. + + If unset, the default is based on the apiservers.config.openshift.io/cluster resource. + + Note that when using the Old, Intermediate, and Modern profile types, the effective + profile configuration is subject to change between releases. For example, given + a specification to use the Intermediate profile deployed on release X.Y.Z, an upgrade + to release X.Y.Z+1 may cause a new profile configuration to be applied to the ingress + controller, resulting in a rollout. + properties: + custom: + description: |- + custom is a user-defined TLS security profile. Be extremely careful using a custom + profile as invalid configurations can be catastrophic. An example custom profile + looks like this: + + minTLSVersion: VersionTLS11 + ciphers: + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + nullable: true + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + intermediate: + description: |- + intermediate is a TLS profile for use when you do not need compatibility with + legacy clients and want to remain highly secure while being compatible with + most clients currently in use. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS12 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + nullable: true + type: object + modern: + description: |- + modern is a TLS security profile for use with clients that support TLS 1.3 and + do not need backward compatibility for older clients. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS13 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + nullable: true + type: object + old: + description: |- + old is a TLS profile for use when services need to be accessed by very old + clients or libraries and should be used only as a last resort. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS10 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-ECDSA-AES128-SHA256 + - ECDHE-RSA-AES128-SHA256 + - ECDHE-ECDSA-AES128-SHA + - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA + - ECDHE-RSA-AES256-SHA + - AES128-GCM-SHA256 + - AES256-GCM-SHA384 + - AES128-SHA256 + - AES128-SHA + - AES256-SHA + - DES-CBC3-SHA + nullable: true + type: object + type: + description: |- + type is one of Old, Intermediate, Modern or Custom. Custom provides the + ability to specify individual TLS security profile parameters. + + The profiles are based on version 5.7 of the Mozilla Server Side TLS + configuration guidelines. The cipher lists consist of the configuration's + "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.7.json + + The profiles are intent based, so they may change over time as new ciphers are + developed and existing ciphers are found to be insecure. Depending on + precisely which ciphers are available to a process, the list may be reduced. + enum: + - Old + - Intermediate + - Modern + - Custom + type: string + type: object + tuningOptions: + anyOf: + - properties: + maxConnections: + enum: + - -1 + - 0 + - properties: + maxConnections: + format: int32 + maximum: 2000000 + minimum: 2000 + description: |- + tuningOptions defines parameters for adjusting the performance of + ingress controller pods. All fields are optional and will use their + respective defaults if not set. See specific tuningOptions fields for + more details. + + Setting fields within tuningOptions is generally not recommended. The + default values are suitable for most configurations. + properties: + clientFinTimeout: + description: |- + clientFinTimeout defines how long a connection will be held open while + waiting for the client response to the server/backend closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + clientTimeout: + description: |- + clientTimeout defines how long a connection will be held open while + waiting for a client response. + + If unset, the default timeout is 30s + format: duration + type: string + connectTimeout: + description: |- + connectTimeout defines the maximum time to wait for + a connection attempt to a server/backend to succeed. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 5s. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + headerBufferBytes: + description: |- + headerBufferBytes describes how much memory should be reserved + (in bytes) for IngressController connection sessions. + Note that this value must be at least 16384 if HTTP/2 is + enabled for the IngressController (https://tools.ietf.org/html/rfc7540). + If this field is empty, the IngressController will use a default value + of 32768 bytes. + + Setting this field is generally not recommended as headerBufferBytes + values that are too small may break the IngressController and + headerBufferBytes values that are too large could cause the + IngressController to use significantly more memory than necessary. + format: int32 + minimum: 16384 + type: integer + headerBufferMaxRewriteBytes: + description: |- + headerBufferMaxRewriteBytes describes how much memory should be reserved + (in bytes) from headerBufferBytes for HTTP header rewriting + and appending for IngressController connection sessions. + Note that incoming HTTP requests will be limited to + (headerBufferBytes - headerBufferMaxRewriteBytes) bytes, meaning + headerBufferBytes must be greater than headerBufferMaxRewriteBytes. + If this field is empty, the IngressController will use a default value + of 8192 bytes. + + Setting this field is generally not recommended as + headerBufferMaxRewriteBytes values that are too small may break the + IngressController and headerBufferMaxRewriteBytes values that are too + large could cause the IngressController to use significantly more memory + than necessary. + format: int32 + minimum: 4096 + type: integer + healthCheckInterval: + description: |- + healthCheckInterval defines how long the router waits between two consecutive + health checks on its configured backends. This value is applied globally as + a default for all routes, but may be overridden per-route by the route annotation + "router.openshift.io/haproxy.health.check.interval". + + Expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, eg "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Setting this to less than 5s can cause excess traffic due to too frequent + TCP health checks and accompanying SYN packet storms. Alternatively, setting + this too high can result in increased latency, due to backend servers that are no + longer available, but haven't yet been detected as such. + + An empty or zero healthCheckInterval means no opinion and IngressController chooses + a default, which is subject to change over time. + Currently the default healthCheckInterval value is 5s. + + Currently the minimum allowed value is 1s and the maximum allowed value is + 2147483647ms (24.85 days). Both are subject to change over time. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + httpKeepAliveTimeout: + description: |- + httpKeepAliveTimeout defines the maximum allowed time to wait for + a new HTTP request to appear on a connection from the client to the router. + + This field expects an unsigned duration string of a decimal number, with optional + fraction and a unit suffix, e.g. "300ms", "1.5s" or "2m45s". + Valid time units are "ms", "s", "m". + The allowed range is from 1 millisecond to 15 minutes. + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 300s. + + Low values (tens of milliseconds or less) can cause clients to close and reopen connections + for each request, leading to reduced connection sharing. + For HTTP/2, special care should be taken with low values. + A few seconds is a reasonable starting point to avoid holding idle connections open + while still allowing subsequent requests to reuse the connection. + + High values (minutes or more) favor connection reuse but may cause idle + connections to linger longer. + maxLength: 16 + minLength: 1 + type: string + x-kubernetes-validations: + - message: httpKeepAliveTimeout must be a valid duration string + composed of an unsigned integer value, optionally followed + by a decimal fraction and a unit suffix (ms, s, m) + rule: self.matches('^([0-9]+(\\.[0-9]+)?(ms|s|m))+$') + - message: httpKeepAliveTimeout must be less than or equal to + 15 minutes + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) <= duration(''15m'')' + - message: httpKeepAliveTimeout must be greater than or equal + to 1 millisecond + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) >= duration(''1ms'')' + maxConnections: + description: |- + maxConnections defines the maximum number of simultaneous + connections that can be established per HAProxy process. + Increasing this value allows each ingress controller pod to + handle more connections but at the cost of additional + system resources being consumed. + + Permitted values are: empty, 0, -1, and the range + 2000-2000000. + + If this field is empty or 0, the IngressController will use + the default value of 50000, but the default is subject to + change in future releases. + + If the value is -1 then HAProxy will dynamically compute a + maximum value based on the available ulimits in the running + container. Selecting -1 (i.e., auto) will result in a large + value being computed (~520000 on OpenShift >=4.10 clusters) + and therefore each HAProxy process will incur significant + memory usage compared to the current default of 50000. + + Setting a value that is greater than the current operating + system limit will prevent the HAProxy process from + starting. + + If you choose a discrete value (e.g., 750000) and the + router pod is migrated to a new node, there's no guarantee + that that new node has identical ulimits configured. In + such a scenario the pod would fail to start. If you have + nodes with different ulimits configured (e.g., different + tuned profiles) and you choose a discrete value then the + guidance is to use -1 and let the value be computed + dynamically at runtime. + + You can monitor memory usage for router containers with the + following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}'. + + You can monitor memory usage of individual HAProxy + processes in router containers with the following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}/container_processes{container="router",namespace="openshift-ingress"}'. + format: int32 + type: integer + reloadInterval: + description: |- + reloadInterval defines the minimum interval at which the router is allowed to reload + to accept new changes. Increasing this value can prevent the accumulation of + HAProxy processes, depending on the scenario. Increasing this interval can + also lessen load imbalance on a backend's servers when using the roundrobin + balancing algorithm. Alternatively, decreasing this value may decrease latency + since updates to HAProxy's configuration can take effect more quickly. + + The value must be a time duration value; see . + Currently, the minimum value allowed is 1s, and the maximum allowed value is + 120s. Minimum and maximum allowed values may change in future versions of OpenShift. + Note that if a duration outside of these bounds is provided, the value of reloadInterval + will be capped/floored and not rejected (e.g. a duration of over 120s will be capped to + 120s; the IngressController will not reject and replace this disallowed value with + the default). + + A zero value for reloadInterval tells the IngressController to choose the default, + which is currently 5s and subject to change without notice. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Note: Setting a value significantly larger than the default of 5s can cause latency + in observing updates to routes and their endpoints. HAProxy's configuration will + be reloaded less frequently, and newly created routes will not be served until the + subsequent reload. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + serverFinTimeout: + description: |- + serverFinTimeout defines how long a connection will be held open while + waiting for the server/backend response to the client closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + serverTimeout: + description: |- + serverTimeout defines how long a connection will be held open while + waiting for a server/backend response. + + If unset, the default timeout is 30s + format: duration + type: string + threadCount: + description: |- + threadCount defines the number of threads created per HAProxy process. + Creating more threads allows each ingress controller pod to handle more + connections, at the cost of more system resources being used. HAProxy + currently supports up to 64 threads. If this field is empty, the + IngressController will use the default value. The current default is 4 + threads, but this may change in future releases. + + Setting this field is generally not recommended. Increasing the number + of HAProxy threads allows ingress controller pods to utilize more CPU + time under load, potentially starving other pods if set too high. + Reducing the number of threads may cause the ingress controller to + perform poorly. + format: int32 + maximum: 64 + minimum: 1 + type: integer + tlsInspectDelay: + description: |- + tlsInspectDelay defines how long the router can hold data to find a + matching route. + + Setting this too short can cause the router to fall back to the default + certificate for edge-terminated or reencrypt routes even when a better + matching certificate could be used. + + If unset, the default inspect delay is 5s + format: duration + type: string + tunnelTimeout: + description: |- + tunnelTimeout defines how long a tunnel connection (including + websockets) will be held open while the tunnel is idle. + + If unset, the default timeout is 1h + format: duration + type: string + type: object + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides allows specifying unsupported + configuration options. Its use is unsupported. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + status: + description: status is the most recently observed status of the IngressController. + properties: + availableReplicas: + description: |- + availableReplicas is number of observed available replicas according to the + ingress controller deployment. + format: int32 + type: integer + conditions: + description: |- + conditions is a list of conditions and their status. + + Available means the ingress controller deployment is available and + servicing route and ingress resources (i.e, .status.availableReplicas + equals .spec.replicas) + + There are additional conditions which indicate the status of other + ingress controller features and capabilities. + + * LoadBalancerManaged + - True if the following conditions are met: + * The endpoint publishing strategy requires a service load balancer. + - False if any of those conditions are unsatisfied. + + * LoadBalancerReady + - True if the following conditions are met: + * A load balancer is managed. + * The load balancer is ready. + - False if any of those conditions are unsatisfied. + + * DNSManaged + - True if the following conditions are met: + * The endpoint publishing strategy and platform support DNS. + * The ingress controller domain is set. + * dns.config.openshift.io/cluster configures DNS zones. + - False if any of those conditions are unsatisfied. + + * DNSReady + - True if the following conditions are met: + * DNS is managed. + * DNS records have been successfully created. + - False if any of those conditions are unsatisfied. + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + domain: + description: domain is the actual domain in use. + type: string + endpointPublishingStrategy: + description: endpointPublishingStrategy is the actual strategy in + use. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + namespaceSelector: + description: namespaceSelector is the actual namespaceSelector in + use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + observedGeneration: + description: observedGeneration is the most recent generation observed. + format: int64 + type: integer + routeSelector: + description: routeSelector is the actual routeSelector in use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + selector: + description: |- + selector is a label selector, in string format, for ingress controller pods + corresponding to the IngressController. The number of matching pods should + equal the value of availableReplicas. + type: string + tlsProfile: + description: tlsProfile is the TLS connection configuration that is + in effect. + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + type: object + type: object + x-kubernetes-validations: + - message: The combined 'router-' + metadata.name + '.' + .spec.domain cannot + exceed 253 characters + rule: '!has(self.spec.domain) || size(''router-'' + self.metadata.name + + ''.'' + self.spec.domain) <= 253' + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.availableReplicas + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml new file mode 100644 index 0000000000..89c366cda4 --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml @@ -0,0 +1,3317 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/616 + api.openshift.io/merged-by-featuregates: "true" + capability.openshift.io/name: Ingress + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: DevPreviewNoUpgrade + name: ingresscontrollers.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: IngressController + listKind: IngressControllerList + plural: ingresscontrollers + singular: ingresscontroller + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + IngressController describes a managed ingress controller for the cluster. The + controller can service OpenShift Route and Kubernetes Ingress resources. + + When an IngressController is created, a new ingress controller deployment is + created to allow external traffic to reach the services that expose Ingress + or Route resources. Updating this resource may lead to disruption for public + facing network connections as a new ingress controller revision may be rolled + out. + + https://kubernetes.io/docs/concepts/services-networking/ingress-controllers + + Whenever possible, sensible defaults for the platform are used. See each + field for more details. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the specification of the desired behavior of the + IngressController. + properties: + clientTLS: + description: |- + clientTLS specifies settings for requesting and verifying client + certificates, which can be used to enable mutual TLS for + edge-terminated and reencrypt routes. + properties: + allowedSubjectPatterns: + description: |- + allowedSubjectPatterns specifies a list of regular expressions that + should be matched against the distinguished name on a valid client + certificate to filter requests. The regular expressions must use + PCRE syntax. If this list is empty, no filtering is performed. If + the list is nonempty, then at least one pattern must match a client + certificate's distinguished name or else the ingress controller + rejects the certificate and denies the connection. + items: + type: string + type: array + x-kubernetes-list-type: atomic + clientCA: + description: |- + clientCA specifies a configmap containing the PEM-encoded CA + certificate bundle that should be used to verify a client's + certificate. The administrator must create this configmap in the + openshift-config namespace. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + clientCertificatePolicy: + description: |- + clientCertificatePolicy specifies whether the ingress controller + requires clients to provide certificates. This field accepts the + values "Required" or "Optional". + + Note that the ingress controller only checks client certificates for + edge-terminated and reencrypt TLS routes; it cannot check + certificates for cleartext HTTP or passthrough TLS routes. + enum: + - "" + - Required + - Optional + type: string + required: + - clientCA + - clientCertificatePolicy + type: object + closedClientConnectionPolicy: + default: Continue + description: |- + closedClientConnectionPolicy controls how the IngressController + behaves when the client closes the TCP connection while the TLS + handshake or HTTP request is in progress. This option maps directly + to HAProxy’s "abortonclose" option. + + Valid values are: "Abort" and "Continue". + The default value is "Continue". + + When set to "Abort", the router will stop processing the TLS handshake + if it is in progress, and it will not send an HTTP request to the backend server + if the request has not yet been sent when the client closes the connection. + + When set to "Continue", the router will complete the TLS handshake + if it is in progress, or send an HTTP request to the backend server + and wait for the backend server's response, regardless of + whether the client has closed the connection. + + Setting "Abort" can help free CPU resources otherwise spent on TLS computation + for connections the client has already closed, and can reduce request queue + size, thereby reducing the load on saturated backend servers. + + Important Considerations: + + - The default policy ("Continue") is HTTP-compliant, and requests + for aborted client connections will still be served. + Use the "Continue" policy to allow a client to send a request + and then immediately close its side of the connection while + still receiving a response on the half-closed connection. + + - When clients use keep-alive connections, the most common case for premature + closure is when the user wants to cancel the transfer or when a timeout + occurs. In that case, the "Abort" policy may be used to reduce resource consumption. + + - Using RSA keys larger than 2048 bits can significantly slow down + TLS computations. Consider using the "Abort" policy to reduce CPU usage. + enum: + - Abort + - Continue + type: string + defaultCertificate: + description: |- + defaultCertificate is a reference to a secret containing the default + certificate served by the ingress controller. When Routes don't specify + their own certificate, defaultCertificate is used. + + The secret must contain the following keys and data: + + tls.crt: certificate file contents + tls.key: key file contents + + If unset, a wildcard certificate is automatically generated and used. The + certificate is valid for the ingress controller domain (and subdomains) and + the generated certificate's CA will be automatically integrated with the + cluster's trust store. + + If a wildcard certificate is used and shared by multiple + HTTP/2 enabled routes (which implies ALPN) then clients + (i.e., notably browsers) are at liberty to reuse open + connections. This means a client can reuse a connection to + another route and that is likely to fail. This behaviour is + generally known as connection coalescing. + + The in-use certificate (whether generated or user-specified) will be + automatically integrated with OpenShift's built-in OAuth server. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + domain: + description: |- + domain is a DNS name serviced by the ingress controller and is used to + configure multiple features: + + * For the LoadBalancerService endpoint publishing strategy, domain is + used to configure DNS records. See endpointPublishingStrategy. + + * When using a generated default certificate, the certificate will be valid + for domain and its subdomains. See defaultCertificate. + + * The value is published to individual Route statuses so that end-users + know where to target external DNS records. + + domain must be unique among all IngressControllers, and cannot be + updated. + + If empty, defaults to ingress.config.openshift.io/cluster .spec.domain. + + The domain value must be a valid DNS name. It must consist of lowercase + alphanumeric characters, '-' or '.', and each label must start and end + with an alphanumeric character and not exceed 63 characters. Maximum + length of a valid DNS domain is 253 characters. + + The implementation may add a prefix such as "router-default." to the domain + when constructing the router canonical hostname. To ensure the resulting + hostname does not exceed the DNS maximum length of 253 characters, + the domain length is additionally validated at the IngressController object + level. For the maximum length of the domain value itself, the shortest + possible variant of the prefix and the ingress controller name was considered + for example "router-a." + maxLength: 244 + type: string + x-kubernetes-validations: + - message: domain must consist of lower case alphanumeric characters, + '-' or '.', and must start and end with an alphanumeric character + rule: '!format.dns1123Subdomain().validate(self).hasValue()' + - message: each DNS label must not exceed 63 characters + rule: self.split('.').all(label, size(label) <= 63) + endpointPublishingStrategy: + description: |- + endpointPublishingStrategy is used to publish the ingress controller + endpoints to other networks, enable load balancer integrations, etc. + + If unset, the default is based on + infrastructure.config.openshift.io/cluster .status.platform: + + AWS: LoadBalancerService (with External scope) + Azure: LoadBalancerService (with External scope) + GCP: LoadBalancerService (with External scope) + IBMCloud: LoadBalancerService (with External scope) + AlibabaCloud: LoadBalancerService (with External scope) + Libvirt: HostNetwork + + Any other platform types (including None) default to HostNetwork. + + endpointPublishingStrategy cannot be updated. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + httpCompression: + description: |- + httpCompression defines a policy for HTTP traffic compression. + By default, there is no HTTP compression. + properties: + mimeTypes: + description: |- + mimeTypes is a list of MIME types that should have compression applied. + This list can be empty, in which case the ingress controller does not apply compression. + + Note: Not all MIME types benefit from compression, but HAProxy will still use resources + to try to compress if instructed to. Generally speaking, text (html, css, js, etc.) + formats benefit from compression, but formats that are already compressed (image, + audio, video, etc.) benefit little in exchange for the time and cpu spent on compressing + again. See https://joehonton.medium.com/the-gzip-penalty-d31bd697f1a2 + items: + description: |- + CompressionMIMEType defines the format of a single MIME type. + E.g. "text/css; charset=utf-8", "text/html", "text/*", "image/svg+xml", + "application/octet-stream", "X-custom/customsub", etc. + + The format should follow the Content-Type definition in RFC 1341: + Content-Type := type "/" subtype *[";" parameter] + - The type in Content-Type can be one of: + application, audio, image, message, multipart, text, video, or a custom + type preceded by "X-" and followed by a token as defined below. + - The token is a string of at least one character, and not containing white + space, control characters, or any of the characters in the tspecials set. + - The tspecials set contains the characters ()<>@,;:\"/[]?.= + - The subtype in Content-Type is also a token. + - The optional parameter/s following the subtype are defined as: + token "=" (token / quoted-string) + - The quoted-string, as defined in RFC 822, is surrounded by double quotes + and can contain white space plus any character EXCEPT \, ", and CR. + It can also contain any single ASCII character as long as it is escaped by \. + pattern: ^(?i)(x-[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|application|audio|image|message|multipart|text|video)/[^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+(; *[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+=([^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|"(\\[\x00-\x7F]|[^\x0D"\\])*"))*$ + type: string + type: array + x-kubernetes-list-type: set + type: object + httpEmptyRequestsPolicy: + default: Respond + description: |- + httpEmptyRequestsPolicy describes how HTTP connections should be + handled if the connection times out before a request is received. + Allowed values for this field are "Respond" and "Ignore". If the + field is set to "Respond", the ingress controller sends an HTTP 400 + or 408 response, logs the connection (if access logging is enabled), + and counts the connection in the appropriate metrics. If the field + is set to "Ignore", the ingress controller closes the connection + without sending a response, logging the connection, or incrementing + metrics. The default value is "Respond". + + Typically, these connections come from load balancers' health probes + or Web browsers' speculative connections ("preconnect") and can be + safely ignored. However, these requests may also be caused by + network errors, and so setting this field to "Ignore" may impede + detection and diagnosis of problems. In addition, these requests may + be caused by port scans, in which case logging empty requests may aid + in detecting intrusion attempts. + enum: + - Respond + - Ignore + type: string + httpErrorCodePages: + description: |- + httpErrorCodePages specifies a configmap with custom error pages. + The administrator must create this configmap in the openshift-config namespace. + This configmap should have keys in the format "error-page-.http", + where is an HTTP error code. + For example, "error-page-503.http" defines an error page for HTTP 503 responses. + Currently only error pages for 503 and 404 responses can be customized. + Each value in the configmap should be the full response, including HTTP headers. + Eg- https://raw.githubusercontent.com/openshift/router/fadab45747a9b30cc3f0a4b41ad2871f95827a93/images/router/haproxy/conf/error-page-503.http + If this field is empty, the ingress controller uses the default error pages. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + httpHeaders: + description: |- + httpHeaders defines policy for HTTP headers. + + If this field is empty, the default values are used. + properties: + actions: + description: |- + actions specifies options for modifying headers and their values. + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be modified for TLS passthrough + connections. + Setting the HSTS (`Strict-Transport-Security`) header is not supported via actions. `Strict-Transport-Security` + may only be configured using the "haproxy.router.openshift.io/hsts_header" route annotation, and only in + accordance with the policy specified in Ingress.Spec.RequiredHSTSPolicies. + Any actions defined here are applied after any actions related to the following other fields: + cache-control, spec.clientTLS, + spec.httpHeaders.forwardedHeaderPolicy, spec.httpHeaders.uniqueId, + and spec.httpHeaders.headerNameCaseAdjustments. + In case of HTTP request headers, the actions specified in spec.httpHeaders.actions on the Route will be executed after + the actions specified in the IngressController's spec.httpHeaders.actions field. + In case of HTTP response headers, the actions specified in spec.httpHeaders.actions on the IngressController will be + executed after the actions specified in the Route's spec.httpHeaders.actions field. + Headers set using this API cannot be captured for use in access logs. + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. Please refer to the documentation + for that API field for more details. + properties: + request: + description: |- + request is a list of HTTP request headers to modify. + Actions defined here will modify the request headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for request headers will be executed before Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 request header actions may be configured. + Sample fetchers allowed are "req.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[req.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are req.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:req\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + response: + description: |- + response is a list of HTTP response headers to modify. + Actions defined here will modify the response headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for response headers will be executed after Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 response header actions may be configured. + Sample fetchers allowed are "res.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[res.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are res.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:res\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + type: object + forwardedHeaderPolicy: + description: |- + forwardedHeaderPolicy specifies when and how the IngressController + sets the Forwarded, X-Forwarded-For, X-Forwarded-Host, + X-Forwarded-Port, X-Forwarded-Proto, and X-Forwarded-Proto-Version + HTTP headers. The value may be one of the following: + + * "Append", which specifies that the IngressController appends the + headers, preserving existing headers. + + * "Replace", which specifies that the IngressController sets the + headers, replacing any existing Forwarded or X-Forwarded-* headers. + + * "IfNone", which specifies that the IngressController sets the + headers if they are not already set. + + * "Never", which specifies that the IngressController never sets the + headers, preserving any existing headers. + + By default, the policy is "Append". + enum: + - Append + - Replace + - IfNone + - Never + type: string + headerNameCaseAdjustments: + description: |- + headerNameCaseAdjustments specifies case adjustments that can be + applied to HTTP header names. Each adjustment is specified as an + HTTP header name with the desired capitalization. For example, + specifying "X-Forwarded-For" indicates that the "x-forwarded-for" + HTTP header should be adjusted to have the specified capitalization. + + These adjustments are only applied to cleartext, edge-terminated, and + re-encrypt routes, and only when using HTTP/1. + + For request headers, these adjustments are applied only for routes + that have the haproxy.router.openshift.io/h1-adjust-case=true + annotation. For response headers, these adjustments are applied to + all HTTP responses. + + If this field is empty, no request headers are adjusted. + items: + description: |- + IngressControllerHTTPHeaderNameCaseAdjustment is the name of an HTTP header + (for example, "X-Forwarded-For") in the desired capitalization. The value + must be a valid HTTP header name as defined in RFC 2616 section 4.2. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + uniqueId: + description: |- + uniqueId describes configuration for a custom HTTP header that the + ingress controller should inject into incoming HTTP requests. + Typically, this header is configured to have a value that is unique + to the HTTP request. The header can be used by applications or + included in access logs to facilitate tracing individual HTTP + requests. + + If this field is empty, no such header is injected into requests. + properties: + format: + description: |- + format specifies the format for the injected HTTP header's value. + This field has no effect unless name is specified. For the + HAProxy-based ingress controller implementation, this format uses the + same syntax as the HTTP log format. If the field is empty, the + default value is "%{+X}o\\ %ci:%cp_%fi:%fp_%Ts_%rt:%pid"; see the + corresponding HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + maxLength: 1024 + minLength: 0 + pattern: ^(%(%|(\{[-+]?[QXE](,[-+]?[QXE])*\})?([A-Za-z]+|\[[.0-9A-Z_a-z]+(\([^)]+\))?(,[.0-9A-Z_a-z]+(\([^)]+\))?)*\]))|[^%[:cntrl:]])*$ + type: string + name: + description: |- + name specifies the name of the HTTP header (for example, "unique-id") + that the ingress controller should inject into HTTP requests. The + field's value must be a valid HTTP header name as defined in RFC 2616 + section 4.2. If the field is empty, no header is injected. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + type: object + type: object + idleConnectionTerminationPolicy: + default: Immediate + description: |- + idleConnectionTerminationPolicy maps directly to HAProxy's + idle-close-on-response option and controls whether HAProxy + keeps idle frontend connections open during a soft stop + (router reload). + + Allowed values for this field are "Immediate" and + "Deferred". The default value is "Immediate". + + When set to "Immediate", idle connections are closed + immediately during router reloads. This ensures immediate + propagation of route changes but may impact clients + sensitive to connection resets. + + When set to "Deferred", HAProxy will maintain idle + connections during a soft reload instead of closing them + immediately. These connections remain open until any of the + following occurs: + + - A new request is received on the connection, in which + case HAProxy handles it in the old process and closes + the connection after sending the response. + + - HAProxy's `timeout http-keep-alive` duration expires. + By default this is 300 seconds, but it can be changed + using httpKeepAliveTimeout tuning option. + + - The client's keep-alive timeout expires, causing the + client to close the connection. + + Setting Deferred can help prevent errors in clients or load + balancers that do not properly handle connection resets. + Additionally, this option allows you to retain the pre-2.4 + HAProxy behaviour: in HAProxy version 2.2 (OpenShift + versions < 4.14), maintaining idle connections during a + soft reload was the default behaviour, but starting with + HAProxy 2.4, the default changed to closing idle + connections immediately. + + Important Consideration: + + - Using Deferred will result in temporary inconsistencies + for the first request on each persistent connection + after a route update and router reload. This request + will be processed by the old HAProxy process using its + old configuration. Subsequent requests will use the + updated configuration. + + Operational Considerations: + + - Keeping idle connections open during reloads may lead + to an accumulation of old HAProxy processes if + connections remain idle for extended periods, + especially in environments where frequent reloads + occur. + + - Consider monitoring the number of HAProxy processes in + the router pods when Deferred is set. + + - You may need to enable or adjust the + `ingress.operator.openshift.io/hard-stop-after` + duration (configured via an annotation on the + IngressController resource) in environments with + frequent reloads to prevent resource exhaustion. + enum: + - Immediate + - Deferred + type: string + logging: + description: |- + logging defines parameters for what should be logged where. If this + field is empty, operational logs are enabled but access logs are + disabled. + properties: + access: + description: |- + access describes how the client requests should be logged. + + If this field is empty, access logging is disabled. + properties: + destination: + description: destination is where access logs go. + properties: + container: + description: |- + container holds parameters for the Container logging destination. + Present only if type is Container. + properties: + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 8192, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 8192 + minimum: 480 + type: integer + type: object + syslog: + description: |- + syslog holds parameters for a syslog endpoint. Present only if + type is Syslog. + oneOf: + - properties: + address: + format: ipv4 + - properties: + address: + format: ipv6 + properties: + address: + description: |- + address is the IP address of the syslog endpoint that receives log + messages. + type: string + facility: + description: |- + facility specifies the syslog facility of log messages. + + If this field is empty, the facility is "local1". + enum: + - kern + - user + - mail + - daemon + - auth + - syslog + - lpr + - news + - uucp + - cron + - auth2 + - ftp + - ntp + - audit + - alert + - cron2 + - local0 + - local1 + - local2 + - local3 + - local4 + - local5 + - local6 + - local7 + type: string + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 4096, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 4096 + minimum: 480 + type: integer + port: + description: |- + port is the UDP port number of the syslog endpoint that receives log + messages. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - address + - port + type: object + type: + description: |- + type is the type of destination for logs. It must be one of the + following: + + * Container + + The ingress operator configures the sidecar container named "logs" on + the ingress controller pod and configures the ingress controller to + write logs to the sidecar. The logs are then available as container + logs. The expectation is that the administrator configures a custom + logging solution that reads logs from this sidecar. Note that using + container logs means that logs may be dropped if the rate of logs + exceeds the container runtime's or the custom logging solution's + capacity. + + * Syslog + + Logs are sent to a syslog endpoint. The administrator must specify + an endpoint that can receive syslog messages. The expectation is + that the administrator has configured a custom syslog instance. + enum: + - Container + - Syslog + type: string + required: + - type + type: object + httpCaptureCookies: + description: |- + httpCaptureCookies specifies HTTP cookies that should be captured in + access logs. If this field is empty, no cookies are captured. + items: + description: |- + IngressControllerCaptureHTTPCookie describes an HTTP cookie that should be + captured. + properties: + matchType: + description: |- + matchType specifies the type of match to be performed on the cookie + name. Allowed values are "Exact" for an exact string match and + "Prefix" for a string prefix match. If "Exact" is specified, a name + must be specified in the name field. If "Prefix" is provided, a + prefix must be specified in the namePrefix field. For example, + specifying matchType "Prefix" and namePrefix "foo" will capture a + cookie named "foo" or "foobar" but not one named "bar". The first + matching cookie is captured. + enum: + - Exact + - Prefix + type: string + maxLength: + description: |- + maxLength specifies a maximum length of the string that will be + logged, which includes the cookie name, cookie value, and + one-character delimiter. If the log entry exceeds this length, the + value will be truncated in the log message. Note that the ingress + controller may impose a separate bound on the total length of HTTP + headers in a request. + maximum: 1024 + minimum: 1 + type: integer + name: + description: |- + name specifies a cookie name. Its value must be a valid HTTP cookie + name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + namePrefix: + description: |- + namePrefix specifies a cookie name prefix. Its value must be a valid + HTTP cookie name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + required: + - matchType + - maxLength + type: object + maxItems: 1 + nullable: true + type: array + x-kubernetes-list-type: atomic + httpCaptureHeaders: + description: |- + httpCaptureHeaders defines HTTP headers that should be captured in + access logs. If this field is empty, no headers are captured. + + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be captured for TLS passthrough + connections. + properties: + request: + description: |- + request specifies which HTTP request headers to capture. + + If this field is empty, no request headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + response: + description: |- + response specifies which HTTP response headers to capture. + + If this field is empty, no response headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + type: object + httpLogFormat: + description: |- + httpLogFormat specifies the format of the log message for an HTTP + request. + + If this field is empty, log messages use the implementation's default + HTTP log format. For HAProxy's default HTTP log format, see the + HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + + Note that this format only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). It does not affect the log format for TLS passthrough + connections. + type: string + logEmptyRequests: + default: Log + description: |- + logEmptyRequests specifies how connections on which no request is + received should be logged. Typically, these empty requests come from + load balancers' health probes or Web browsers' speculative + connections ("preconnect"), in which case logging these requests may + be undesirable. However, these requests may also be caused by + network errors, in which case logging empty requests may be useful + for diagnosing the errors. In addition, these requests may be caused + by port scans, in which case logging empty requests may aid in + detecting intrusion attempts. Allowed values for this field are + "Log" and "Ignore". The default value is "Log". + enum: + - Log + - Ignore + type: string + required: + - destination + type: object + type: object + namespaceSelector: + description: |- + namespaceSelector is used to filter the set of namespaces serviced by the + ingress controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodePlacement: + description: |- + nodePlacement enables explicit control over the scheduling of the ingress + controller. + + If unset, defaults are used. See NodePlacement for more details. + properties: + nodeSelector: + description: |- + nodeSelector is the node selector applied to ingress controller + deployments. + + If set, the specified selector is used and replaces the default. + + If unset, the default depends on the value of the defaultPlacement + field in the cluster config.openshift.io/v1/ingresses status. + + When defaultPlacement is Workers, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/worker: '' + + When defaultPlacement is ControlPlane, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/master: '' + + These defaults are subject to change. + + Note that using nodeSelector.matchExpressions is not supported. Only + nodeSelector.matchLabels may be used. This is a limitation of the + Kubernetes API: the pod spec does not allow complex expressions for + node selectors. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tolerations: + description: |- + tolerations is a list of tolerations applied to ingress controller + deployments. + + The default is an empty list. + + See https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + replicas: + description: |- + replicas is the desired number of ingress controller replicas. If unset, + the default depends on the value of the defaultPlacement field in the + cluster config.openshift.io/v1/ingresses status. + + The value of replicas is set based on the value of a chosen field in the + Infrastructure CR. If defaultPlacement is set to ControlPlane, the + chosen field will be controlPlaneTopology. If it is set to Workers the + chosen field will be infrastructureTopology. Replicas will then be set to 1 + or 2 based whether the chosen field's value is SingleReplica or + HighlyAvailable, respectively. + + These defaults are subject to change. + format: int32 + type: integer + routeAdmission: + description: |- + routeAdmission defines a policy for handling new route claims (for example, + to allow or deny claims across namespaces). + + If empty, defaults will be applied. See specific routeAdmission fields + for details about their defaults. + properties: + namespaceOwnership: + description: |- + namespaceOwnership describes how host name claims across namespaces should + be handled. + + Value must be one of: + + - Strict: Do not allow routes in different namespaces to claim the same host. + + - InterNamespaceAllowed: Allow routes to claim different paths of the same + host name across namespaces. + + If empty, the default is Strict. + enum: + - InterNamespaceAllowed + - Strict + type: string + wildcardPolicy: + description: |- + wildcardPolicy describes how routes with wildcard policies should + be handled for the ingress controller. WildcardPolicy controls use + of routes [1] exposed by the ingress controller based on the route's + wildcard policy. + + [1] https://github.com/openshift/api/blob/master/route/v1/types.go + + Note: Updating WildcardPolicy from WildcardsAllowed to WildcardsDisallowed + will cause admitted routes with a wildcard policy of Subdomain to stop + working. These routes must be updated to a wildcard policy of None to be + readmitted by the ingress controller. + + WildcardPolicy supports WildcardsAllowed and WildcardsDisallowed values. + + If empty, defaults to "WildcardsDisallowed". + enum: + - WildcardsAllowed + - WildcardsDisallowed + type: string + type: object + routeSelector: + description: |- + routeSelector is used to filter the set of Routes serviced by the ingress + controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tlsSecurityProfile: + description: |- + tlsSecurityProfile specifies settings for TLS connections for ingresscontrollers. + + If unset, the default is based on the apiservers.config.openshift.io/cluster resource. + + Note that when using the Old, Intermediate, and Modern profile types, the effective + profile configuration is subject to change between releases. For example, given + a specification to use the Intermediate profile deployed on release X.Y.Z, an upgrade + to release X.Y.Z+1 may cause a new profile configuration to be applied to the ingress + controller, resulting in a rollout. + properties: + custom: + description: |- + custom is a user-defined TLS security profile. Be extremely careful using a custom + profile as invalid configurations can be catastrophic. An example custom profile + looks like this: + + minTLSVersion: VersionTLS11 + ciphers: + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + nullable: true + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + intermediate: + description: |- + intermediate is a TLS profile for use when you do not need compatibility with + legacy clients and want to remain highly secure while being compatible with + most clients currently in use. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS12 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + nullable: true + type: object + modern: + description: |- + modern is a TLS security profile for use with clients that support TLS 1.3 and + do not need backward compatibility for older clients. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS13 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + nullable: true + type: object + old: + description: |- + old is a TLS profile for use when services need to be accessed by very old + clients or libraries and should be used only as a last resort. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS10 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-ECDSA-AES128-SHA256 + - ECDHE-RSA-AES128-SHA256 + - ECDHE-ECDSA-AES128-SHA + - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA + - ECDHE-RSA-AES256-SHA + - AES128-GCM-SHA256 + - AES256-GCM-SHA384 + - AES128-SHA256 + - AES128-SHA + - AES256-SHA + - DES-CBC3-SHA + nullable: true + type: object + type: + description: |- + type is one of Old, Intermediate, Modern or Custom. Custom provides the + ability to specify individual TLS security profile parameters. + + The profiles are based on version 5.7 of the Mozilla Server Side TLS + configuration guidelines. The cipher lists consist of the configuration's + "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.7.json + + The profiles are intent based, so they may change over time as new ciphers are + developed and existing ciphers are found to be insecure. Depending on + precisely which ciphers are available to a process, the list may be reduced. + enum: + - Old + - Intermediate + - Modern + - Custom + type: string + type: object + tuningOptions: + anyOf: + - properties: + maxConnections: + enum: + - -1 + - 0 + - properties: + maxConnections: + format: int32 + maximum: 2000000 + minimum: 2000 + description: |- + tuningOptions defines parameters for adjusting the performance of + ingress controller pods. All fields are optional and will use their + respective defaults if not set. See specific tuningOptions fields for + more details. + + Setting fields within tuningOptions is generally not recommended. The + default values are suitable for most configurations. + properties: + clientFinTimeout: + description: |- + clientFinTimeout defines how long a connection will be held open while + waiting for the client response to the server/backend closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + clientTimeout: + description: |- + clientTimeout defines how long a connection will be held open while + waiting for a client response. + + If unset, the default timeout is 30s + format: duration + type: string + configurationManagement: + description: |- + configurationManagement specifies how OpenShift router should update + the HAProxy configuration. The following values are valid for this + field: + + * "ForkAndReload". + * "Dynamic". + + Omitting this field means that the user has no opinion and the + platform may choose a reasonable default. This default is subject to + change over time. The current default is "ForkAndReload". + + "ForkAndReload" means that OpenShift router should rewrite the + HAProxy configuration file and instruct HAProxy to fork and reload. + This is OpenShift router's traditional approach. + + "Dynamic" means that OpenShift router may use HAProxy's control + socket for some configuration updates and fall back to fork and + reload for other configuration updates. This is a newer approach, + which may be less mature than ForkAndReload. This setting can + improve load-balancing fairness and metrics accuracy and reduce CPU + and memory usage if HAProxy has frequent configuration updates for + route and endpoints updates. + + Note: The "Dynamic" option is currently experimental and should not + be enabled on production clusters. + enum: + - Dynamic + - ForkAndReload + type: string + connectTimeout: + description: |- + connectTimeout defines the maximum time to wait for + a connection attempt to a server/backend to succeed. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 5s. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + headerBufferBytes: + description: |- + headerBufferBytes describes how much memory should be reserved + (in bytes) for IngressController connection sessions. + Note that this value must be at least 16384 if HTTP/2 is + enabled for the IngressController (https://tools.ietf.org/html/rfc7540). + If this field is empty, the IngressController will use a default value + of 32768 bytes. + + Setting this field is generally not recommended as headerBufferBytes + values that are too small may break the IngressController and + headerBufferBytes values that are too large could cause the + IngressController to use significantly more memory than necessary. + format: int32 + minimum: 16384 + type: integer + headerBufferMaxRewriteBytes: + description: |- + headerBufferMaxRewriteBytes describes how much memory should be reserved + (in bytes) from headerBufferBytes for HTTP header rewriting + and appending for IngressController connection sessions. + Note that incoming HTTP requests will be limited to + (headerBufferBytes - headerBufferMaxRewriteBytes) bytes, meaning + headerBufferBytes must be greater than headerBufferMaxRewriteBytes. + If this field is empty, the IngressController will use a default value + of 8192 bytes. + + Setting this field is generally not recommended as + headerBufferMaxRewriteBytes values that are too small may break the + IngressController and headerBufferMaxRewriteBytes values that are too + large could cause the IngressController to use significantly more memory + than necessary. + format: int32 + minimum: 4096 + type: integer + healthCheckInterval: + description: |- + healthCheckInterval defines how long the router waits between two consecutive + health checks on its configured backends. This value is applied globally as + a default for all routes, but may be overridden per-route by the route annotation + "router.openshift.io/haproxy.health.check.interval". + + Expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, eg "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Setting this to less than 5s can cause excess traffic due to too frequent + TCP health checks and accompanying SYN packet storms. Alternatively, setting + this too high can result in increased latency, due to backend servers that are no + longer available, but haven't yet been detected as such. + + An empty or zero healthCheckInterval means no opinion and IngressController chooses + a default, which is subject to change over time. + Currently the default healthCheckInterval value is 5s. + + Currently the minimum allowed value is 1s and the maximum allowed value is + 2147483647ms (24.85 days). Both are subject to change over time. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + httpKeepAliveTimeout: + description: |- + httpKeepAliveTimeout defines the maximum allowed time to wait for + a new HTTP request to appear on a connection from the client to the router. + + This field expects an unsigned duration string of a decimal number, with optional + fraction and a unit suffix, e.g. "300ms", "1.5s" or "2m45s". + Valid time units are "ms", "s", "m". + The allowed range is from 1 millisecond to 15 minutes. + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 300s. + + Low values (tens of milliseconds or less) can cause clients to close and reopen connections + for each request, leading to reduced connection sharing. + For HTTP/2, special care should be taken with low values. + A few seconds is a reasonable starting point to avoid holding idle connections open + while still allowing subsequent requests to reuse the connection. + + High values (minutes or more) favor connection reuse but may cause idle + connections to linger longer. + maxLength: 16 + minLength: 1 + type: string + x-kubernetes-validations: + - message: httpKeepAliveTimeout must be a valid duration string + composed of an unsigned integer value, optionally followed + by a decimal fraction and a unit suffix (ms, s, m) + rule: self.matches('^([0-9]+(\\.[0-9]+)?(ms|s|m))+$') + - message: httpKeepAliveTimeout must be less than or equal to + 15 minutes + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) <= duration(''15m'')' + - message: httpKeepAliveTimeout must be greater than or equal + to 1 millisecond + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) >= duration(''1ms'')' + maxConnections: + description: |- + maxConnections defines the maximum number of simultaneous + connections that can be established per HAProxy process. + Increasing this value allows each ingress controller pod to + handle more connections but at the cost of additional + system resources being consumed. + + Permitted values are: empty, 0, -1, and the range + 2000-2000000. + + If this field is empty or 0, the IngressController will use + the default value of 50000, but the default is subject to + change in future releases. + + If the value is -1 then HAProxy will dynamically compute a + maximum value based on the available ulimits in the running + container. Selecting -1 (i.e., auto) will result in a large + value being computed (~520000 on OpenShift >=4.10 clusters) + and therefore each HAProxy process will incur significant + memory usage compared to the current default of 50000. + + Setting a value that is greater than the current operating + system limit will prevent the HAProxy process from + starting. + + If you choose a discrete value (e.g., 750000) and the + router pod is migrated to a new node, there's no guarantee + that that new node has identical ulimits configured. In + such a scenario the pod would fail to start. If you have + nodes with different ulimits configured (e.g., different + tuned profiles) and you choose a discrete value then the + guidance is to use -1 and let the value be computed + dynamically at runtime. + + You can monitor memory usage for router containers with the + following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}'. + + You can monitor memory usage of individual HAProxy + processes in router containers with the following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}/container_processes{container="router",namespace="openshift-ingress"}'. + format: int32 + type: integer + reloadInterval: + description: |- + reloadInterval defines the minimum interval at which the router is allowed to reload + to accept new changes. Increasing this value can prevent the accumulation of + HAProxy processes, depending on the scenario. Increasing this interval can + also lessen load imbalance on a backend's servers when using the roundrobin + balancing algorithm. Alternatively, decreasing this value may decrease latency + since updates to HAProxy's configuration can take effect more quickly. + + The value must be a time duration value; see . + Currently, the minimum value allowed is 1s, and the maximum allowed value is + 120s. Minimum and maximum allowed values may change in future versions of OpenShift. + Note that if a duration outside of these bounds is provided, the value of reloadInterval + will be capped/floored and not rejected (e.g. a duration of over 120s will be capped to + 120s; the IngressController will not reject and replace this disallowed value with + the default). + + A zero value for reloadInterval tells the IngressController to choose the default, + which is currently 5s and subject to change without notice. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Note: Setting a value significantly larger than the default of 5s can cause latency + in observing updates to routes and their endpoints. HAProxy's configuration will + be reloaded less frequently, and newly created routes will not be served until the + subsequent reload. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + serverFinTimeout: + description: |- + serverFinTimeout defines how long a connection will be held open while + waiting for the server/backend response to the client closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + serverTimeout: + description: |- + serverTimeout defines how long a connection will be held open while + waiting for a server/backend response. + + If unset, the default timeout is 30s + format: duration + type: string + threadCount: + description: |- + threadCount defines the number of threads created per HAProxy process. + Creating more threads allows each ingress controller pod to handle more + connections, at the cost of more system resources being used. HAProxy + currently supports up to 64 threads. If this field is empty, the + IngressController will use the default value. The current default is 4 + threads, but this may change in future releases. + + Setting this field is generally not recommended. Increasing the number + of HAProxy threads allows ingress controller pods to utilize more CPU + time under load, potentially starving other pods if set too high. + Reducing the number of threads may cause the ingress controller to + perform poorly. + format: int32 + maximum: 64 + minimum: 1 + type: integer + tlsInspectDelay: + description: |- + tlsInspectDelay defines how long the router can hold data to find a + matching route. + + Setting this too short can cause the router to fall back to the default + certificate for edge-terminated or reencrypt routes even when a better + matching certificate could be used. + + If unset, the default inspect delay is 5s + format: duration + type: string + tunnelTimeout: + description: |- + tunnelTimeout defines how long a tunnel connection (including + websockets) will be held open while the tunnel is idle. + + If unset, the default timeout is 1h + format: duration + type: string + type: object + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides allows specifying unsupported + configuration options. Its use is unsupported. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + status: + description: status is the most recently observed status of the IngressController. + properties: + availableReplicas: + description: |- + availableReplicas is number of observed available replicas according to the + ingress controller deployment. + format: int32 + type: integer + conditions: + description: |- + conditions is a list of conditions and their status. + + Available means the ingress controller deployment is available and + servicing route and ingress resources (i.e, .status.availableReplicas + equals .spec.replicas) + + There are additional conditions which indicate the status of other + ingress controller features and capabilities. + + * LoadBalancerManaged + - True if the following conditions are met: + * The endpoint publishing strategy requires a service load balancer. + - False if any of those conditions are unsatisfied. + + * LoadBalancerReady + - True if the following conditions are met: + * A load balancer is managed. + * The load balancer is ready. + - False if any of those conditions are unsatisfied. + + * DNSManaged + - True if the following conditions are met: + * The endpoint publishing strategy and platform support DNS. + * The ingress controller domain is set. + * dns.config.openshift.io/cluster configures DNS zones. + - False if any of those conditions are unsatisfied. + + * DNSReady + - True if the following conditions are met: + * DNS is managed. + * DNS records have been successfully created. + - False if any of those conditions are unsatisfied. + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + domain: + description: domain is the actual domain in use. + type: string + endpointPublishingStrategy: + description: endpointPublishingStrategy is the actual strategy in + use. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + namespaceSelector: + description: namespaceSelector is the actual namespaceSelector in + use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + observedGeneration: + description: observedGeneration is the most recent generation observed. + format: int64 + type: integer + routeSelector: + description: routeSelector is the actual routeSelector in use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + selector: + description: |- + selector is a label selector, in string format, for ingress controller pods + corresponding to the IngressController. The number of matching pods should + equal the value of availableReplicas. + type: string + tlsProfile: + description: tlsProfile is the TLS connection configuration that is + in effect. + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + type: object + type: object + x-kubernetes-validations: + - message: The combined 'router-' + metadata.name + '.' + .spec.domain cannot + exceed 253 characters + rule: '!has(self.spec.domain) || size(''router-'' + self.metadata.name + + ''.'' + self.spec.domain) <= 253' + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.availableReplicas + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml similarity index 99% rename from vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers.crd.yaml rename to vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index 00d20d54f9..535ddf0bc8 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -7,6 +7,7 @@ metadata: capability.openshift.io/name: Ingress include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: OKD name: ingresscontrollers.operator.openshift.io spec: group: operator.openshift.io diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml new file mode 100644 index 0000000000..2fbc3cd4e3 --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml @@ -0,0 +1,3317 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/616 + api.openshift.io/merged-by-featuregates: "true" + capability.openshift.io/name: Ingress + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: ingresscontrollers.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: IngressController + listKind: IngressControllerList + plural: ingresscontrollers + singular: ingresscontroller + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + IngressController describes a managed ingress controller for the cluster. The + controller can service OpenShift Route and Kubernetes Ingress resources. + + When an IngressController is created, a new ingress controller deployment is + created to allow external traffic to reach the services that expose Ingress + or Route resources. Updating this resource may lead to disruption for public + facing network connections as a new ingress controller revision may be rolled + out. + + https://kubernetes.io/docs/concepts/services-networking/ingress-controllers + + Whenever possible, sensible defaults for the platform are used. See each + field for more details. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the specification of the desired behavior of the + IngressController. + properties: + clientTLS: + description: |- + clientTLS specifies settings for requesting and verifying client + certificates, which can be used to enable mutual TLS for + edge-terminated and reencrypt routes. + properties: + allowedSubjectPatterns: + description: |- + allowedSubjectPatterns specifies a list of regular expressions that + should be matched against the distinguished name on a valid client + certificate to filter requests. The regular expressions must use + PCRE syntax. If this list is empty, no filtering is performed. If + the list is nonempty, then at least one pattern must match a client + certificate's distinguished name or else the ingress controller + rejects the certificate and denies the connection. + items: + type: string + type: array + x-kubernetes-list-type: atomic + clientCA: + description: |- + clientCA specifies a configmap containing the PEM-encoded CA + certificate bundle that should be used to verify a client's + certificate. The administrator must create this configmap in the + openshift-config namespace. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + clientCertificatePolicy: + description: |- + clientCertificatePolicy specifies whether the ingress controller + requires clients to provide certificates. This field accepts the + values "Required" or "Optional". + + Note that the ingress controller only checks client certificates for + edge-terminated and reencrypt TLS routes; it cannot check + certificates for cleartext HTTP or passthrough TLS routes. + enum: + - "" + - Required + - Optional + type: string + required: + - clientCA + - clientCertificatePolicy + type: object + closedClientConnectionPolicy: + default: Continue + description: |- + closedClientConnectionPolicy controls how the IngressController + behaves when the client closes the TCP connection while the TLS + handshake or HTTP request is in progress. This option maps directly + to HAProxy’s "abortonclose" option. + + Valid values are: "Abort" and "Continue". + The default value is "Continue". + + When set to "Abort", the router will stop processing the TLS handshake + if it is in progress, and it will not send an HTTP request to the backend server + if the request has not yet been sent when the client closes the connection. + + When set to "Continue", the router will complete the TLS handshake + if it is in progress, or send an HTTP request to the backend server + and wait for the backend server's response, regardless of + whether the client has closed the connection. + + Setting "Abort" can help free CPU resources otherwise spent on TLS computation + for connections the client has already closed, and can reduce request queue + size, thereby reducing the load on saturated backend servers. + + Important Considerations: + + - The default policy ("Continue") is HTTP-compliant, and requests + for aborted client connections will still be served. + Use the "Continue" policy to allow a client to send a request + and then immediately close its side of the connection while + still receiving a response on the half-closed connection. + + - When clients use keep-alive connections, the most common case for premature + closure is when the user wants to cancel the transfer or when a timeout + occurs. In that case, the "Abort" policy may be used to reduce resource consumption. + + - Using RSA keys larger than 2048 bits can significantly slow down + TLS computations. Consider using the "Abort" policy to reduce CPU usage. + enum: + - Abort + - Continue + type: string + defaultCertificate: + description: |- + defaultCertificate is a reference to a secret containing the default + certificate served by the ingress controller. When Routes don't specify + their own certificate, defaultCertificate is used. + + The secret must contain the following keys and data: + + tls.crt: certificate file contents + tls.key: key file contents + + If unset, a wildcard certificate is automatically generated and used. The + certificate is valid for the ingress controller domain (and subdomains) and + the generated certificate's CA will be automatically integrated with the + cluster's trust store. + + If a wildcard certificate is used and shared by multiple + HTTP/2 enabled routes (which implies ALPN) then clients + (i.e., notably browsers) are at liberty to reuse open + connections. This means a client can reuse a connection to + another route and that is likely to fail. This behaviour is + generally known as connection coalescing. + + The in-use certificate (whether generated or user-specified) will be + automatically integrated with OpenShift's built-in OAuth server. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + domain: + description: |- + domain is a DNS name serviced by the ingress controller and is used to + configure multiple features: + + * For the LoadBalancerService endpoint publishing strategy, domain is + used to configure DNS records. See endpointPublishingStrategy. + + * When using a generated default certificate, the certificate will be valid + for domain and its subdomains. See defaultCertificate. + + * The value is published to individual Route statuses so that end-users + know where to target external DNS records. + + domain must be unique among all IngressControllers, and cannot be + updated. + + If empty, defaults to ingress.config.openshift.io/cluster .spec.domain. + + The domain value must be a valid DNS name. It must consist of lowercase + alphanumeric characters, '-' or '.', and each label must start and end + with an alphanumeric character and not exceed 63 characters. Maximum + length of a valid DNS domain is 253 characters. + + The implementation may add a prefix such as "router-default." to the domain + when constructing the router canonical hostname. To ensure the resulting + hostname does not exceed the DNS maximum length of 253 characters, + the domain length is additionally validated at the IngressController object + level. For the maximum length of the domain value itself, the shortest + possible variant of the prefix and the ingress controller name was considered + for example "router-a." + maxLength: 244 + type: string + x-kubernetes-validations: + - message: domain must consist of lower case alphanumeric characters, + '-' or '.', and must start and end with an alphanumeric character + rule: '!format.dns1123Subdomain().validate(self).hasValue()' + - message: each DNS label must not exceed 63 characters + rule: self.split('.').all(label, size(label) <= 63) + endpointPublishingStrategy: + description: |- + endpointPublishingStrategy is used to publish the ingress controller + endpoints to other networks, enable load balancer integrations, etc. + + If unset, the default is based on + infrastructure.config.openshift.io/cluster .status.platform: + + AWS: LoadBalancerService (with External scope) + Azure: LoadBalancerService (with External scope) + GCP: LoadBalancerService (with External scope) + IBMCloud: LoadBalancerService (with External scope) + AlibabaCloud: LoadBalancerService (with External scope) + Libvirt: HostNetwork + + Any other platform types (including None) default to HostNetwork. + + endpointPublishingStrategy cannot be updated. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + httpCompression: + description: |- + httpCompression defines a policy for HTTP traffic compression. + By default, there is no HTTP compression. + properties: + mimeTypes: + description: |- + mimeTypes is a list of MIME types that should have compression applied. + This list can be empty, in which case the ingress controller does not apply compression. + + Note: Not all MIME types benefit from compression, but HAProxy will still use resources + to try to compress if instructed to. Generally speaking, text (html, css, js, etc.) + formats benefit from compression, but formats that are already compressed (image, + audio, video, etc.) benefit little in exchange for the time and cpu spent on compressing + again. See https://joehonton.medium.com/the-gzip-penalty-d31bd697f1a2 + items: + description: |- + CompressionMIMEType defines the format of a single MIME type. + E.g. "text/css; charset=utf-8", "text/html", "text/*", "image/svg+xml", + "application/octet-stream", "X-custom/customsub", etc. + + The format should follow the Content-Type definition in RFC 1341: + Content-Type := type "/" subtype *[";" parameter] + - The type in Content-Type can be one of: + application, audio, image, message, multipart, text, video, or a custom + type preceded by "X-" and followed by a token as defined below. + - The token is a string of at least one character, and not containing white + space, control characters, or any of the characters in the tspecials set. + - The tspecials set contains the characters ()<>@,;:\"/[]?.= + - The subtype in Content-Type is also a token. + - The optional parameter/s following the subtype are defined as: + token "=" (token / quoted-string) + - The quoted-string, as defined in RFC 822, is surrounded by double quotes + and can contain white space plus any character EXCEPT \, ", and CR. + It can also contain any single ASCII character as long as it is escaped by \. + pattern: ^(?i)(x-[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|application|audio|image|message|multipart|text|video)/[^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+(; *[^][ ()\\<>@,;:"/?.=\x00-\x1F\x7F]+=([^][ + ()\\<>@,;:"/?.=\x00-\x1F\x7F]+|"(\\[\x00-\x7F]|[^\x0D"\\])*"))*$ + type: string + type: array + x-kubernetes-list-type: set + type: object + httpEmptyRequestsPolicy: + default: Respond + description: |- + httpEmptyRequestsPolicy describes how HTTP connections should be + handled if the connection times out before a request is received. + Allowed values for this field are "Respond" and "Ignore". If the + field is set to "Respond", the ingress controller sends an HTTP 400 + or 408 response, logs the connection (if access logging is enabled), + and counts the connection in the appropriate metrics. If the field + is set to "Ignore", the ingress controller closes the connection + without sending a response, logging the connection, or incrementing + metrics. The default value is "Respond". + + Typically, these connections come from load balancers' health probes + or Web browsers' speculative connections ("preconnect") and can be + safely ignored. However, these requests may also be caused by + network errors, and so setting this field to "Ignore" may impede + detection and diagnosis of problems. In addition, these requests may + be caused by port scans, in which case logging empty requests may aid + in detecting intrusion attempts. + enum: + - Respond + - Ignore + type: string + httpErrorCodePages: + description: |- + httpErrorCodePages specifies a configmap with custom error pages. + The administrator must create this configmap in the openshift-config namespace. + This configmap should have keys in the format "error-page-.http", + where is an HTTP error code. + For example, "error-page-503.http" defines an error page for HTTP 503 responses. + Currently only error pages for 503 and 404 responses can be customized. + Each value in the configmap should be the full response, including HTTP headers. + Eg- https://raw.githubusercontent.com/openshift/router/fadab45747a9b30cc3f0a4b41ad2871f95827a93/images/router/haproxy/conf/error-page-503.http + If this field is empty, the ingress controller uses the default error pages. + properties: + name: + description: name is the metadata.name of the referenced config + map + type: string + required: + - name + type: object + httpHeaders: + description: |- + httpHeaders defines policy for HTTP headers. + + If this field is empty, the default values are used. + properties: + actions: + description: |- + actions specifies options for modifying headers and their values. + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be modified for TLS passthrough + connections. + Setting the HSTS (`Strict-Transport-Security`) header is not supported via actions. `Strict-Transport-Security` + may only be configured using the "haproxy.router.openshift.io/hsts_header" route annotation, and only in + accordance with the policy specified in Ingress.Spec.RequiredHSTSPolicies. + Any actions defined here are applied after any actions related to the following other fields: + cache-control, spec.clientTLS, + spec.httpHeaders.forwardedHeaderPolicy, spec.httpHeaders.uniqueId, + and spec.httpHeaders.headerNameCaseAdjustments. + In case of HTTP request headers, the actions specified in spec.httpHeaders.actions on the Route will be executed after + the actions specified in the IngressController's spec.httpHeaders.actions field. + In case of HTTP response headers, the actions specified in spec.httpHeaders.actions on the IngressController will be + executed after the actions specified in the Route's spec.httpHeaders.actions field. + Headers set using this API cannot be captured for use in access logs. + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. Please refer to the documentation + for that API field for more details. + properties: + request: + description: |- + request is a list of HTTP request headers to modify. + Actions defined here will modify the request headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for request headers will be executed before Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 request header actions may be configured. + Sample fetchers allowed are "req.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[req.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are req.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:req\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + response: + description: |- + response is a list of HTTP response headers to modify. + Actions defined here will modify the response headers of all requests passing through an ingress controller. + These actions are applied to all Routes i.e. for all connections handled by the ingress controller defined within a cluster. + IngressController actions for response headers will be executed after Route actions. + Currently, actions may define to either `Set` or `Delete` headers values. + Actions are applied in sequence as defined in this list. + A maximum of 20 response header actions may be configured. + Sample fetchers allowed are "res.hdr" and "ssl_c_der". + Converters allowed are "lower" and "base64". + Example header values: "%[res.hdr(X-target),lower]", "%{+Q}[ssl_c_der,base64]". + items: + description: IngressControllerHTTPHeader specifies configuration + for setting or deleting an HTTP header. + properties: + action: + description: action specifies actions to perform on + headers, such as setting or deleting headers. + properties: + set: + description: |- + set specifies how the HTTP header should be set. + This field is required when type is Set and forbidden otherwise. + properties: + value: + description: |- + value specifies a header value. + Dynamic values can be added. The value will be interpreted as an HAProxy format string as defined in + http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 and may use HAProxy's %[] syntax and + otherwise must be a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + The value of this field must be no more than 16384 characters in length. + Note that the total size of all net added headers *after* interpolating dynamic values + must not exceed the value of spec.tuningOptions.headerBufferMaxRewriteBytes on the + IngressController. + maxLength: 16384 + minLength: 1 + type: string + required: + - value + type: object + type: + description: |- + type defines the type of the action to be applied on the header. + Possible values are Set or Delete. + Set allows you to set HTTP request and response headers. + Delete allows you to delete HTTP request and response headers. + enum: + - Set + - Delete + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: set is required when type is Set, and forbidden + otherwise + rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) + : !has(self.set)' + name: + description: |- + name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`". + The following header names are reserved and may not be modified via this API: + Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. + It must be no more than 255 characters in length. + Header name must be unique. + maxLength: 255 + minLength: 1 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + x-kubernetes-validations: + - message: strict-transport-security header may not + be modified via header actions + rule: self.lowerAscii() != 'strict-transport-security' + - message: proxy header may not be modified via header + actions + rule: self.lowerAscii() != 'proxy' + - message: host header may not be modified via header + actions + rule: self.lowerAscii() != 'host' + - message: cookie header may not be modified via header + actions + rule: self.lowerAscii() != 'cookie' + - message: set-cookie header may not be modified via + header actions + rule: self.lowerAscii() != 'set-cookie' + required: + - action + - name + type: object + maxItems: 20 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: Either the header value provided is not in correct + format or the sample fetcher/converter specified is not + allowed. The dynamic header value will be interpreted + as an HAProxy format string as defined in http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#8.2.6 + and may use HAProxy's %[] syntax and otherwise must be + a valid HTTP header value as defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2. + Sample fetchers allowed are res.hdr, ssl_c_der. Converters + allowed are lower, base64. + rule: self.all(key, key.action.type == "Delete" || (has(key.action.set) + && key.action.set.value.matches('^(?:%(?:%|(?:\\{[-+]?[QXE](?:,[-+]?[QXE])*\\})?\\[(?:res\\.hdr\\([0-9A-Za-z-]+\\)|ssl_c_der)(?:,(?:lower|base64))*\\])|[^%[:cntrl:]])+$'))) + type: object + forwardedHeaderPolicy: + description: |- + forwardedHeaderPolicy specifies when and how the IngressController + sets the Forwarded, X-Forwarded-For, X-Forwarded-Host, + X-Forwarded-Port, X-Forwarded-Proto, and X-Forwarded-Proto-Version + HTTP headers. The value may be one of the following: + + * "Append", which specifies that the IngressController appends the + headers, preserving existing headers. + + * "Replace", which specifies that the IngressController sets the + headers, replacing any existing Forwarded or X-Forwarded-* headers. + + * "IfNone", which specifies that the IngressController sets the + headers if they are not already set. + + * "Never", which specifies that the IngressController never sets the + headers, preserving any existing headers. + + By default, the policy is "Append". + enum: + - Append + - Replace + - IfNone + - Never + type: string + headerNameCaseAdjustments: + description: |- + headerNameCaseAdjustments specifies case adjustments that can be + applied to HTTP header names. Each adjustment is specified as an + HTTP header name with the desired capitalization. For example, + specifying "X-Forwarded-For" indicates that the "x-forwarded-for" + HTTP header should be adjusted to have the specified capitalization. + + These adjustments are only applied to cleartext, edge-terminated, and + re-encrypt routes, and only when using HTTP/1. + + For request headers, these adjustments are applied only for routes + that have the haproxy.router.openshift.io/h1-adjust-case=true + annotation. For response headers, these adjustments are applied to + all HTTP responses. + + If this field is empty, no request headers are adjusted. + items: + description: |- + IngressControllerHTTPHeaderNameCaseAdjustment is the name of an HTTP header + (for example, "X-Forwarded-For") in the desired capitalization. The value + must be a valid HTTP header name as defined in RFC 2616 section 4.2. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + uniqueId: + description: |- + uniqueId describes configuration for a custom HTTP header that the + ingress controller should inject into incoming HTTP requests. + Typically, this header is configured to have a value that is unique + to the HTTP request. The header can be used by applications or + included in access logs to facilitate tracing individual HTTP + requests. + + If this field is empty, no such header is injected into requests. + properties: + format: + description: |- + format specifies the format for the injected HTTP header's value. + This field has no effect unless name is specified. For the + HAProxy-based ingress controller implementation, this format uses the + same syntax as the HTTP log format. If the field is empty, the + default value is "%{+X}o\\ %ci:%cp_%fi:%fp_%Ts_%rt:%pid"; see the + corresponding HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + maxLength: 1024 + minLength: 0 + pattern: ^(%(%|(\{[-+]?[QXE](,[-+]?[QXE])*\})?([A-Za-z]+|\[[.0-9A-Z_a-z]+(\([^)]+\))?(,[.0-9A-Z_a-z]+(\([^)]+\))?)*\]))|[^%[:cntrl:]])*$ + type: string + name: + description: |- + name specifies the name of the HTTP header (for example, "unique-id") + that the ingress controller should inject into HTTP requests. The + field's value must be a valid HTTP header name as defined in RFC 2616 + section 4.2. If the field is empty, no header is injected. + maxLength: 1024 + minLength: 0 + pattern: ^$|^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + type: object + type: object + idleConnectionTerminationPolicy: + default: Immediate + description: |- + idleConnectionTerminationPolicy maps directly to HAProxy's + idle-close-on-response option and controls whether HAProxy + keeps idle frontend connections open during a soft stop + (router reload). + + Allowed values for this field are "Immediate" and + "Deferred". The default value is "Immediate". + + When set to "Immediate", idle connections are closed + immediately during router reloads. This ensures immediate + propagation of route changes but may impact clients + sensitive to connection resets. + + When set to "Deferred", HAProxy will maintain idle + connections during a soft reload instead of closing them + immediately. These connections remain open until any of the + following occurs: + + - A new request is received on the connection, in which + case HAProxy handles it in the old process and closes + the connection after sending the response. + + - HAProxy's `timeout http-keep-alive` duration expires. + By default this is 300 seconds, but it can be changed + using httpKeepAliveTimeout tuning option. + + - The client's keep-alive timeout expires, causing the + client to close the connection. + + Setting Deferred can help prevent errors in clients or load + balancers that do not properly handle connection resets. + Additionally, this option allows you to retain the pre-2.4 + HAProxy behaviour: in HAProxy version 2.2 (OpenShift + versions < 4.14), maintaining idle connections during a + soft reload was the default behaviour, but starting with + HAProxy 2.4, the default changed to closing idle + connections immediately. + + Important Consideration: + + - Using Deferred will result in temporary inconsistencies + for the first request on each persistent connection + after a route update and router reload. This request + will be processed by the old HAProxy process using its + old configuration. Subsequent requests will use the + updated configuration. + + Operational Considerations: + + - Keeping idle connections open during reloads may lead + to an accumulation of old HAProxy processes if + connections remain idle for extended periods, + especially in environments where frequent reloads + occur. + + - Consider monitoring the number of HAProxy processes in + the router pods when Deferred is set. + + - You may need to enable or adjust the + `ingress.operator.openshift.io/hard-stop-after` + duration (configured via an annotation on the + IngressController resource) in environments with + frequent reloads to prevent resource exhaustion. + enum: + - Immediate + - Deferred + type: string + logging: + description: |- + logging defines parameters for what should be logged where. If this + field is empty, operational logs are enabled but access logs are + disabled. + properties: + access: + description: |- + access describes how the client requests should be logged. + + If this field is empty, access logging is disabled. + properties: + destination: + description: destination is where access logs go. + properties: + container: + description: |- + container holds parameters for the Container logging destination. + Present only if type is Container. + properties: + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 8192, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 8192 + minimum: 480 + type: integer + type: object + syslog: + description: |- + syslog holds parameters for a syslog endpoint. Present only if + type is Syslog. + oneOf: + - properties: + address: + format: ipv4 + - properties: + address: + format: ipv6 + properties: + address: + description: |- + address is the IP address of the syslog endpoint that receives log + messages. + type: string + facility: + description: |- + facility specifies the syslog facility of log messages. + + If this field is empty, the facility is "local1". + enum: + - kern + - user + - mail + - daemon + - auth + - syslog + - lpr + - news + - uucp + - cron + - auth2 + - ftp + - ntp + - audit + - alert + - cron2 + - local0 + - local1 + - local2 + - local3 + - local4 + - local5 + - local6 + - local7 + type: string + maxLength: + default: 1024 + description: |- + maxLength is the maximum length of the log message. + + Valid values are integers in the range 480 to 4096, inclusive. + + When omitted, the default value is 1024. + format: int32 + maximum: 4096 + minimum: 480 + type: integer + port: + description: |- + port is the UDP port number of the syslog endpoint that receives log + messages. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - address + - port + type: object + type: + description: |- + type is the type of destination for logs. It must be one of the + following: + + * Container + + The ingress operator configures the sidecar container named "logs" on + the ingress controller pod and configures the ingress controller to + write logs to the sidecar. The logs are then available as container + logs. The expectation is that the administrator configures a custom + logging solution that reads logs from this sidecar. Note that using + container logs means that logs may be dropped if the rate of logs + exceeds the container runtime's or the custom logging solution's + capacity. + + * Syslog + + Logs are sent to a syslog endpoint. The administrator must specify + an endpoint that can receive syslog messages. The expectation is + that the administrator has configured a custom syslog instance. + enum: + - Container + - Syslog + type: string + required: + - type + type: object + httpCaptureCookies: + description: |- + httpCaptureCookies specifies HTTP cookies that should be captured in + access logs. If this field is empty, no cookies are captured. + items: + description: |- + IngressControllerCaptureHTTPCookie describes an HTTP cookie that should be + captured. + properties: + matchType: + description: |- + matchType specifies the type of match to be performed on the cookie + name. Allowed values are "Exact" for an exact string match and + "Prefix" for a string prefix match. If "Exact" is specified, a name + must be specified in the name field. If "Prefix" is provided, a + prefix must be specified in the namePrefix field. For example, + specifying matchType "Prefix" and namePrefix "foo" will capture a + cookie named "foo" or "foobar" but not one named "bar". The first + matching cookie is captured. + enum: + - Exact + - Prefix + type: string + maxLength: + description: |- + maxLength specifies a maximum length of the string that will be + logged, which includes the cookie name, cookie value, and + one-character delimiter. If the log entry exceeds this length, the + value will be truncated in the log message. Note that the ingress + controller may impose a separate bound on the total length of HTTP + headers in a request. + maximum: 1024 + minimum: 1 + type: integer + name: + description: |- + name specifies a cookie name. Its value must be a valid HTTP cookie + name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + namePrefix: + description: |- + namePrefix specifies a cookie name prefix. Its value must be a valid + HTTP cookie name as defined in RFC 6265 section 4.1. + maxLength: 1024 + minLength: 0 + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]*$ + type: string + required: + - matchType + - maxLength + type: object + maxItems: 1 + nullable: true + type: array + x-kubernetes-list-type: atomic + httpCaptureHeaders: + description: |- + httpCaptureHeaders defines HTTP headers that should be captured in + access logs. If this field is empty, no headers are captured. + + Note that this option only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). Headers cannot be captured for TLS passthrough + connections. + properties: + request: + description: |- + request specifies which HTTP request headers to capture. + + If this field is empty, no request headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + response: + description: |- + response specifies which HTTP response headers to capture. + + If this field is empty, no response headers are captured. + items: + description: |- + IngressControllerCaptureHTTPHeader describes an HTTP header that should be + captured. + properties: + maxLength: + description: |- + maxLength specifies a maximum length for the header value. If a + header value exceeds this length, the value will be truncated in the + log message. Note that the ingress controller may impose a separate + bound on the total length of HTTP headers in a request. + minimum: 1 + type: integer + name: + description: |- + name specifies a header name. Its value must be a valid HTTP header + name as defined in RFC 2616 section 4.2. + pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$ + type: string + required: + - maxLength + - name + type: object + nullable: true + type: array + x-kubernetes-list-type: atomic + type: object + httpLogFormat: + description: |- + httpLogFormat specifies the format of the log message for an HTTP + request. + + If this field is empty, log messages use the implementation's default + HTTP log format. For HAProxy's default HTTP log format, see the + HAProxy documentation: + http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#8.2.3 + + Note that this format only applies to cleartext HTTP connections + and to secure HTTP connections for which the ingress controller + terminates encryption (that is, edge-terminated or reencrypt + connections). It does not affect the log format for TLS passthrough + connections. + type: string + logEmptyRequests: + default: Log + description: |- + logEmptyRequests specifies how connections on which no request is + received should be logged. Typically, these empty requests come from + load balancers' health probes or Web browsers' speculative + connections ("preconnect"), in which case logging these requests may + be undesirable. However, these requests may also be caused by + network errors, in which case logging empty requests may be useful + for diagnosing the errors. In addition, these requests may be caused + by port scans, in which case logging empty requests may aid in + detecting intrusion attempts. Allowed values for this field are + "Log" and "Ignore". The default value is "Log". + enum: + - Log + - Ignore + type: string + required: + - destination + type: object + type: object + namespaceSelector: + description: |- + namespaceSelector is used to filter the set of namespaces serviced by the + ingress controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodePlacement: + description: |- + nodePlacement enables explicit control over the scheduling of the ingress + controller. + + If unset, defaults are used. See NodePlacement for more details. + properties: + nodeSelector: + description: |- + nodeSelector is the node selector applied to ingress controller + deployments. + + If set, the specified selector is used and replaces the default. + + If unset, the default depends on the value of the defaultPlacement + field in the cluster config.openshift.io/v1/ingresses status. + + When defaultPlacement is Workers, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/worker: '' + + When defaultPlacement is ControlPlane, the default is: + + kubernetes.io/os: linux + node-role.kubernetes.io/master: '' + + These defaults are subject to change. + + Note that using nodeSelector.matchExpressions is not supported. Only + nodeSelector.matchLabels may be used. This is a limitation of the + Kubernetes API: the pod spec does not allow complex expressions for + node selectors. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tolerations: + description: |- + tolerations is a list of tolerations applied to ingress controller + deployments. + + The default is an empty list. + + See https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + replicas: + description: |- + replicas is the desired number of ingress controller replicas. If unset, + the default depends on the value of the defaultPlacement field in the + cluster config.openshift.io/v1/ingresses status. + + The value of replicas is set based on the value of a chosen field in the + Infrastructure CR. If defaultPlacement is set to ControlPlane, the + chosen field will be controlPlaneTopology. If it is set to Workers the + chosen field will be infrastructureTopology. Replicas will then be set to 1 + or 2 based whether the chosen field's value is SingleReplica or + HighlyAvailable, respectively. + + These defaults are subject to change. + format: int32 + type: integer + routeAdmission: + description: |- + routeAdmission defines a policy for handling new route claims (for example, + to allow or deny claims across namespaces). + + If empty, defaults will be applied. See specific routeAdmission fields + for details about their defaults. + properties: + namespaceOwnership: + description: |- + namespaceOwnership describes how host name claims across namespaces should + be handled. + + Value must be one of: + + - Strict: Do not allow routes in different namespaces to claim the same host. + + - InterNamespaceAllowed: Allow routes to claim different paths of the same + host name across namespaces. + + If empty, the default is Strict. + enum: + - InterNamespaceAllowed + - Strict + type: string + wildcardPolicy: + description: |- + wildcardPolicy describes how routes with wildcard policies should + be handled for the ingress controller. WildcardPolicy controls use + of routes [1] exposed by the ingress controller based on the route's + wildcard policy. + + [1] https://github.com/openshift/api/blob/master/route/v1/types.go + + Note: Updating WildcardPolicy from WildcardsAllowed to WildcardsDisallowed + will cause admitted routes with a wildcard policy of Subdomain to stop + working. These routes must be updated to a wildcard policy of None to be + readmitted by the ingress controller. + + WildcardPolicy supports WildcardsAllowed and WildcardsDisallowed values. + + If empty, defaults to "WildcardsDisallowed". + enum: + - WildcardsAllowed + - WildcardsDisallowed + type: string + type: object + routeSelector: + description: |- + routeSelector is used to filter the set of Routes serviced by the ingress + controller. This is useful for implementing shards. + + If unset, the default is no filtering. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + tlsSecurityProfile: + description: |- + tlsSecurityProfile specifies settings for TLS connections for ingresscontrollers. + + If unset, the default is based on the apiservers.config.openshift.io/cluster resource. + + Note that when using the Old, Intermediate, and Modern profile types, the effective + profile configuration is subject to change between releases. For example, given + a specification to use the Intermediate profile deployed on release X.Y.Z, an upgrade + to release X.Y.Z+1 may cause a new profile configuration to be applied to the ingress + controller, resulting in a rollout. + properties: + custom: + description: |- + custom is a user-defined TLS security profile. Be extremely careful using a custom + profile as invalid configurations can be catastrophic. An example custom profile + looks like this: + + minTLSVersion: VersionTLS11 + ciphers: + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + nullable: true + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + intermediate: + description: |- + intermediate is a TLS profile for use when you do not need compatibility with + legacy clients and want to remain highly secure while being compatible with + most clients currently in use. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS12 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + nullable: true + type: object + modern: + description: |- + modern is a TLS security profile for use with clients that support TLS 1.3 and + do not need backward compatibility for older clients. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS13 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + nullable: true + type: object + old: + description: |- + old is a TLS profile for use when services need to be accessed by very old + clients or libraries and should be used only as a last resort. + + This profile is equivalent to a Custom profile specified as: + minTLSVersion: VersionTLS10 + ciphers: + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + - ECDHE-ECDSA-AES128-GCM-SHA256 + - ECDHE-RSA-AES128-GCM-SHA256 + - ECDHE-ECDSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-ECDSA-CHACHA20-POLY1305 + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-ECDSA-AES128-SHA256 + - ECDHE-RSA-AES128-SHA256 + - ECDHE-ECDSA-AES128-SHA + - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA + - ECDHE-RSA-AES256-SHA + - AES128-GCM-SHA256 + - AES256-GCM-SHA384 + - AES128-SHA256 + - AES128-SHA + - AES256-SHA + - DES-CBC3-SHA + nullable: true + type: object + type: + description: |- + type is one of Old, Intermediate, Modern or Custom. Custom provides the + ability to specify individual TLS security profile parameters. + + The profiles are based on version 5.7 of the Mozilla Server Side TLS + configuration guidelines. The cipher lists consist of the configuration's + "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.7.json + + The profiles are intent based, so they may change over time as new ciphers are + developed and existing ciphers are found to be insecure. Depending on + precisely which ciphers are available to a process, the list may be reduced. + enum: + - Old + - Intermediate + - Modern + - Custom + type: string + type: object + tuningOptions: + anyOf: + - properties: + maxConnections: + enum: + - -1 + - 0 + - properties: + maxConnections: + format: int32 + maximum: 2000000 + minimum: 2000 + description: |- + tuningOptions defines parameters for adjusting the performance of + ingress controller pods. All fields are optional and will use their + respective defaults if not set. See specific tuningOptions fields for + more details. + + Setting fields within tuningOptions is generally not recommended. The + default values are suitable for most configurations. + properties: + clientFinTimeout: + description: |- + clientFinTimeout defines how long a connection will be held open while + waiting for the client response to the server/backend closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + clientTimeout: + description: |- + clientTimeout defines how long a connection will be held open while + waiting for a client response. + + If unset, the default timeout is 30s + format: duration + type: string + configurationManagement: + description: |- + configurationManagement specifies how OpenShift router should update + the HAProxy configuration. The following values are valid for this + field: + + * "ForkAndReload". + * "Dynamic". + + Omitting this field means that the user has no opinion and the + platform may choose a reasonable default. This default is subject to + change over time. The current default is "ForkAndReload". + + "ForkAndReload" means that OpenShift router should rewrite the + HAProxy configuration file and instruct HAProxy to fork and reload. + This is OpenShift router's traditional approach. + + "Dynamic" means that OpenShift router may use HAProxy's control + socket for some configuration updates and fall back to fork and + reload for other configuration updates. This is a newer approach, + which may be less mature than ForkAndReload. This setting can + improve load-balancing fairness and metrics accuracy and reduce CPU + and memory usage if HAProxy has frequent configuration updates for + route and endpoints updates. + + Note: The "Dynamic" option is currently experimental and should not + be enabled on production clusters. + enum: + - Dynamic + - ForkAndReload + type: string + connectTimeout: + description: |- + connectTimeout defines the maximum time to wait for + a connection attempt to a server/backend to succeed. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 5s. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + headerBufferBytes: + description: |- + headerBufferBytes describes how much memory should be reserved + (in bytes) for IngressController connection sessions. + Note that this value must be at least 16384 if HTTP/2 is + enabled for the IngressController (https://tools.ietf.org/html/rfc7540). + If this field is empty, the IngressController will use a default value + of 32768 bytes. + + Setting this field is generally not recommended as headerBufferBytes + values that are too small may break the IngressController and + headerBufferBytes values that are too large could cause the + IngressController to use significantly more memory than necessary. + format: int32 + minimum: 16384 + type: integer + headerBufferMaxRewriteBytes: + description: |- + headerBufferMaxRewriteBytes describes how much memory should be reserved + (in bytes) from headerBufferBytes for HTTP header rewriting + and appending for IngressController connection sessions. + Note that incoming HTTP requests will be limited to + (headerBufferBytes - headerBufferMaxRewriteBytes) bytes, meaning + headerBufferBytes must be greater than headerBufferMaxRewriteBytes. + If this field is empty, the IngressController will use a default value + of 8192 bytes. + + Setting this field is generally not recommended as + headerBufferMaxRewriteBytes values that are too small may break the + IngressController and headerBufferMaxRewriteBytes values that are too + large could cause the IngressController to use significantly more memory + than necessary. + format: int32 + minimum: 4096 + type: integer + healthCheckInterval: + description: |- + healthCheckInterval defines how long the router waits between two consecutive + health checks on its configured backends. This value is applied globally as + a default for all routes, but may be overridden per-route by the route annotation + "router.openshift.io/haproxy.health.check.interval". + + Expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, eg "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Setting this to less than 5s can cause excess traffic due to too frequent + TCP health checks and accompanying SYN packet storms. Alternatively, setting + this too high can result in increased latency, due to backend servers that are no + longer available, but haven't yet been detected as such. + + An empty or zero healthCheckInterval means no opinion and IngressController chooses + a default, which is subject to change over time. + Currently the default healthCheckInterval value is 5s. + + Currently the minimum allowed value is 1s and the maximum allowed value is + 2147483647ms (24.85 days). Both are subject to change over time. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + httpKeepAliveTimeout: + description: |- + httpKeepAliveTimeout defines the maximum allowed time to wait for + a new HTTP request to appear on a connection from the client to the router. + + This field expects an unsigned duration string of a decimal number, with optional + fraction and a unit suffix, e.g. "300ms", "1.5s" or "2m45s". + Valid time units are "ms", "s", "m". + The allowed range is from 1 millisecond to 15 minutes. + + When omitted, this means the user has no opinion and the platform is left + to choose a reasonable default. This default is subject to change over time. + The current default is 300s. + + Low values (tens of milliseconds or less) can cause clients to close and reopen connections + for each request, leading to reduced connection sharing. + For HTTP/2, special care should be taken with low values. + A few seconds is a reasonable starting point to avoid holding idle connections open + while still allowing subsequent requests to reuse the connection. + + High values (minutes or more) favor connection reuse but may cause idle + connections to linger longer. + maxLength: 16 + minLength: 1 + type: string + x-kubernetes-validations: + - message: httpKeepAliveTimeout must be a valid duration string + composed of an unsigned integer value, optionally followed + by a decimal fraction and a unit suffix (ms, s, m) + rule: self.matches('^([0-9]+(\\.[0-9]+)?(ms|s|m))+$') + - message: httpKeepAliveTimeout must be less than or equal to + 15 minutes + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) <= duration(''15m'')' + - message: httpKeepAliveTimeout must be greater than or equal + to 1 millisecond + rule: '!self.matches(''^([0-9]+(\\.[0-9]+)?(ms|s|m))+$'') || + duration(self) >= duration(''1ms'')' + maxConnections: + description: |- + maxConnections defines the maximum number of simultaneous + connections that can be established per HAProxy process. + Increasing this value allows each ingress controller pod to + handle more connections but at the cost of additional + system resources being consumed. + + Permitted values are: empty, 0, -1, and the range + 2000-2000000. + + If this field is empty or 0, the IngressController will use + the default value of 50000, but the default is subject to + change in future releases. + + If the value is -1 then HAProxy will dynamically compute a + maximum value based on the available ulimits in the running + container. Selecting -1 (i.e., auto) will result in a large + value being computed (~520000 on OpenShift >=4.10 clusters) + and therefore each HAProxy process will incur significant + memory usage compared to the current default of 50000. + + Setting a value that is greater than the current operating + system limit will prevent the HAProxy process from + starting. + + If you choose a discrete value (e.g., 750000) and the + router pod is migrated to a new node, there's no guarantee + that that new node has identical ulimits configured. In + such a scenario the pod would fail to start. If you have + nodes with different ulimits configured (e.g., different + tuned profiles) and you choose a discrete value then the + guidance is to use -1 and let the value be computed + dynamically at runtime. + + You can monitor memory usage for router containers with the + following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}'. + + You can monitor memory usage of individual HAProxy + processes in router containers with the following metric: + 'container_memory_working_set_bytes{container="router",namespace="openshift-ingress"}/container_processes{container="router",namespace="openshift-ingress"}'. + format: int32 + type: integer + reloadInterval: + description: |- + reloadInterval defines the minimum interval at which the router is allowed to reload + to accept new changes. Increasing this value can prevent the accumulation of + HAProxy processes, depending on the scenario. Increasing this interval can + also lessen load imbalance on a backend's servers when using the roundrobin + balancing algorithm. Alternatively, decreasing this value may decrease latency + since updates to HAProxy's configuration can take effect more quickly. + + The value must be a time duration value; see . + Currently, the minimum value allowed is 1s, and the maximum allowed value is + 120s. Minimum and maximum allowed values may change in future versions of OpenShift. + Note that if a duration outside of these bounds is provided, the value of reloadInterval + will be capped/floored and not rejected (e.g. a duration of over 120s will be capped to + 120s; the IngressController will not reject and replace this disallowed value with + the default). + + A zero value for reloadInterval tells the IngressController to choose the default, + which is currently 5s and subject to change without notice. + + This field expects an unsigned duration string of decimal numbers, each with optional + fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m". + Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h". + + Note: Setting a value significantly larger than the default of 5s can cause latency + in observing updates to routes and their endpoints. HAProxy's configuration will + be reloaded less frequently, and newly created routes will not be served until the + subsequent reload. + pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$ + type: string + serverFinTimeout: + description: |- + serverFinTimeout defines how long a connection will be held open while + waiting for the server/backend response to the client closing the + connection. + + If unset, the default timeout is 1s + format: duration + type: string + serverTimeout: + description: |- + serverTimeout defines how long a connection will be held open while + waiting for a server/backend response. + + If unset, the default timeout is 30s + format: duration + type: string + threadCount: + description: |- + threadCount defines the number of threads created per HAProxy process. + Creating more threads allows each ingress controller pod to handle more + connections, at the cost of more system resources being used. HAProxy + currently supports up to 64 threads. If this field is empty, the + IngressController will use the default value. The current default is 4 + threads, but this may change in future releases. + + Setting this field is generally not recommended. Increasing the number + of HAProxy threads allows ingress controller pods to utilize more CPU + time under load, potentially starving other pods if set too high. + Reducing the number of threads may cause the ingress controller to + perform poorly. + format: int32 + maximum: 64 + minimum: 1 + type: integer + tlsInspectDelay: + description: |- + tlsInspectDelay defines how long the router can hold data to find a + matching route. + + Setting this too short can cause the router to fall back to the default + certificate for edge-terminated or reencrypt routes even when a better + matching certificate could be used. + + If unset, the default inspect delay is 5s + format: duration + type: string + tunnelTimeout: + description: |- + tunnelTimeout defines how long a tunnel connection (including + websockets) will be held open while the tunnel is idle. + + If unset, the default timeout is 1h + format: duration + type: string + type: object + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides allows specifying unsupported + configuration options. Its use is unsupported. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + status: + description: status is the most recently observed status of the IngressController. + properties: + availableReplicas: + description: |- + availableReplicas is number of observed available replicas according to the + ingress controller deployment. + format: int32 + type: integer + conditions: + description: |- + conditions is a list of conditions and their status. + + Available means the ingress controller deployment is available and + servicing route and ingress resources (i.e, .status.availableReplicas + equals .spec.replicas) + + There are additional conditions which indicate the status of other + ingress controller features and capabilities. + + * LoadBalancerManaged + - True if the following conditions are met: + * The endpoint publishing strategy requires a service load balancer. + - False if any of those conditions are unsatisfied. + + * LoadBalancerReady + - True if the following conditions are met: + * A load balancer is managed. + * The load balancer is ready. + - False if any of those conditions are unsatisfied. + + * DNSManaged + - True if the following conditions are met: + * The endpoint publishing strategy and platform support DNS. + * The ingress controller domain is set. + * dns.config.openshift.io/cluster configures DNS zones. + - False if any of those conditions are unsatisfied. + + * DNSReady + - True if the following conditions are met: + * DNS is managed. + * DNS records have been successfully created. + - False if any of those conditions are unsatisfied. + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + domain: + description: domain is the actual domain in use. + type: string + endpointPublishingStrategy: + description: endpointPublishingStrategy is the actual strategy in + use. + properties: + hostNetwork: + description: |- + hostNetwork holds parameters for the HostNetwork endpoint publishing + strategy. Present only if type is HostNetwork. + properties: + httpPort: + default: 80 + description: |- + httpPort is the port on the host which should be used to listen for + HTTP requests. This field should be set when port 80 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 80. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + httpsPort: + default: 443 + description: |- + httpsPort is the port on the host which should be used to listen for + HTTPS requests. This field should be set when port 443 is already in use. + The value should not coincide with the NodePort range of the cluster. + When the value is 0 or is not specified it defaults to 443. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + statsPort: + default: 1936 + description: |- + statsPort is the port on the host where the stats from the router are + published. The value should not coincide with the NodePort range of the + cluster. If an external load balancer is configured to forward connections + to this IngressController, the load balancer should use this port for + health checks. The load balancer can send HTTP probes on this port on a + given node, with the path /healthz/ready to determine if the ingress + controller is ready to receive traffic on the node. For proper operation + the load balancer must not forward traffic to a node until the health + check reports ready. The load balancer should also stop forwarding requests + within a maximum of 45 seconds after /healthz/ready starts reporting + not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with + a threshold of two successful or failed requests to become healthy or + unhealthy respectively, are well-tested values. When the value is 0 or + is not specified it defaults to 1936. + format: int32 + maximum: 65535 + minimum: 0 + type: integer + type: object + loadBalancer: + description: |- + loadBalancer holds parameters for the load balancer. Present only if + type is LoadBalancerService. + properties: + allowedSourceRanges: + description: |- + allowedSourceRanges specifies an allowlist of IP address ranges to which + access to the load balancer should be restricted. Each range must be + specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is + specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default, + which allows all source addresses. + + To facilitate migration from earlier versions of OpenShift that did + not have the allowedSourceRanges field, you may set the + service.beta.kubernetes.io/load-balancer-source-ranges annotation on + the "router-" service in the + "openshift-ingress" namespace, and this annotation will take + effect if allowedSourceRanges is empty on OpenShift 4.12. + items: + description: |- + CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" + or "fd00::/8"). + pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$) + type: string + nullable: true + type: array + x-kubernetes-list-type: atomic + dnsManagementPolicy: + default: Managed + description: |- + dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record + associated with the load balancer service will be managed by + the ingress operator. It defaults to Managed. + Valid values are: Managed and Unmanaged. + enum: + - Managed + - Unmanaged + type: string + providerParameters: + description: |- + providerParameters holds desired load balancer information specific to + the underlying infrastructure provider. + + If empty, defaults will be applied. See specific providerParameters + fields for details about their defaults. + properties: + aws: + description: |- + aws provides configuration settings that are specific to AWS + load balancers. + + If empty, defaults will be applied. See specific aws fields for + details about their defaults. + properties: + classicLoadBalancer: + description: |- + classicLoadBalancerParameters holds configuration parameters for an AWS + classic load balancer. Present only if type is Classic. + properties: + connectionIdleTimeout: + description: |- + connectionIdleTimeout specifies the maximum time period that a + connection may be idle before the load balancer closes the + connection. The value must be parseable as a time duration value; + see . A nil or zero value + means no opinion, in which case a default value is used. The default + value for this field is 60s. This default is subject to change. + format: duration + type: string + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + networkLoadBalancer: + description: |- + networkLoadBalancerParameters holds configuration parameters for an AWS + network load balancer. Present only if type is NLB. + properties: + eipAllocations: + description: |- + eipAllocations is a list of IDs for Elastic IP (EIP) addresses that + are assigned to the Network Load Balancer. + The following restrictions apply: + + eipAllocations can only be used with external scope, not internal. + An EIP can be allocated to only a single IngressController. + The number of EIP allocations must match the number of subnets that are used for the load balancer. + Each EIP allocation must be unique. + A maximum of 10 EIP allocations are permitted. + + See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general + information about configuration, characteristics, and limitations of Elastic IP addresses. + items: + description: |- + EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment. + Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters. + maxLength: 26 + minLength: 26 + type: string + x-kubernetes-validations: + - message: eipAllocations should start with + 'eipalloc-' + rule: self.startsWith('eipalloc-') + - message: eipAllocations must be 'eipalloc-' + followed by exactly 17 hexadecimal characters + (0-9, a-f, A-F) + rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$') + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: eipAllocations cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) + subnets: + description: |- + subnets specifies the subnets to which the load balancer will + attach. The subnets may be specified by either their + ID or name. The total number of subnets is limited to 10. + + In order for the load balancer to be provisioned with subnets, + each subnet must exist, each subnet must be from a different + availability zone, and the load balancer service must be + recreated to pick up new values. + + When omitted from the spec, the subnets will be auto-discovered + for each availability zone. Auto-discovered subnets are not reported + in the status of the IngressController object. + properties: + ids: + description: |- + ids specifies a list of AWS subnets by subnet ID. + Subnet IDs must start with "subnet-", consist only + of alphanumeric characters, must be exactly 24 + characters long, must be unique, and the total + number of subnets specified by ids and names + must not exceed 10. + items: + description: AWSSubnetID is a reference + to an AWS subnet ID. + maxLength: 24 + minLength: 24 + pattern: ^subnet-[0-9A-Za-z]+$ + type: string + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet ids cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + names: + description: |- + names specifies a list of AWS subnets by subnet name. + Subnet names must not start with "subnet-", must not + include commas, must be under 256 characters in length, + must be unique, and the total number of subnets + specified by ids and names must not exceed 10. + items: + description: AWSSubnetName is a reference + to an AWS subnet name. + maxLength: 256 + minLength: 1 + type: string + x-kubernetes-validations: + - message: subnet name cannot contain a + comma + rule: '!self.contains('','')' + - message: subnet name cannot start with + 'subnet-' + rule: '!self.startsWith(''subnet-'')' + maxItems: 10 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: subnet names cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == + y)) + type: object + x-kubernetes-validations: + - message: the total number of subnets cannot + exceed 10 + rule: 'has(self.ids) && has(self.names) ? size(self.ids + + self.names) <= 10 : true' + - message: must specify at least 1 subnet name + or id + rule: has(self.ids) && self.ids.size() > 0 || + has(self.names) && self.names.size() > 0 + type: object + x-kubernetes-validations: + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids + self.subnets.names) + == size(self.eipAllocations) : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.ids) + && !has(self.subnets.names) && has(self.eipAllocations) + ? size(self.subnets.ids) == size(self.eipAllocations) + : true' + - message: number of subnets must be equal to number + of eipAllocations + rule: 'has(self.subnets) && has(self.subnets.names) + && !has(self.subnets.ids) && has(self.eipAllocations) + ? size(self.subnets.names) == size(self.eipAllocations) + : true' + type: + description: |- + type is the type of AWS load balancer to instantiate for an ingresscontroller. + + Valid values are: + + * "Classic": A Classic Load Balancer that makes routing decisions at either + the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See + the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb + + * "NLB": A Network Load Balancer that makes routing decisions at the + transport layer (TCP/SSL). See the following for additional details: + + https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb + enum: + - Classic + - NLB + type: string + required: + - type + type: object + gcp: + description: |- + gcp provides configuration settings that are specific to GCP + load balancers. + + If empty, defaults will be applied. See specific gcp fields for + details about their defaults. + properties: + clientAccess: + description: |- + clientAccess describes how client access is restricted for internal + load balancers. + + Valid values are: + * "Global": Specifying an internal load balancer with Global client access + allows clients from any region within the VPC to communicate with the load + balancer. + + https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access + + * "Local": Specifying an internal load balancer with Local client access + means only clients within the same region (and VPC) as the GCP load balancer + can communicate with the load balancer. Note that this is the default behavior. + + https://cloud.google.com/load-balancing/docs/internal#client_access + enum: + - Global + - Local + type: string + type: object + ibm: + description: |- + ibm provides configuration settings that are specific to IBM Cloud + load balancers. + + If empty, defaults will be applied. See specific ibm fields for + details about their defaults. + properties: + protocol: + description: |- + protocol specifies whether the load balancer uses PROXY protocol to forward connections to + the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: + "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas" + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + Valid values for protocol are TCP, PROXY and omitted. + When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is TCP, without the proxy protocol enabled. + enum: + - "" + - TCP + - PROXY + type: string + type: object + openstack: + description: |- + openstack provides configuration settings that are specific to OpenStack + load balancers. + + If empty, defaults will be applied. See specific openstack fields for + details about their defaults. + properties: + floatingIP: + description: |- + floatingIP specifies the IP address that the load balancer will use. + When not specified, an IP address will be assigned randomly by the OpenStack cloud provider. + When specified, the floating IP has to be pre-created. If the + specified value is not a floating IP or is already claimed, the + OpenStack cloud provider won't be able to provision the load + balancer. + This field may only be used if the IngressController has External scope. + This value must be a valid IPv4 or IPv6 address. + type: string + x-kubernetes-validations: + - message: floatingIP must be a valid IPv4 or IPv6 + address + rule: isIP(self) + type: object + type: + description: |- + type is the underlying infrastructure provider for the load balancer. + Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix", + "OpenStack", and "VSphere". + enum: + - AWS + - Azure + - BareMetal + - GCP + - Nutanix + - OpenStack + - VSphere + - IBM + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: openstack is not permitted when type is not OpenStack + rule: 'has(self.type) && self.type == ''OpenStack'' ? true + : !has(self.openstack)' + scope: + description: |- + scope indicates the scope at which the load balancer is exposed. + Possible values are "External" and "Internal". + enum: + - Internal + - External + type: string + required: + - dnsManagementPolicy + - scope + type: object + x-kubernetes-validations: + - message: eipAllocations are forbidden when the scope is Internal. + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.aws) || !has(self.providerParameters.aws.networkLoadBalancer) + || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)' + - message: cannot specify a floating ip when scope is internal + rule: '!has(self.scope) || self.scope != ''Internal'' || !has(self.providerParameters) + || !has(self.providerParameters.openstack) || !has(self.providerParameters.openstack.floatingIP) + || self.providerParameters.openstack.floatingIP == ""' + nodePort: + description: |- + nodePort holds parameters for the NodePortService endpoint publishing strategy. + Present only if type is NodePortService. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + private: + description: |- + private holds parameters for the Private endpoint publishing + strategy. Present only if type is Private. + properties: + protocol: + description: |- + protocol specifies whether the IngressController expects incoming + connections to use plain TCP or whether the IngressController expects + PROXY protocol. + + PROXY protocol can be used with load balancers that support it to + communicate the source addresses of client connections when + forwarding those connections to the IngressController. Using PROXY + protocol enables the IngressController to report those source + addresses instead of reporting the load balancer's address in HTTP + headers and logs. Note that enabling PROXY protocol on the + IngressController will cause connections to fail if you are not using + a load balancer that uses PROXY protocol to forward connections to + the IngressController. See + http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for + information about PROXY protocol. + + The following values are valid for this field: + + * The empty string. + * "TCP". + * "PROXY". + + The empty string specifies the default, which is TCP without PROXY + protocol. Note that the default is subject to change. + enum: + - "" + - TCP + - PROXY + type: string + type: object + type: + description: |- + type is the publishing strategy to use. Valid values are: + + * LoadBalancerService + + Publishes the ingress controller using a Kubernetes LoadBalancer Service. + + In this configuration, the ingress controller deployment uses container + networking. A LoadBalancer Service is created to publish the deployment. + + See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + + If domain is set, a wildcard DNS record will be managed to point at the + LoadBalancer Service's external name. DNS records are managed only in DNS + zones defined by dns.config.openshift.io/cluster .spec.publicZone and + .spec.privateZone. + + Wildcard DNS management is currently supported only on the AWS, Azure, + and GCP platforms. + + * HostNetwork + + Publishes the ingress controller on node ports where the ingress controller + is deployed. + + In this configuration, the ingress controller deployment uses host + networking, bound to node ports 80 and 443. The user is responsible for + configuring an external load balancer to publish the ingress controller via + the node ports. + + * Private + + Does not publish the ingress controller. + + In this configuration, the ingress controller deployment uses container + networking, and is not explicitly published. The user must manually publish + the ingress controller. + + * NodePortService + + Publishes the ingress controller using a Kubernetes NodePort Service. + + In this configuration, the ingress controller deployment uses container + networking. A NodePort Service is created to publish the deployment. The + specific node ports are dynamically allocated by OpenShift; however, to + support static port allocations, user changes to the node port + field of the managed NodePort Service will preserved. + enum: + - LoadBalancerService + - HostNetwork + - Private + - NodePortService + type: string + required: + - type + type: object + namespaceSelector: + description: namespaceSelector is the actual namespaceSelector in + use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + observedGeneration: + description: observedGeneration is the most recent generation observed. + format: int64 + type: integer + routeSelector: + description: routeSelector is the actual routeSelector in use. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + selector: + description: |- + selector is a label selector, in string format, for ingress controller pods + corresponding to the IngressController. The number of matching pods should + equal the value of availableReplicas. + type: string + tlsProfile: + description: tlsProfile is the TLS connection configuration that is + in effect. + properties: + ciphers: + description: |- + ciphers is used to specify the cipher algorithms that are negotiated + during the TLS handshake. Operators may remove entries that their operands + do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + + ciphers: + - ECDHE-RSA-AES128-GCM-SHA256 + + TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + and are always enabled when TLS 1.3 is negotiated. + items: + type: string + type: array + x-kubernetes-list-type: atomic + minTLSVersion: + description: |- + minTLSVersion is used to specify the minimal version of the TLS protocol + that is negotiated during the TLS handshake. For example, to use TLS + versions 1.1, 1.2 and 1.3 (yaml): + + minTLSVersion: VersionTLS11 + enum: + - VersionTLS10 + - VersionTLS11 + - VersionTLS12 + - VersionTLS13 + type: string + type: object + type: object + type: object + x-kubernetes-validations: + - message: The combined 'router-' + metadata.name + '.' + .spec.domain cannot + exceed 253 characters + rule: '!has(self.spec.domain) || size(''router-'' + self.metadata.name + + ''.'' + self.spec.domain) <= 253' + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.availableReplicas + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-CustomNoUpgrade.crd.yaml new file mode 100644 index 0000000000..4081fa837b --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-CustomNoUpgrade.crd.yaml @@ -0,0 +1,1152 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/475 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: CustomNoUpgrade + name: networks.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: Network + listKind: NetworkList + plural: networks + singular: network + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + Network describes the cluster's desired network configuration. It is + consumed by the cluster-network-operator. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: NetworkSpec is the top-level network configuration object. + properties: + additionalNetworks: + description: |- + additionalNetworks is a list of extra networks to make available to pods + when multiple networks are enabled. + items: + description: |- + AdditionalNetworkDefinition configures an extra network that is available but not + created by default. Instead, pods must request them by name. + type must be specified, along with exactly one "Config" that matches the type. + properties: + name: + description: |- + name is the name of the network. This will be populated in the resulting CRD + This must be unique. + type: string + namespace: + description: |- + namespace is the namespace of the network. This will be populated in the resulting CRD + If not given the network will be created in the default namespace. + type: string + rawCNIConfig: + description: |- + rawCNIConfig is the raw CNI configuration json to create in the + NetworkAttachmentDefinition CRD + type: string + simpleMacvlanConfig: + description: simpleMacvlanConfig configures the macvlan interface + in case of type:NetworkTypeSimpleMacvlan + properties: + ipamConfig: + description: ipamConfig configures IPAM module will be used + for IP Address Management (IPAM). + properties: + staticIPAMConfig: + description: staticIPAMConfig configures the static + IP address in case of type:IPAMTypeStatic + properties: + addresses: + description: addresses configures IP address for + the interface + items: + description: StaticIPAMAddresses provides IP address + and Gateway for static IPAM addresses + properties: + address: + description: address is the IP address in + CIDR format + type: string + gateway: + description: gateway is IP inside of subnet + to designate as the gateway + type: string + type: object + type: array + x-kubernetes-list-type: atomic + dns: + description: dns configures DNS for the interface + properties: + domain: + description: domain configures the domainname + the local domain used for short hostname lookups + type: string + nameservers: + description: nameservers points DNS servers + for IP lookup + items: + type: string + type: array + x-kubernetes-list-type: atomic + search: + description: search configures priority ordered + search domains for short hostname lookups + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + routes: + description: routes configures IP routes for the + interface + items: + description: StaticIPAMRoutes provides Destination/Gateway + pairs for static IPAM routes + properties: + destination: + description: destination points the IP route + destination + type: string + gateway: + description: |- + gateway is the route's next-hop IP address + If unset, a default gateway is assumed (as determined by the CNI plugin). + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: + description: |- + type is the type of IPAM module will be used for IP Address Management(IPAM). + The supported values are IPAMTypeDHCP, IPAMTypeStatic + type: string + type: object + master: + description: |- + master is the host interface to create the macvlan interface from. + If not specified, it will be default route interface + type: string + mode: + description: 'mode is the macvlan mode: bridge, private, + vepa, passthru. The default is bridge' + type: string + mtu: + description: |- + mtu is the mtu to use for the macvlan interface. if unset, host's + kernel will select the value. + format: int32 + minimum: 0 + type: integer + type: object + type: + description: |- + type is the type of network + The supported values are NetworkTypeRaw, NetworkTypeSimpleMacvlan + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + additionalRoutingCapabilities: + description: |- + additionalRoutingCapabilities describes components and relevant + configuration providing additional routing capabilities. When set, it + enables such components and the usage of the routing capabilities they + provide for the machine network. Upstream operators, like MetalLB + operator, requiring these capabilities may rely on, or automatically set + this attribute. Network plugins may leverage advanced routing + capabilities acquired through the enablement of these components but may + require specific configuration on their side to do so; refer to their + respective documentation and configuration options. + properties: + providers: + description: |- + providers is a set of enabled components that provide additional routing + capabilities. Entries on this list must be unique. The only valid value + is currrently "FRR" which provides FRR routing capabilities through the + deployment of FRR. + items: + description: RoutingCapabilitiesProvider is a component providing + routing capabilities. + enum: + - FRR + type: string + maxItems: 1 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - rule: self.all(x, self.exists_one(y, x == y)) + required: + - providers + type: object + clusterNetwork: + description: |- + clusterNetwork is the IP address pool to use for pod IPs. + Some network providers support multiple ClusterNetworks. + Others only support one. This is equivalent to the cluster-cidr. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + defaultNetwork: + description: defaultNetwork is the "default" network that all pods + will receive + properties: + openshiftSDNConfig: + description: |- + openshiftSDNConfig was previously used to configure the openshift-sdn plugin. + DEPRECATED: OpenShift SDN is no longer supported. + properties: + enableUnidling: + description: |- + enableUnidling controls whether or not the service proxy will support idling + and unidling of services. By default, unidling is enabled. + type: boolean + mode: + description: mode is one of "Multitenant", "Subnet", or "NetworkPolicy" + type: string + mtu: + description: |- + mtu is the mtu to use for the tunnel interface. Defaults to 1450 if unset. + This must be 50 bytes smaller than the machine's uplink. + format: int32 + minimum: 0 + type: integer + useExternalOpenvswitch: + description: |- + useExternalOpenvswitch used to control whether the operator would deploy an OVS + DaemonSet itself or expect someone else to start OVS. As of 4.6, OVS is always + run as a system service, and this flag is ignored. + type: boolean + vxlanPort: + description: vxlanPort is the port to use for all vxlan packets. + The default is 4789. + format: int32 + minimum: 0 + type: integer + type: object + ovnKubernetesConfig: + description: ovnKubernetesConfig configures the ovn-kubernetes + plugin. + properties: + bgpManagedConfig: + description: |- + bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) + in no-overlay mode that specify routing="Managed" in their noOverlayConfig. + It is required when noOverlayConfig.routing is set to "Managed". + When omitted, this means the user does not configure BGP for managed routing. + This field can be set at installation time or on day 2, and can be modified at any time. + properties: + asNumber: + default: 64512 + description: |- + asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) + to be used in the generated FRR configuration. + Valid values are 1 to 4294967295. + When omitted, this defaults to 64512. + format: int64 + maximum: 4294967295 + minimum: 1 + type: integer + bgpTopology: + description: |- + bgpTopology defines the BGP topology to be used. + Allowed values are "FullMesh". + When set to "FullMesh", every node peers directly with every other node via BGP. + This field is required when BGPManagedConfig is specified. + enum: + - FullMesh + type: string + required: + - bgpTopology + type: object + egressIPConfig: + description: egressIPConfig holds the configuration for EgressIP + options. + properties: + reachabilityTotalTimeoutSeconds: + description: |- + reachabilityTotalTimeout configures the EgressIP node reachability check total timeout in seconds. + If the EgressIP node cannot be reached within this timeout, the node is declared down. + Setting a large value may cause the EgressIP feature to react slowly to node changes. + In particular, it may react slowly for EgressIP nodes that really have a genuine problem and are unreachable. + When omitted, this means the user has no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is 1 second. + A value of 0 disables the EgressIP node's reachability check. + format: int32 + maximum: 60 + minimum: 0 + type: integer + type: object + gatewayConfig: + description: gatewayConfig holds the configuration for node + gateway options. + properties: + ipForwarding: + description: |- + ipForwarding controls IP forwarding for all traffic on OVN-Kubernetes managed interfaces (such as br-ex). + By default this is set to Restricted, and Kubernetes related traffic is still forwarded appropriately, but other + IP traffic will not be routed by the OCP node. If there is a desire to allow the host to forward traffic across + OVN-Kubernetes managed interfaces, then set this field to "Global". + The supported values are "Restricted" and "Global". + type: string + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv4 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV4 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /29). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is 169.254.0.0/17 + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 4 + - message: subnet must be in the range /0 to /29 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 29 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > + 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv6 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV6 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /125). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is fd69::/112 + Note that IPV6 dual addresses are not permitted + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 6 + - message: subnet must be in the range /0 to /125 + inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 125 + type: object + routingViaHost: + default: false + description: |- + routingViaHost allows pod egress traffic to exit via the ovn-k8s-mp0 management port + into the host before sending it out. If this is not set, traffic will always egress directly + from OVN to outside without touching the host stack. Setting this to true means hardware + offload will not be supported. Default is false if GatewayConfig is specified. + type: boolean + type: object + genevePort: + description: |- + geneve port is the UDP port to be used by geneve encapulation. + Default is 6081 + format: int32 + minimum: 1 + type: integer + hybridOverlayConfig: + description: |- + hybridOverlayConfig configures an additional overlay network for peers that are + not using OVN. + properties: + hybridClusterNetwork: + description: hybridClusterNetwork defines a network space + given to nodes on an additional overlay network. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + hybridOverlayVXLANPort: + description: |- + hybridOverlayVXLANPort defines the VXLAN port number to be used by the additional overlay network. + Default is 4789 + format: int32 + type: integer + type: object + ipsecConfig: + default: + mode: Disabled + description: |- + ipsecConfig enables and configures IPsec for pods on the pod network within the + cluster. + properties: + full: + description: |- + full defines configuration parameters for the IPsec `Full` mode. + This is permitted only when mode is configured with `Full`, + and forbidden otherwise. + minProperties: 1 + properties: + encapsulation: + description: |- + encapsulation option to configure libreswan on how inter-pod traffic across nodes + are encapsulated to handle NAT traversal. When configured it uses UDP port 4500 + for the encapsulation. + Valid values are Always, Auto and omitted. + Always means enable UDP encapsulation regardless of whether NAT is detected. + Auto means enable UDP encapsulation based on the detection of NAT. + When omitted, this means no opinion and the platform is left to choose a reasonable + default, which is subject to change over time. The current default is Auto. + enum: + - Always + - Auto + type: string + type: object + mode: + description: |- + mode defines the behaviour of the ipsec configuration within the platform. + Valid values are `Disabled`, `External` and `Full`. + When 'Disabled', ipsec will not be enabled at the node level. + When 'External', ipsec is enabled on the node level but requires the user to configure the secure communication parameters. + This mode is for external secure communications and the configuration can be done using the k8s-nmstate operator. + When 'Full', ipsec is configured on the node level and inter-pod secure communication within the cluster is configured. + Note with `Full`, if ipsec is desired for communication with external (to the cluster) entities (such as storage arrays), + this is left to the user to configure. + enum: + - Disabled + - External + - Full + type: string + type: object + x-kubernetes-validations: + - message: ipsecConfig.mode is required + rule: self == oldSelf || has(self.mode) + - message: full is forbidden when mode is not Full + rule: 'has(self.mode) && self.mode == ''Full'' ? true : + !has(self.full)' + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The current default value is 100.64.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The current default subnet is 100.88.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default value is fd98::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default subnet is fd97::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + type: object + mtu: + description: |- + mtu is the MTU to use for the tunnel interface. This must be 100 + bytes smaller than the uplink mtu. + Default is 1400 + format: int32 + minimum: 0 + type: integer + noOverlayConfig: + description: |- + noOverlayConfig contains configuration for no-overlay mode. + This configuration applies to the default network only. + It is required when transport is "NoOverlay". + When omitted, this means the user does not configure no-overlay mode options. + properties: + outboundSNAT: + description: |- + outboundSNAT defines the SNAT behavior for outbound traffic from pods. + Allowed values are "Enabled" and "Disabled". + When set to "Enabled", SNAT is performed on outbound traffic from pods. + When set to "Disabled", SNAT is not performed and pod IPs are preserved in outbound traffic. + This field is required when the network operates in no-overlay mode. + This field can be set to any value at installation time and can be changed afterwards. + enum: + - Enabled + - Disabled + type: string + routing: + description: |- + routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. + Allowed values are "Managed" and "Unmanaged". + When set to "Managed", OVN-Kubernetes manages the pod network routing configuration through BGP. + When set to "Unmanaged", users are responsible for configuring the pod network routing. + This field is required when the network operates in no-overlay mode. + This field is immutable once set. + enum: + - Managed + - Unmanaged + type: string + x-kubernetes-validations: + - message: routing is immutable once set + rule: self == oldSelf + required: + - outboundSNAT + - routing + type: object + policyAuditConfig: + description: |- + policyAuditConfig is the configuration for network policy audit events. If unset, + reported defaults are used. + properties: + destination: + default: "null" + description: |- + destination is the location for policy log messages. + Regardless of this config, persistent logs will always be dumped to the host + at /var/log/ovn/ however + Additionally syslog output may be configured as follows. + Valid values are: + - "libc" -> to use the libc syslog() function of the host node's journdald process + - "udp:host:port" -> for sending syslog over UDP + - "unix:file" -> for using the UNIX domain socket directly + - "null" -> to discard all messages logged to syslog + The default is "null" + type: string + maxFileSize: + default: 50 + description: |- + maxFilesSize is the max size an ACL_audit log file is allowed to reach before rotation occurs + Units are in MB and the Default is 50MB + format: int32 + minimum: 1 + type: integer + maxLogFiles: + default: 5 + description: maxLogFiles specifies the maximum number + of ACL_audit log files that can be present. + format: int32 + minimum: 1 + type: integer + rateLimit: + default: 20 + description: |- + rateLimit is the approximate maximum number of messages to generate per-second per-node. If + unset the default of 20 msg/sec is used. + format: int32 + minimum: 1 + type: integer + syslogFacility: + default: local0 + description: syslogFacility the RFC5424 facility for generated + messages, e.g. "kern". Default is "local0" + type: string + type: object + routeAdvertisements: + description: |- + routeAdvertisements determines if the functionality to advertise cluster + network routes through a dynamic routing protocol, such as BGP, is + enabled or not. This functionality is configured through the + ovn-kubernetes RouteAdvertisements CRD. Requires the 'FRR' routing + capability provider to be enabled as an additional routing capability. + Allowed values are "Enabled", "Disabled" and ommited. When omitted, this + means the user has no opinion and the platform is left to choose + reasonable defaults. These defaults are subject to change over time. The + current default is "Disabled". + enum: + - "" + - Enabled + - Disabled + type: string + transport: + description: |- + transport sets the transport mode for pods on the default network. + Allowed values are "NoOverlay" and "Geneve". + "NoOverlay" avoids tunnel encapsulation, routing pod traffic directly between nodes. + "Geneve" encapsulates pod traffic using Geneve tunnels between nodes. + When omitted, this means the user has no opinion and the platform chooses + a reasonable default which is subject to change over time. + The current default is "Geneve". + "NoOverlay" can only be set at installation time and cannot be changed afterwards. + "Geneve" may be set explicitly at any time to lock in the current default. + enum: + - NoOverlay + - Geneve + type: string + x-kubernetes-validations: + - message: transport is immutable once set + rule: self == oldSelf + v4InternalSubnet: + description: |- + v4InternalSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is 100.64.0.0/16 + type: string + v6InternalSubnet: + description: |- + v6InternalSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is fd98::/64 + type: string + type: object + x-kubernetes-validations: + - message: routeAdvertisements must be Enabled when transport + is NoOverlay + rule: 'self.?transport.orValue('''') == ''NoOverlay'' ? self.?routeAdvertisements.orValue('''') + == ''Enabled'' : true' + - message: noOverlayConfig must be set if transport is NoOverlay, + and is forbidden otherwise + rule: 'self.?transport.orValue('''') == ''NoOverlay'' ? has(self.noOverlayConfig) + : !has(self.noOverlayConfig)' + - message: bgpManagedConfig is required when noOverlayConfig.routing + is Managed + rule: 'self.?noOverlayConfig.routing.orValue('''') == ''Managed'' + ? has(self.bgpManagedConfig) : true' + - message: transport can only be set to Geneve after installation + rule: '!has(self.transport) || self.transport == ''Geneve'' + || has(oldSelf.transport)' + - message: transport may not be removed once set + rule: '!has(oldSelf.transport) || has(self.transport)' + - message: noOverlayConfig may not be removed once set + rule: '!has(oldSelf.noOverlayConfig) || has(self.noOverlayConfig)' + type: + description: |- + type is the type of network + All NetworkTypes are supported except for NetworkTypeRaw + type: string + type: object + deployKubeProxy: + description: |- + deployKubeProxy specifies whether or not a standalone kube-proxy should + be deployed by the operator. Some network providers include kube-proxy + or similar functionality. If unset, the plugin will attempt to select + the correct value, which is false when ovn-kubernetes is used and true + otherwise. + type: boolean + disableMultiNetwork: + description: |- + disableMultiNetwork defaults to 'false' and this setting enables the pod multi-networking capability. + disableMultiNetwork when set to 'true' at cluster install time does not install the components, typically the Multus CNI and the network-attachment-definition CRD, + that enable the pod multi-networking capability. Setting the parameter to 'true' might be useful when you need install third-party CNI plugins, + but these plugins are not supported by Red Hat. Changing the parameter value as a postinstallation cluster task has no effect. + type: boolean + disableNetworkDiagnostics: + default: false + description: |- + disableNetworkDiagnostics specifies whether or not PodNetworkConnectivityCheck + CRs from a test pod to every node, apiserver and LB should be disabled or not. + If unset, this property defaults to 'false' and network diagnostics is enabled. + Setting this to 'true' would reduce the additional load of the pods performing the checks. + type: boolean + exportNetworkFlows: + description: |- + exportNetworkFlows enables and configures the export of network flow metadata from the pod network + by using protocols NetFlow, SFlow or IPFIX. Currently only supported on OVN-Kubernetes plugin. + If unset, flows will not be exported to any collector. + properties: + ipfix: + description: ipfix defines IPFIX configuration. + properties: + collectors: + description: ipfixCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + netFlow: + description: netFlow defines the NetFlow configuration. + properties: + collectors: + description: |- + netFlow defines the NetFlow collectors that will consume the flow data exported from OVS. + It is a list of strings formatted as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + sFlow: + description: sFlow defines the SFlow configuration. + properties: + collectors: + description: sFlowCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + type: object + kubeProxyConfig: + description: |- + kubeProxyConfig lets us configure desired proxy configuration, if + deployKubeProxy is true. If not specified, sensible defaults will be chosen by + OpenShift directly. + properties: + bindAddress: + description: |- + The address to "bind" on + Defaults to 0.0.0.0 + type: string + iptablesSyncPeriod: + description: |- + An internal kube-proxy parameter. In older releases of OCP, this sometimes needed to be adjusted + in large clusters for performance reasons, but this is no longer necessary, and there is no reason + to change this from the default value. + Default: 30s + type: string + proxyArguments: + additionalProperties: + description: ProxyArgumentList is a list of arguments to pass + to the kubeproxy process + items: + type: string + type: array + x-kubernetes-list-type: atomic + description: Any additional arguments to pass to the kubeproxy + process + type: object + type: object + logLevel: + default: Normal + description: |- + logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for their operands. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + managementState: + description: managementState indicates whether and how the operator + should manage the component + pattern: ^(Managed|Unmanaged|Force|Removed)$ + type: string + migration: + description: |- + migration enables and configures cluster network migration, for network changes + that cannot be made instantly. + properties: + features: + description: |- + features was previously used to configure which network plugin features + would be migrated in a network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + properties: + egressFirewall: + default: true + description: |- + egressFirewall specified whether or not the Egress Firewall configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + egressIP: + default: true + description: |- + egressIP specified whether or not the Egress IP configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + multicast: + default: true + description: |- + multicast specified whether or not the multicast configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + type: object + mode: + description: |- + mode indicates the mode of network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + enum: + - Live + - Offline + - "" + type: string + mtu: + description: |- + mtu contains the MTU migration configuration. Set this to allow changing + the MTU values for the default network. If unset, the operation of + changing the MTU for the default network will be rejected. + properties: + machine: + description: |- + machine contains MTU migration configuration for the machine's uplink. + Needs to be migrated along with the default network MTU unless the + current uplink MTU already accommodates the default network MTU. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + network: + description: |- + network contains information about MTU migration for the default network. + Migrations are only allowed to MTU values lower than the machine's uplink + MTU by the minimum appropriate offset. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + type: object + networkType: + description: |- + networkType was previously used when changing the default network type. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + type: string + type: object + x-kubernetes-validations: + - message: networkType migration in mode other than 'Live' may not + be configured at the same time as mtu migration + rule: '!has(self.mtu) || !has(self.networkType) || self.networkType + == "" || has(self.mode) && self.mode == ''Live''' + observedConfig: + description: |- + observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because + it is an input to the level for the operator + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + operatorLogLevel: + default: Normal + description: |- + operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for themselves. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + serviceNetwork: + description: |- + serviceNetwork is the ip address pool to use for Service IPs + Currently, all existing network providers only support a single value + here, but this is an array to allow for growth. + items: + type: string + type: array + x-kubernetes-list-type: atomic + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides overrides the final configuration that was computed by the operator. + Red Hat does not support the use of this field. + Misuse of this field could lead to unexpected behavior or conflict with other configuration options. + Seek guidance from the Red Hat support before using this field. + Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + useMultiNetworkPolicy: + description: |- + useMultiNetworkPolicy enables a controller which allows for + MultiNetworkPolicy objects to be used on additional networks as + created by Multus CNI. MultiNetworkPolicy are similar to NetworkPolicy + objects, but NetworkPolicy objects only apply to the primary interface. + With MultiNetworkPolicy, you can control the traffic that a pod can receive + over the secondary interfaces. If unset, this property defaults to 'false' + and MultiNetworkPolicy objects are ignored. If 'disableMultiNetwork' is + 'true' then the value of this field is ignored. + type: boolean + type: object + x-kubernetes-validations: + - message: invalid value for IPForwarding, valid values are 'Restricted' + or 'Global' + rule: '!has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig) || + !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding) + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == oldSelf.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Restricted'' || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Global''' + - message: Route advertisements cannot be Enabled if 'FRR' routing capability + provider is not available + rule: (has(self.additionalRoutingCapabilities) && ('FRR' in self.additionalRoutingCapabilities.providers)) + || !has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements) + || self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements != + 'Enabled' + status: + description: |- + NetworkStatus is detailed operator status, which is distilled + up to the Network clusteroperator object. + properties: + conditions: + description: conditions is a list of conditions and their status + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + generations: + description: generations are used to determine when an item needs + to be reconciled or has changed in a way that needs a reaction. + items: + description: GenerationStatus keeps track of the generation for + a given resource so that decisions about forced updates can be + made. + properties: + group: + description: group is the group of the thing you're tracking + type: string + hash: + description: hash is an optional field set for resources without + generation that are content sensitive like secrets and configmaps + type: string + lastGeneration: + description: lastGeneration is the last generation of the workload + controller involved + format: int64 + type: integer + name: + description: name is the name of the thing you're tracking + type: string + namespace: + description: namespace is where the thing you're tracking is + type: string + resource: + description: resource is the resource type of the thing you're + tracking + type: string + required: + - group + - name + - namespace + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - group + - resource + - namespace + - name + x-kubernetes-list-type: map + latestAvailableRevision: + description: latestAvailableRevision is the deploymentID of the most + recent deployment + format: int32 + type: integer + x-kubernetes-validations: + - message: must only increase + rule: self >= oldSelf + observedGeneration: + description: observedGeneration is the last generation change you've + dealt with + format: int64 + type: integer + readyReplicas: + description: readyReplicas indicates how many replicas are ready and + at the desired state + format: int32 + type: integer + version: + description: version is the level this availability applies to + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-Default.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-Default.crd.yaml new file mode 100644 index 0000000000..2324d6d3b6 --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-Default.crd.yaml @@ -0,0 +1,1045 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/475 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: Default + name: networks.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: Network + listKind: NetworkList + plural: networks + singular: network + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + Network describes the cluster's desired network configuration. It is + consumed by the cluster-network-operator. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: NetworkSpec is the top-level network configuration object. + properties: + additionalNetworks: + description: |- + additionalNetworks is a list of extra networks to make available to pods + when multiple networks are enabled. + items: + description: |- + AdditionalNetworkDefinition configures an extra network that is available but not + created by default. Instead, pods must request them by name. + type must be specified, along with exactly one "Config" that matches the type. + properties: + name: + description: |- + name is the name of the network. This will be populated in the resulting CRD + This must be unique. + type: string + namespace: + description: |- + namespace is the namespace of the network. This will be populated in the resulting CRD + If not given the network will be created in the default namespace. + type: string + rawCNIConfig: + description: |- + rawCNIConfig is the raw CNI configuration json to create in the + NetworkAttachmentDefinition CRD + type: string + simpleMacvlanConfig: + description: simpleMacvlanConfig configures the macvlan interface + in case of type:NetworkTypeSimpleMacvlan + properties: + ipamConfig: + description: ipamConfig configures IPAM module will be used + for IP Address Management (IPAM). + properties: + staticIPAMConfig: + description: staticIPAMConfig configures the static + IP address in case of type:IPAMTypeStatic + properties: + addresses: + description: addresses configures IP address for + the interface + items: + description: StaticIPAMAddresses provides IP address + and Gateway for static IPAM addresses + properties: + address: + description: address is the IP address in + CIDR format + type: string + gateway: + description: gateway is IP inside of subnet + to designate as the gateway + type: string + type: object + type: array + x-kubernetes-list-type: atomic + dns: + description: dns configures DNS for the interface + properties: + domain: + description: domain configures the domainname + the local domain used for short hostname lookups + type: string + nameservers: + description: nameservers points DNS servers + for IP lookup + items: + type: string + type: array + x-kubernetes-list-type: atomic + search: + description: search configures priority ordered + search domains for short hostname lookups + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + routes: + description: routes configures IP routes for the + interface + items: + description: StaticIPAMRoutes provides Destination/Gateway + pairs for static IPAM routes + properties: + destination: + description: destination points the IP route + destination + type: string + gateway: + description: |- + gateway is the route's next-hop IP address + If unset, a default gateway is assumed (as determined by the CNI plugin). + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: + description: |- + type is the type of IPAM module will be used for IP Address Management(IPAM). + The supported values are IPAMTypeDHCP, IPAMTypeStatic + type: string + type: object + master: + description: |- + master is the host interface to create the macvlan interface from. + If not specified, it will be default route interface + type: string + mode: + description: 'mode is the macvlan mode: bridge, private, + vepa, passthru. The default is bridge' + type: string + mtu: + description: |- + mtu is the mtu to use for the macvlan interface. if unset, host's + kernel will select the value. + format: int32 + minimum: 0 + type: integer + type: object + type: + description: |- + type is the type of network + The supported values are NetworkTypeRaw, NetworkTypeSimpleMacvlan + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + additionalRoutingCapabilities: + description: |- + additionalRoutingCapabilities describes components and relevant + configuration providing additional routing capabilities. When set, it + enables such components and the usage of the routing capabilities they + provide for the machine network. Upstream operators, like MetalLB + operator, requiring these capabilities may rely on, or automatically set + this attribute. Network plugins may leverage advanced routing + capabilities acquired through the enablement of these components but may + require specific configuration on their side to do so; refer to their + respective documentation and configuration options. + properties: + providers: + description: |- + providers is a set of enabled components that provide additional routing + capabilities. Entries on this list must be unique. The only valid value + is currrently "FRR" which provides FRR routing capabilities through the + deployment of FRR. + items: + description: RoutingCapabilitiesProvider is a component providing + routing capabilities. + enum: + - FRR + type: string + maxItems: 1 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - rule: self.all(x, self.exists_one(y, x == y)) + required: + - providers + type: object + clusterNetwork: + description: |- + clusterNetwork is the IP address pool to use for pod IPs. + Some network providers support multiple ClusterNetworks. + Others only support one. This is equivalent to the cluster-cidr. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + defaultNetwork: + description: defaultNetwork is the "default" network that all pods + will receive + properties: + openshiftSDNConfig: + description: |- + openshiftSDNConfig was previously used to configure the openshift-sdn plugin. + DEPRECATED: OpenShift SDN is no longer supported. + properties: + enableUnidling: + description: |- + enableUnidling controls whether or not the service proxy will support idling + and unidling of services. By default, unidling is enabled. + type: boolean + mode: + description: mode is one of "Multitenant", "Subnet", or "NetworkPolicy" + type: string + mtu: + description: |- + mtu is the mtu to use for the tunnel interface. Defaults to 1450 if unset. + This must be 50 bytes smaller than the machine's uplink. + format: int32 + minimum: 0 + type: integer + useExternalOpenvswitch: + description: |- + useExternalOpenvswitch used to control whether the operator would deploy an OVS + DaemonSet itself or expect someone else to start OVS. As of 4.6, OVS is always + run as a system service, and this flag is ignored. + type: boolean + vxlanPort: + description: vxlanPort is the port to use for all vxlan packets. + The default is 4789. + format: int32 + minimum: 0 + type: integer + type: object + ovnKubernetesConfig: + description: ovnKubernetesConfig configures the ovn-kubernetes + plugin. + properties: + egressIPConfig: + description: egressIPConfig holds the configuration for EgressIP + options. + properties: + reachabilityTotalTimeoutSeconds: + description: |- + reachabilityTotalTimeout configures the EgressIP node reachability check total timeout in seconds. + If the EgressIP node cannot be reached within this timeout, the node is declared down. + Setting a large value may cause the EgressIP feature to react slowly to node changes. + In particular, it may react slowly for EgressIP nodes that really have a genuine problem and are unreachable. + When omitted, this means the user has no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is 1 second. + A value of 0 disables the EgressIP node's reachability check. + format: int32 + maximum: 60 + minimum: 0 + type: integer + type: object + gatewayConfig: + description: gatewayConfig holds the configuration for node + gateway options. + properties: + ipForwarding: + description: |- + ipForwarding controls IP forwarding for all traffic on OVN-Kubernetes managed interfaces (such as br-ex). + By default this is set to Restricted, and Kubernetes related traffic is still forwarded appropriately, but other + IP traffic will not be routed by the OCP node. If there is a desire to allow the host to forward traffic across + OVN-Kubernetes managed interfaces, then set this field to "Global". + The supported values are "Restricted" and "Global". + type: string + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv4 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV4 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /29). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is 169.254.0.0/17 + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 4 + - message: subnet must be in the range /0 to /29 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 29 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > + 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv6 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV6 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /125). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is fd69::/112 + Note that IPV6 dual addresses are not permitted + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 6 + - message: subnet must be in the range /0 to /125 + inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 125 + type: object + routingViaHost: + default: false + description: |- + routingViaHost allows pod egress traffic to exit via the ovn-k8s-mp0 management port + into the host before sending it out. If this is not set, traffic will always egress directly + from OVN to outside without touching the host stack. Setting this to true means hardware + offload will not be supported. Default is false if GatewayConfig is specified. + type: boolean + type: object + genevePort: + description: |- + geneve port is the UDP port to be used by geneve encapulation. + Default is 6081 + format: int32 + minimum: 1 + type: integer + hybridOverlayConfig: + description: |- + hybridOverlayConfig configures an additional overlay network for peers that are + not using OVN. + properties: + hybridClusterNetwork: + description: hybridClusterNetwork defines a network space + given to nodes on an additional overlay network. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + hybridOverlayVXLANPort: + description: |- + hybridOverlayVXLANPort defines the VXLAN port number to be used by the additional overlay network. + Default is 4789 + format: int32 + type: integer + type: object + ipsecConfig: + default: + mode: Disabled + description: |- + ipsecConfig enables and configures IPsec for pods on the pod network within the + cluster. + properties: + full: + description: |- + full defines configuration parameters for the IPsec `Full` mode. + This is permitted only when mode is configured with `Full`, + and forbidden otherwise. + minProperties: 1 + properties: + encapsulation: + description: |- + encapsulation option to configure libreswan on how inter-pod traffic across nodes + are encapsulated to handle NAT traversal. When configured it uses UDP port 4500 + for the encapsulation. + Valid values are Always, Auto and omitted. + Always means enable UDP encapsulation regardless of whether NAT is detected. + Auto means enable UDP encapsulation based on the detection of NAT. + When omitted, this means no opinion and the platform is left to choose a reasonable + default, which is subject to change over time. The current default is Auto. + enum: + - Always + - Auto + type: string + type: object + mode: + description: |- + mode defines the behaviour of the ipsec configuration within the platform. + Valid values are `Disabled`, `External` and `Full`. + When 'Disabled', ipsec will not be enabled at the node level. + When 'External', ipsec is enabled on the node level but requires the user to configure the secure communication parameters. + This mode is for external secure communications and the configuration can be done using the k8s-nmstate operator. + When 'Full', ipsec is configured on the node level and inter-pod secure communication within the cluster is configured. + Note with `Full`, if ipsec is desired for communication with external (to the cluster) entities (such as storage arrays), + this is left to the user to configure. + enum: + - Disabled + - External + - Full + type: string + type: object + x-kubernetes-validations: + - message: ipsecConfig.mode is required + rule: self == oldSelf || has(self.mode) + - message: full is forbidden when mode is not Full + rule: 'has(self.mode) && self.mode == ''Full'' ? true : + !has(self.full)' + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The current default value is 100.64.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The current default subnet is 100.88.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default value is fd98::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default subnet is fd97::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + type: object + mtu: + description: |- + mtu is the MTU to use for the tunnel interface. This must be 100 + bytes smaller than the uplink mtu. + Default is 1400 + format: int32 + minimum: 0 + type: integer + policyAuditConfig: + description: |- + policyAuditConfig is the configuration for network policy audit events. If unset, + reported defaults are used. + properties: + destination: + default: "null" + description: |- + destination is the location for policy log messages. + Regardless of this config, persistent logs will always be dumped to the host + at /var/log/ovn/ however + Additionally syslog output may be configured as follows. + Valid values are: + - "libc" -> to use the libc syslog() function of the host node's journdald process + - "udp:host:port" -> for sending syslog over UDP + - "unix:file" -> for using the UNIX domain socket directly + - "null" -> to discard all messages logged to syslog + The default is "null" + type: string + maxFileSize: + default: 50 + description: |- + maxFilesSize is the max size an ACL_audit log file is allowed to reach before rotation occurs + Units are in MB and the Default is 50MB + format: int32 + minimum: 1 + type: integer + maxLogFiles: + default: 5 + description: maxLogFiles specifies the maximum number + of ACL_audit log files that can be present. + format: int32 + minimum: 1 + type: integer + rateLimit: + default: 20 + description: |- + rateLimit is the approximate maximum number of messages to generate per-second per-node. If + unset the default of 20 msg/sec is used. + format: int32 + minimum: 1 + type: integer + syslogFacility: + default: local0 + description: syslogFacility the RFC5424 facility for generated + messages, e.g. "kern". Default is "local0" + type: string + type: object + routeAdvertisements: + description: |- + routeAdvertisements determines if the functionality to advertise cluster + network routes through a dynamic routing protocol, such as BGP, is + enabled or not. This functionality is configured through the + ovn-kubernetes RouteAdvertisements CRD. Requires the 'FRR' routing + capability provider to be enabled as an additional routing capability. + Allowed values are "Enabled", "Disabled" and ommited. When omitted, this + means the user has no opinion and the platform is left to choose + reasonable defaults. These defaults are subject to change over time. The + current default is "Disabled". + enum: + - "" + - Enabled + - Disabled + type: string + v4InternalSubnet: + description: |- + v4InternalSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is 100.64.0.0/16 + type: string + v6InternalSubnet: + description: |- + v6InternalSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is fd98::/64 + type: string + type: object + type: + description: |- + type is the type of network + All NetworkTypes are supported except for NetworkTypeRaw + type: string + type: object + deployKubeProxy: + description: |- + deployKubeProxy specifies whether or not a standalone kube-proxy should + be deployed by the operator. Some network providers include kube-proxy + or similar functionality. If unset, the plugin will attempt to select + the correct value, which is false when ovn-kubernetes is used and true + otherwise. + type: boolean + disableMultiNetwork: + description: |- + disableMultiNetwork defaults to 'false' and this setting enables the pod multi-networking capability. + disableMultiNetwork when set to 'true' at cluster install time does not install the components, typically the Multus CNI and the network-attachment-definition CRD, + that enable the pod multi-networking capability. Setting the parameter to 'true' might be useful when you need install third-party CNI plugins, + but these plugins are not supported by Red Hat. Changing the parameter value as a postinstallation cluster task has no effect. + type: boolean + disableNetworkDiagnostics: + default: false + description: |- + disableNetworkDiagnostics specifies whether or not PodNetworkConnectivityCheck + CRs from a test pod to every node, apiserver and LB should be disabled or not. + If unset, this property defaults to 'false' and network diagnostics is enabled. + Setting this to 'true' would reduce the additional load of the pods performing the checks. + type: boolean + exportNetworkFlows: + description: |- + exportNetworkFlows enables and configures the export of network flow metadata from the pod network + by using protocols NetFlow, SFlow or IPFIX. Currently only supported on OVN-Kubernetes plugin. + If unset, flows will not be exported to any collector. + properties: + ipfix: + description: ipfix defines IPFIX configuration. + properties: + collectors: + description: ipfixCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + netFlow: + description: netFlow defines the NetFlow configuration. + properties: + collectors: + description: |- + netFlow defines the NetFlow collectors that will consume the flow data exported from OVS. + It is a list of strings formatted as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + sFlow: + description: sFlow defines the SFlow configuration. + properties: + collectors: + description: sFlowCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + type: object + kubeProxyConfig: + description: |- + kubeProxyConfig lets us configure desired proxy configuration, if + deployKubeProxy is true. If not specified, sensible defaults will be chosen by + OpenShift directly. + properties: + bindAddress: + description: |- + The address to "bind" on + Defaults to 0.0.0.0 + type: string + iptablesSyncPeriod: + description: |- + An internal kube-proxy parameter. In older releases of OCP, this sometimes needed to be adjusted + in large clusters for performance reasons, but this is no longer necessary, and there is no reason + to change this from the default value. + Default: 30s + type: string + proxyArguments: + additionalProperties: + description: ProxyArgumentList is a list of arguments to pass + to the kubeproxy process + items: + type: string + type: array + x-kubernetes-list-type: atomic + description: Any additional arguments to pass to the kubeproxy + process + type: object + type: object + logLevel: + default: Normal + description: |- + logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for their operands. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + managementState: + description: managementState indicates whether and how the operator + should manage the component + pattern: ^(Managed|Unmanaged|Force|Removed)$ + type: string + migration: + description: |- + migration enables and configures cluster network migration, for network changes + that cannot be made instantly. + properties: + features: + description: |- + features was previously used to configure which network plugin features + would be migrated in a network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + properties: + egressFirewall: + default: true + description: |- + egressFirewall specified whether or not the Egress Firewall configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + egressIP: + default: true + description: |- + egressIP specified whether or not the Egress IP configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + multicast: + default: true + description: |- + multicast specified whether or not the multicast configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + type: object + mode: + description: |- + mode indicates the mode of network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + enum: + - Live + - Offline + - "" + type: string + mtu: + description: |- + mtu contains the MTU migration configuration. Set this to allow changing + the MTU values for the default network. If unset, the operation of + changing the MTU for the default network will be rejected. + properties: + machine: + description: |- + machine contains MTU migration configuration for the machine's uplink. + Needs to be migrated along with the default network MTU unless the + current uplink MTU already accommodates the default network MTU. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + network: + description: |- + network contains information about MTU migration for the default network. + Migrations are only allowed to MTU values lower than the machine's uplink + MTU by the minimum appropriate offset. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + type: object + networkType: + description: |- + networkType was previously used when changing the default network type. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + type: string + type: object + x-kubernetes-validations: + - message: networkType migration in mode other than 'Live' may not + be configured at the same time as mtu migration + rule: '!has(self.mtu) || !has(self.networkType) || self.networkType + == "" || has(self.mode) && self.mode == ''Live''' + observedConfig: + description: |- + observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because + it is an input to the level for the operator + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + operatorLogLevel: + default: Normal + description: |- + operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for themselves. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + serviceNetwork: + description: |- + serviceNetwork is the ip address pool to use for Service IPs + Currently, all existing network providers only support a single value + here, but this is an array to allow for growth. + items: + type: string + type: array + x-kubernetes-list-type: atomic + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides overrides the final configuration that was computed by the operator. + Red Hat does not support the use of this field. + Misuse of this field could lead to unexpected behavior or conflict with other configuration options. + Seek guidance from the Red Hat support before using this field. + Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + useMultiNetworkPolicy: + description: |- + useMultiNetworkPolicy enables a controller which allows for + MultiNetworkPolicy objects to be used on additional networks as + created by Multus CNI. MultiNetworkPolicy are similar to NetworkPolicy + objects, but NetworkPolicy objects only apply to the primary interface. + With MultiNetworkPolicy, you can control the traffic that a pod can receive + over the secondary interfaces. If unset, this property defaults to 'false' + and MultiNetworkPolicy objects are ignored. If 'disableMultiNetwork' is + 'true' then the value of this field is ignored. + type: boolean + type: object + x-kubernetes-validations: + - message: invalid value for IPForwarding, valid values are 'Restricted' + or 'Global' + rule: '!has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig) || + !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding) + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == oldSelf.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Restricted'' || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Global''' + - message: Route advertisements cannot be Enabled if 'FRR' routing capability + provider is not available + rule: (has(self.additionalRoutingCapabilities) && ('FRR' in self.additionalRoutingCapabilities.providers)) + || !has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements) + || self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements != + 'Enabled' + status: + description: |- + NetworkStatus is detailed operator status, which is distilled + up to the Network clusteroperator object. + properties: + conditions: + description: conditions is a list of conditions and their status + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + generations: + description: generations are used to determine when an item needs + to be reconciled or has changed in a way that needs a reaction. + items: + description: GenerationStatus keeps track of the generation for + a given resource so that decisions about forced updates can be + made. + properties: + group: + description: group is the group of the thing you're tracking + type: string + hash: + description: hash is an optional field set for resources without + generation that are content sensitive like secrets and configmaps + type: string + lastGeneration: + description: lastGeneration is the last generation of the workload + controller involved + format: int64 + type: integer + name: + description: name is the name of the thing you're tracking + type: string + namespace: + description: namespace is where the thing you're tracking is + type: string + resource: + description: resource is the resource type of the thing you're + tracking + type: string + required: + - group + - name + - namespace + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - group + - resource + - namespace + - name + x-kubernetes-list-type: map + latestAvailableRevision: + description: latestAvailableRevision is the deploymentID of the most + recent deployment + format: int32 + type: integer + x-kubernetes-validations: + - message: must only increase + rule: self >= oldSelf + observedGeneration: + description: observedGeneration is the last generation change you've + dealt with + format: int64 + type: integer + readyReplicas: + description: readyReplicas indicates how many replicas are ready and + at the desired state + format: int32 + type: integer + version: + description: version is the level this availability applies to + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-DevPreviewNoUpgrade.crd.yaml new file mode 100644 index 0000000000..7fcb1ab52e --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-DevPreviewNoUpgrade.crd.yaml @@ -0,0 +1,1152 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/475 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: DevPreviewNoUpgrade + name: networks.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: Network + listKind: NetworkList + plural: networks + singular: network + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + Network describes the cluster's desired network configuration. It is + consumed by the cluster-network-operator. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: NetworkSpec is the top-level network configuration object. + properties: + additionalNetworks: + description: |- + additionalNetworks is a list of extra networks to make available to pods + when multiple networks are enabled. + items: + description: |- + AdditionalNetworkDefinition configures an extra network that is available but not + created by default. Instead, pods must request them by name. + type must be specified, along with exactly one "Config" that matches the type. + properties: + name: + description: |- + name is the name of the network. This will be populated in the resulting CRD + This must be unique. + type: string + namespace: + description: |- + namespace is the namespace of the network. This will be populated in the resulting CRD + If not given the network will be created in the default namespace. + type: string + rawCNIConfig: + description: |- + rawCNIConfig is the raw CNI configuration json to create in the + NetworkAttachmentDefinition CRD + type: string + simpleMacvlanConfig: + description: simpleMacvlanConfig configures the macvlan interface + in case of type:NetworkTypeSimpleMacvlan + properties: + ipamConfig: + description: ipamConfig configures IPAM module will be used + for IP Address Management (IPAM). + properties: + staticIPAMConfig: + description: staticIPAMConfig configures the static + IP address in case of type:IPAMTypeStatic + properties: + addresses: + description: addresses configures IP address for + the interface + items: + description: StaticIPAMAddresses provides IP address + and Gateway for static IPAM addresses + properties: + address: + description: address is the IP address in + CIDR format + type: string + gateway: + description: gateway is IP inside of subnet + to designate as the gateway + type: string + type: object + type: array + x-kubernetes-list-type: atomic + dns: + description: dns configures DNS for the interface + properties: + domain: + description: domain configures the domainname + the local domain used for short hostname lookups + type: string + nameservers: + description: nameservers points DNS servers + for IP lookup + items: + type: string + type: array + x-kubernetes-list-type: atomic + search: + description: search configures priority ordered + search domains for short hostname lookups + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + routes: + description: routes configures IP routes for the + interface + items: + description: StaticIPAMRoutes provides Destination/Gateway + pairs for static IPAM routes + properties: + destination: + description: destination points the IP route + destination + type: string + gateway: + description: |- + gateway is the route's next-hop IP address + If unset, a default gateway is assumed (as determined by the CNI plugin). + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: + description: |- + type is the type of IPAM module will be used for IP Address Management(IPAM). + The supported values are IPAMTypeDHCP, IPAMTypeStatic + type: string + type: object + master: + description: |- + master is the host interface to create the macvlan interface from. + If not specified, it will be default route interface + type: string + mode: + description: 'mode is the macvlan mode: bridge, private, + vepa, passthru. The default is bridge' + type: string + mtu: + description: |- + mtu is the mtu to use for the macvlan interface. if unset, host's + kernel will select the value. + format: int32 + minimum: 0 + type: integer + type: object + type: + description: |- + type is the type of network + The supported values are NetworkTypeRaw, NetworkTypeSimpleMacvlan + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + additionalRoutingCapabilities: + description: |- + additionalRoutingCapabilities describes components and relevant + configuration providing additional routing capabilities. When set, it + enables such components and the usage of the routing capabilities they + provide for the machine network. Upstream operators, like MetalLB + operator, requiring these capabilities may rely on, or automatically set + this attribute. Network plugins may leverage advanced routing + capabilities acquired through the enablement of these components but may + require specific configuration on their side to do so; refer to their + respective documentation and configuration options. + properties: + providers: + description: |- + providers is a set of enabled components that provide additional routing + capabilities. Entries on this list must be unique. The only valid value + is currrently "FRR" which provides FRR routing capabilities through the + deployment of FRR. + items: + description: RoutingCapabilitiesProvider is a component providing + routing capabilities. + enum: + - FRR + type: string + maxItems: 1 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - rule: self.all(x, self.exists_one(y, x == y)) + required: + - providers + type: object + clusterNetwork: + description: |- + clusterNetwork is the IP address pool to use for pod IPs. + Some network providers support multiple ClusterNetworks. + Others only support one. This is equivalent to the cluster-cidr. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + defaultNetwork: + description: defaultNetwork is the "default" network that all pods + will receive + properties: + openshiftSDNConfig: + description: |- + openshiftSDNConfig was previously used to configure the openshift-sdn plugin. + DEPRECATED: OpenShift SDN is no longer supported. + properties: + enableUnidling: + description: |- + enableUnidling controls whether or not the service proxy will support idling + and unidling of services. By default, unidling is enabled. + type: boolean + mode: + description: mode is one of "Multitenant", "Subnet", or "NetworkPolicy" + type: string + mtu: + description: |- + mtu is the mtu to use for the tunnel interface. Defaults to 1450 if unset. + This must be 50 bytes smaller than the machine's uplink. + format: int32 + minimum: 0 + type: integer + useExternalOpenvswitch: + description: |- + useExternalOpenvswitch used to control whether the operator would deploy an OVS + DaemonSet itself or expect someone else to start OVS. As of 4.6, OVS is always + run as a system service, and this flag is ignored. + type: boolean + vxlanPort: + description: vxlanPort is the port to use for all vxlan packets. + The default is 4789. + format: int32 + minimum: 0 + type: integer + type: object + ovnKubernetesConfig: + description: ovnKubernetesConfig configures the ovn-kubernetes + plugin. + properties: + bgpManagedConfig: + description: |- + bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) + in no-overlay mode that specify routing="Managed" in their noOverlayConfig. + It is required when noOverlayConfig.routing is set to "Managed". + When omitted, this means the user does not configure BGP for managed routing. + This field can be set at installation time or on day 2, and can be modified at any time. + properties: + asNumber: + default: 64512 + description: |- + asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) + to be used in the generated FRR configuration. + Valid values are 1 to 4294967295. + When omitted, this defaults to 64512. + format: int64 + maximum: 4294967295 + minimum: 1 + type: integer + bgpTopology: + description: |- + bgpTopology defines the BGP topology to be used. + Allowed values are "FullMesh". + When set to "FullMesh", every node peers directly with every other node via BGP. + This field is required when BGPManagedConfig is specified. + enum: + - FullMesh + type: string + required: + - bgpTopology + type: object + egressIPConfig: + description: egressIPConfig holds the configuration for EgressIP + options. + properties: + reachabilityTotalTimeoutSeconds: + description: |- + reachabilityTotalTimeout configures the EgressIP node reachability check total timeout in seconds. + If the EgressIP node cannot be reached within this timeout, the node is declared down. + Setting a large value may cause the EgressIP feature to react slowly to node changes. + In particular, it may react slowly for EgressIP nodes that really have a genuine problem and are unreachable. + When omitted, this means the user has no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is 1 second. + A value of 0 disables the EgressIP node's reachability check. + format: int32 + maximum: 60 + minimum: 0 + type: integer + type: object + gatewayConfig: + description: gatewayConfig holds the configuration for node + gateway options. + properties: + ipForwarding: + description: |- + ipForwarding controls IP forwarding for all traffic on OVN-Kubernetes managed interfaces (such as br-ex). + By default this is set to Restricted, and Kubernetes related traffic is still forwarded appropriately, but other + IP traffic will not be routed by the OCP node. If there is a desire to allow the host to forward traffic across + OVN-Kubernetes managed interfaces, then set this field to "Global". + The supported values are "Restricted" and "Global". + type: string + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv4 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV4 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /29). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is 169.254.0.0/17 + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 4 + - message: subnet must be in the range /0 to /29 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 29 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > + 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv6 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV6 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /125). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is fd69::/112 + Note that IPV6 dual addresses are not permitted + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 6 + - message: subnet must be in the range /0 to /125 + inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 125 + type: object + routingViaHost: + default: false + description: |- + routingViaHost allows pod egress traffic to exit via the ovn-k8s-mp0 management port + into the host before sending it out. If this is not set, traffic will always egress directly + from OVN to outside without touching the host stack. Setting this to true means hardware + offload will not be supported. Default is false if GatewayConfig is specified. + type: boolean + type: object + genevePort: + description: |- + geneve port is the UDP port to be used by geneve encapulation. + Default is 6081 + format: int32 + minimum: 1 + type: integer + hybridOverlayConfig: + description: |- + hybridOverlayConfig configures an additional overlay network for peers that are + not using OVN. + properties: + hybridClusterNetwork: + description: hybridClusterNetwork defines a network space + given to nodes on an additional overlay network. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + hybridOverlayVXLANPort: + description: |- + hybridOverlayVXLANPort defines the VXLAN port number to be used by the additional overlay network. + Default is 4789 + format: int32 + type: integer + type: object + ipsecConfig: + default: + mode: Disabled + description: |- + ipsecConfig enables and configures IPsec for pods on the pod network within the + cluster. + properties: + full: + description: |- + full defines configuration parameters for the IPsec `Full` mode. + This is permitted only when mode is configured with `Full`, + and forbidden otherwise. + minProperties: 1 + properties: + encapsulation: + description: |- + encapsulation option to configure libreswan on how inter-pod traffic across nodes + are encapsulated to handle NAT traversal. When configured it uses UDP port 4500 + for the encapsulation. + Valid values are Always, Auto and omitted. + Always means enable UDP encapsulation regardless of whether NAT is detected. + Auto means enable UDP encapsulation based on the detection of NAT. + When omitted, this means no opinion and the platform is left to choose a reasonable + default, which is subject to change over time. The current default is Auto. + enum: + - Always + - Auto + type: string + type: object + mode: + description: |- + mode defines the behaviour of the ipsec configuration within the platform. + Valid values are `Disabled`, `External` and `Full`. + When 'Disabled', ipsec will not be enabled at the node level. + When 'External', ipsec is enabled on the node level but requires the user to configure the secure communication parameters. + This mode is for external secure communications and the configuration can be done using the k8s-nmstate operator. + When 'Full', ipsec is configured on the node level and inter-pod secure communication within the cluster is configured. + Note with `Full`, if ipsec is desired for communication with external (to the cluster) entities (such as storage arrays), + this is left to the user to configure. + enum: + - Disabled + - External + - Full + type: string + type: object + x-kubernetes-validations: + - message: ipsecConfig.mode is required + rule: self == oldSelf || has(self.mode) + - message: full is forbidden when mode is not Full + rule: 'has(self.mode) && self.mode == ''Full'' ? true : + !has(self.full)' + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The current default value is 100.64.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The current default subnet is 100.88.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default value is fd98::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default subnet is fd97::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + type: object + mtu: + description: |- + mtu is the MTU to use for the tunnel interface. This must be 100 + bytes smaller than the uplink mtu. + Default is 1400 + format: int32 + minimum: 0 + type: integer + noOverlayConfig: + description: |- + noOverlayConfig contains configuration for no-overlay mode. + This configuration applies to the default network only. + It is required when transport is "NoOverlay". + When omitted, this means the user does not configure no-overlay mode options. + properties: + outboundSNAT: + description: |- + outboundSNAT defines the SNAT behavior for outbound traffic from pods. + Allowed values are "Enabled" and "Disabled". + When set to "Enabled", SNAT is performed on outbound traffic from pods. + When set to "Disabled", SNAT is not performed and pod IPs are preserved in outbound traffic. + This field is required when the network operates in no-overlay mode. + This field can be set to any value at installation time and can be changed afterwards. + enum: + - Enabled + - Disabled + type: string + routing: + description: |- + routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. + Allowed values are "Managed" and "Unmanaged". + When set to "Managed", OVN-Kubernetes manages the pod network routing configuration through BGP. + When set to "Unmanaged", users are responsible for configuring the pod network routing. + This field is required when the network operates in no-overlay mode. + This field is immutable once set. + enum: + - Managed + - Unmanaged + type: string + x-kubernetes-validations: + - message: routing is immutable once set + rule: self == oldSelf + required: + - outboundSNAT + - routing + type: object + policyAuditConfig: + description: |- + policyAuditConfig is the configuration for network policy audit events. If unset, + reported defaults are used. + properties: + destination: + default: "null" + description: |- + destination is the location for policy log messages. + Regardless of this config, persistent logs will always be dumped to the host + at /var/log/ovn/ however + Additionally syslog output may be configured as follows. + Valid values are: + - "libc" -> to use the libc syslog() function of the host node's journdald process + - "udp:host:port" -> for sending syslog over UDP + - "unix:file" -> for using the UNIX domain socket directly + - "null" -> to discard all messages logged to syslog + The default is "null" + type: string + maxFileSize: + default: 50 + description: |- + maxFilesSize is the max size an ACL_audit log file is allowed to reach before rotation occurs + Units are in MB and the Default is 50MB + format: int32 + minimum: 1 + type: integer + maxLogFiles: + default: 5 + description: maxLogFiles specifies the maximum number + of ACL_audit log files that can be present. + format: int32 + minimum: 1 + type: integer + rateLimit: + default: 20 + description: |- + rateLimit is the approximate maximum number of messages to generate per-second per-node. If + unset the default of 20 msg/sec is used. + format: int32 + minimum: 1 + type: integer + syslogFacility: + default: local0 + description: syslogFacility the RFC5424 facility for generated + messages, e.g. "kern". Default is "local0" + type: string + type: object + routeAdvertisements: + description: |- + routeAdvertisements determines if the functionality to advertise cluster + network routes through a dynamic routing protocol, such as BGP, is + enabled or not. This functionality is configured through the + ovn-kubernetes RouteAdvertisements CRD. Requires the 'FRR' routing + capability provider to be enabled as an additional routing capability. + Allowed values are "Enabled", "Disabled" and ommited. When omitted, this + means the user has no opinion and the platform is left to choose + reasonable defaults. These defaults are subject to change over time. The + current default is "Disabled". + enum: + - "" + - Enabled + - Disabled + type: string + transport: + description: |- + transport sets the transport mode for pods on the default network. + Allowed values are "NoOverlay" and "Geneve". + "NoOverlay" avoids tunnel encapsulation, routing pod traffic directly between nodes. + "Geneve" encapsulates pod traffic using Geneve tunnels between nodes. + When omitted, this means the user has no opinion and the platform chooses + a reasonable default which is subject to change over time. + The current default is "Geneve". + "NoOverlay" can only be set at installation time and cannot be changed afterwards. + "Geneve" may be set explicitly at any time to lock in the current default. + enum: + - NoOverlay + - Geneve + type: string + x-kubernetes-validations: + - message: transport is immutable once set + rule: self == oldSelf + v4InternalSubnet: + description: |- + v4InternalSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is 100.64.0.0/16 + type: string + v6InternalSubnet: + description: |- + v6InternalSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is fd98::/64 + type: string + type: object + x-kubernetes-validations: + - message: routeAdvertisements must be Enabled when transport + is NoOverlay + rule: 'self.?transport.orValue('''') == ''NoOverlay'' ? self.?routeAdvertisements.orValue('''') + == ''Enabled'' : true' + - message: noOverlayConfig must be set if transport is NoOverlay, + and is forbidden otherwise + rule: 'self.?transport.orValue('''') == ''NoOverlay'' ? has(self.noOverlayConfig) + : !has(self.noOverlayConfig)' + - message: bgpManagedConfig is required when noOverlayConfig.routing + is Managed + rule: 'self.?noOverlayConfig.routing.orValue('''') == ''Managed'' + ? has(self.bgpManagedConfig) : true' + - message: transport can only be set to Geneve after installation + rule: '!has(self.transport) || self.transport == ''Geneve'' + || has(oldSelf.transport)' + - message: transport may not be removed once set + rule: '!has(oldSelf.transport) || has(self.transport)' + - message: noOverlayConfig may not be removed once set + rule: '!has(oldSelf.noOverlayConfig) || has(self.noOverlayConfig)' + type: + description: |- + type is the type of network + All NetworkTypes are supported except for NetworkTypeRaw + type: string + type: object + deployKubeProxy: + description: |- + deployKubeProxy specifies whether or not a standalone kube-proxy should + be deployed by the operator. Some network providers include kube-proxy + or similar functionality. If unset, the plugin will attempt to select + the correct value, which is false when ovn-kubernetes is used and true + otherwise. + type: boolean + disableMultiNetwork: + description: |- + disableMultiNetwork defaults to 'false' and this setting enables the pod multi-networking capability. + disableMultiNetwork when set to 'true' at cluster install time does not install the components, typically the Multus CNI and the network-attachment-definition CRD, + that enable the pod multi-networking capability. Setting the parameter to 'true' might be useful when you need install third-party CNI plugins, + but these plugins are not supported by Red Hat. Changing the parameter value as a postinstallation cluster task has no effect. + type: boolean + disableNetworkDiagnostics: + default: false + description: |- + disableNetworkDiagnostics specifies whether or not PodNetworkConnectivityCheck + CRs from a test pod to every node, apiserver and LB should be disabled or not. + If unset, this property defaults to 'false' and network diagnostics is enabled. + Setting this to 'true' would reduce the additional load of the pods performing the checks. + type: boolean + exportNetworkFlows: + description: |- + exportNetworkFlows enables and configures the export of network flow metadata from the pod network + by using protocols NetFlow, SFlow or IPFIX. Currently only supported on OVN-Kubernetes plugin. + If unset, flows will not be exported to any collector. + properties: + ipfix: + description: ipfix defines IPFIX configuration. + properties: + collectors: + description: ipfixCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + netFlow: + description: netFlow defines the NetFlow configuration. + properties: + collectors: + description: |- + netFlow defines the NetFlow collectors that will consume the flow data exported from OVS. + It is a list of strings formatted as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + sFlow: + description: sFlow defines the SFlow configuration. + properties: + collectors: + description: sFlowCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + type: object + kubeProxyConfig: + description: |- + kubeProxyConfig lets us configure desired proxy configuration, if + deployKubeProxy is true. If not specified, sensible defaults will be chosen by + OpenShift directly. + properties: + bindAddress: + description: |- + The address to "bind" on + Defaults to 0.0.0.0 + type: string + iptablesSyncPeriod: + description: |- + An internal kube-proxy parameter. In older releases of OCP, this sometimes needed to be adjusted + in large clusters for performance reasons, but this is no longer necessary, and there is no reason + to change this from the default value. + Default: 30s + type: string + proxyArguments: + additionalProperties: + description: ProxyArgumentList is a list of arguments to pass + to the kubeproxy process + items: + type: string + type: array + x-kubernetes-list-type: atomic + description: Any additional arguments to pass to the kubeproxy + process + type: object + type: object + logLevel: + default: Normal + description: |- + logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for their operands. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + managementState: + description: managementState indicates whether and how the operator + should manage the component + pattern: ^(Managed|Unmanaged|Force|Removed)$ + type: string + migration: + description: |- + migration enables and configures cluster network migration, for network changes + that cannot be made instantly. + properties: + features: + description: |- + features was previously used to configure which network plugin features + would be migrated in a network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + properties: + egressFirewall: + default: true + description: |- + egressFirewall specified whether or not the Egress Firewall configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + egressIP: + default: true + description: |- + egressIP specified whether or not the Egress IP configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + multicast: + default: true + description: |- + multicast specified whether or not the multicast configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + type: object + mode: + description: |- + mode indicates the mode of network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + enum: + - Live + - Offline + - "" + type: string + mtu: + description: |- + mtu contains the MTU migration configuration. Set this to allow changing + the MTU values for the default network. If unset, the operation of + changing the MTU for the default network will be rejected. + properties: + machine: + description: |- + machine contains MTU migration configuration for the machine's uplink. + Needs to be migrated along with the default network MTU unless the + current uplink MTU already accommodates the default network MTU. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + network: + description: |- + network contains information about MTU migration for the default network. + Migrations are only allowed to MTU values lower than the machine's uplink + MTU by the minimum appropriate offset. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + type: object + networkType: + description: |- + networkType was previously used when changing the default network type. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + type: string + type: object + x-kubernetes-validations: + - message: networkType migration in mode other than 'Live' may not + be configured at the same time as mtu migration + rule: '!has(self.mtu) || !has(self.networkType) || self.networkType + == "" || has(self.mode) && self.mode == ''Live''' + observedConfig: + description: |- + observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because + it is an input to the level for the operator + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + operatorLogLevel: + default: Normal + description: |- + operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for themselves. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + serviceNetwork: + description: |- + serviceNetwork is the ip address pool to use for Service IPs + Currently, all existing network providers only support a single value + here, but this is an array to allow for growth. + items: + type: string + type: array + x-kubernetes-list-type: atomic + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides overrides the final configuration that was computed by the operator. + Red Hat does not support the use of this field. + Misuse of this field could lead to unexpected behavior or conflict with other configuration options. + Seek guidance from the Red Hat support before using this field. + Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + useMultiNetworkPolicy: + description: |- + useMultiNetworkPolicy enables a controller which allows for + MultiNetworkPolicy objects to be used on additional networks as + created by Multus CNI. MultiNetworkPolicy are similar to NetworkPolicy + objects, but NetworkPolicy objects only apply to the primary interface. + With MultiNetworkPolicy, you can control the traffic that a pod can receive + over the secondary interfaces. If unset, this property defaults to 'false' + and MultiNetworkPolicy objects are ignored. If 'disableMultiNetwork' is + 'true' then the value of this field is ignored. + type: boolean + type: object + x-kubernetes-validations: + - message: invalid value for IPForwarding, valid values are 'Restricted' + or 'Global' + rule: '!has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig) || + !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding) + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == oldSelf.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Restricted'' || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Global''' + - message: Route advertisements cannot be Enabled if 'FRR' routing capability + provider is not available + rule: (has(self.additionalRoutingCapabilities) && ('FRR' in self.additionalRoutingCapabilities.providers)) + || !has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements) + || self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements != + 'Enabled' + status: + description: |- + NetworkStatus is detailed operator status, which is distilled + up to the Network clusteroperator object. + properties: + conditions: + description: conditions is a list of conditions and their status + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + generations: + description: generations are used to determine when an item needs + to be reconciled or has changed in a way that needs a reaction. + items: + description: GenerationStatus keeps track of the generation for + a given resource so that decisions about forced updates can be + made. + properties: + group: + description: group is the group of the thing you're tracking + type: string + hash: + description: hash is an optional field set for resources without + generation that are content sensitive like secrets and configmaps + type: string + lastGeneration: + description: lastGeneration is the last generation of the workload + controller involved + format: int64 + type: integer + name: + description: name is the name of the thing you're tracking + type: string + namespace: + description: namespace is where the thing you're tracking is + type: string + resource: + description: resource is the resource type of the thing you're + tracking + type: string + required: + - group + - name + - namespace + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - group + - resource + - namespace + - name + x-kubernetes-list-type: map + latestAvailableRevision: + description: latestAvailableRevision is the deploymentID of the most + recent deployment + format: int32 + type: integer + x-kubernetes-validations: + - message: must only increase + rule: self >= oldSelf + observedGeneration: + description: observedGeneration is the last generation change you've + dealt with + format: int64 + type: integer + readyReplicas: + description: readyReplicas indicates how many replicas are ready and + at the desired state + format: int32 + type: integer + version: + description: version is the level this availability applies to + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-OKD.crd.yaml similarity index 99% rename from vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks.crd.yaml rename to vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-OKD.crd.yaml index 60459deca7..85f957f0da 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-OKD.crd.yaml @@ -6,6 +6,7 @@ metadata: api.openshift.io/merged-by-featuregates: "true" include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: OKD name: networks.operator.openshift.io spec: group: operator.openshift.io diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-TechPreviewNoUpgrade.crd.yaml new file mode 100644 index 0000000000..e6a3bedceb --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-TechPreviewNoUpgrade.crd.yaml @@ -0,0 +1,1152 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/475 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: networks.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: Network + listKind: NetworkList + plural: networks + singular: network + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + Network describes the cluster's desired network configuration. It is + consumed by the cluster-network-operator. + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: NetworkSpec is the top-level network configuration object. + properties: + additionalNetworks: + description: |- + additionalNetworks is a list of extra networks to make available to pods + when multiple networks are enabled. + items: + description: |- + AdditionalNetworkDefinition configures an extra network that is available but not + created by default. Instead, pods must request them by name. + type must be specified, along with exactly one "Config" that matches the type. + properties: + name: + description: |- + name is the name of the network. This will be populated in the resulting CRD + This must be unique. + type: string + namespace: + description: |- + namespace is the namespace of the network. This will be populated in the resulting CRD + If not given the network will be created in the default namespace. + type: string + rawCNIConfig: + description: |- + rawCNIConfig is the raw CNI configuration json to create in the + NetworkAttachmentDefinition CRD + type: string + simpleMacvlanConfig: + description: simpleMacvlanConfig configures the macvlan interface + in case of type:NetworkTypeSimpleMacvlan + properties: + ipamConfig: + description: ipamConfig configures IPAM module will be used + for IP Address Management (IPAM). + properties: + staticIPAMConfig: + description: staticIPAMConfig configures the static + IP address in case of type:IPAMTypeStatic + properties: + addresses: + description: addresses configures IP address for + the interface + items: + description: StaticIPAMAddresses provides IP address + and Gateway for static IPAM addresses + properties: + address: + description: address is the IP address in + CIDR format + type: string + gateway: + description: gateway is IP inside of subnet + to designate as the gateway + type: string + type: object + type: array + x-kubernetes-list-type: atomic + dns: + description: dns configures DNS for the interface + properties: + domain: + description: domain configures the domainname + the local domain used for short hostname lookups + type: string + nameservers: + description: nameservers points DNS servers + for IP lookup + items: + type: string + type: array + x-kubernetes-list-type: atomic + search: + description: search configures priority ordered + search domains for short hostname lookups + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + routes: + description: routes configures IP routes for the + interface + items: + description: StaticIPAMRoutes provides Destination/Gateway + pairs for static IPAM routes + properties: + destination: + description: destination points the IP route + destination + type: string + gateway: + description: |- + gateway is the route's next-hop IP address + If unset, a default gateway is assumed (as determined by the CNI plugin). + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: + description: |- + type is the type of IPAM module will be used for IP Address Management(IPAM). + The supported values are IPAMTypeDHCP, IPAMTypeStatic + type: string + type: object + master: + description: |- + master is the host interface to create the macvlan interface from. + If not specified, it will be default route interface + type: string + mode: + description: 'mode is the macvlan mode: bridge, private, + vepa, passthru. The default is bridge' + type: string + mtu: + description: |- + mtu is the mtu to use for the macvlan interface. if unset, host's + kernel will select the value. + format: int32 + minimum: 0 + type: integer + type: object + type: + description: |- + type is the type of network + The supported values are NetworkTypeRaw, NetworkTypeSimpleMacvlan + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + additionalRoutingCapabilities: + description: |- + additionalRoutingCapabilities describes components and relevant + configuration providing additional routing capabilities. When set, it + enables such components and the usage of the routing capabilities they + provide for the machine network. Upstream operators, like MetalLB + operator, requiring these capabilities may rely on, or automatically set + this attribute. Network plugins may leverage advanced routing + capabilities acquired through the enablement of these components but may + require specific configuration on their side to do so; refer to their + respective documentation and configuration options. + properties: + providers: + description: |- + providers is a set of enabled components that provide additional routing + capabilities. Entries on this list must be unique. The only valid value + is currrently "FRR" which provides FRR routing capabilities through the + deployment of FRR. + items: + description: RoutingCapabilitiesProvider is a component providing + routing capabilities. + enum: + - FRR + type: string + maxItems: 1 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - rule: self.all(x, self.exists_one(y, x == y)) + required: + - providers + type: object + clusterNetwork: + description: |- + clusterNetwork is the IP address pool to use for pod IPs. + Some network providers support multiple ClusterNetworks. + Others only support one. This is equivalent to the cluster-cidr. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + defaultNetwork: + description: defaultNetwork is the "default" network that all pods + will receive + properties: + openshiftSDNConfig: + description: |- + openshiftSDNConfig was previously used to configure the openshift-sdn plugin. + DEPRECATED: OpenShift SDN is no longer supported. + properties: + enableUnidling: + description: |- + enableUnidling controls whether or not the service proxy will support idling + and unidling of services. By default, unidling is enabled. + type: boolean + mode: + description: mode is one of "Multitenant", "Subnet", or "NetworkPolicy" + type: string + mtu: + description: |- + mtu is the mtu to use for the tunnel interface. Defaults to 1450 if unset. + This must be 50 bytes smaller than the machine's uplink. + format: int32 + minimum: 0 + type: integer + useExternalOpenvswitch: + description: |- + useExternalOpenvswitch used to control whether the operator would deploy an OVS + DaemonSet itself or expect someone else to start OVS. As of 4.6, OVS is always + run as a system service, and this flag is ignored. + type: boolean + vxlanPort: + description: vxlanPort is the port to use for all vxlan packets. + The default is 4789. + format: int32 + minimum: 0 + type: integer + type: object + ovnKubernetesConfig: + description: ovnKubernetesConfig configures the ovn-kubernetes + plugin. + properties: + bgpManagedConfig: + description: |- + bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) + in no-overlay mode that specify routing="Managed" in their noOverlayConfig. + It is required when noOverlayConfig.routing is set to "Managed". + When omitted, this means the user does not configure BGP for managed routing. + This field can be set at installation time or on day 2, and can be modified at any time. + properties: + asNumber: + default: 64512 + description: |- + asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) + to be used in the generated FRR configuration. + Valid values are 1 to 4294967295. + When omitted, this defaults to 64512. + format: int64 + maximum: 4294967295 + minimum: 1 + type: integer + bgpTopology: + description: |- + bgpTopology defines the BGP topology to be used. + Allowed values are "FullMesh". + When set to "FullMesh", every node peers directly with every other node via BGP. + This field is required when BGPManagedConfig is specified. + enum: + - FullMesh + type: string + required: + - bgpTopology + type: object + egressIPConfig: + description: egressIPConfig holds the configuration for EgressIP + options. + properties: + reachabilityTotalTimeoutSeconds: + description: |- + reachabilityTotalTimeout configures the EgressIP node reachability check total timeout in seconds. + If the EgressIP node cannot be reached within this timeout, the node is declared down. + Setting a large value may cause the EgressIP feature to react slowly to node changes. + In particular, it may react slowly for EgressIP nodes that really have a genuine problem and are unreachable. + When omitted, this means the user has no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + The current default is 1 second. + A value of 0 disables the EgressIP node's reachability check. + format: int32 + maximum: 60 + minimum: 0 + type: integer + type: object + gatewayConfig: + description: gatewayConfig holds the configuration for node + gateway options. + properties: + ipForwarding: + description: |- + ipForwarding controls IP forwarding for all traffic on OVN-Kubernetes managed interfaces (such as br-ex). + By default this is set to Restricted, and Kubernetes related traffic is still forwarded appropriately, but other + IP traffic will not be routed by the OCP node. If there is a desire to allow the host to forward traffic across + OVN-Kubernetes managed interfaces, then set this field to "Global". + The supported values are "Restricted" and "Global". + type: string + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv4 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV4 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /29). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is 169.254.0.0/17 + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 4 + - message: subnet must be in the range /0 to /29 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 29 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > + 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When omitted, this means no opinion and the default + configuration is used. Check individual members fields within ipv6 for details of default values. + properties: + internalMasqueradeSubnet: + description: |- + internalMasqueradeSubnet contains the masquerade addresses in IPV6 CIDR format used internally by + ovn-kubernetes to enable host to service traffic. Each host in the cluster is configured with these + addresses, as well as the shared gateway bridge interface. The values can be changed after + installation. The subnet chosen should not overlap with other networks specified for + OVN-Kubernetes as well as other networks used on the host. Additionally the subnet must + be large enough to accommodate 6 IPs (maximum prefix length /125). + When omitted, this means no opinion and the platform is left to choose a reasonable default which is subject to change over time. + The current default subnet is fd69::/112 + Note that IPV6 dual addresses are not permitted + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == + 6 + - message: subnet must be in the range /0 to /125 + inclusive + rule: isCIDR(self) && cidr(self).prefixLength() + <= 125 + type: object + routingViaHost: + default: false + description: |- + routingViaHost allows pod egress traffic to exit via the ovn-k8s-mp0 management port + into the host before sending it out. If this is not set, traffic will always egress directly + from OVN to outside without touching the host stack. Setting this to true means hardware + offload will not be supported. Default is false if GatewayConfig is specified. + type: boolean + type: object + genevePort: + description: |- + geneve port is the UDP port to be used by geneve encapulation. + Default is 6081 + format: int32 + minimum: 1 + type: integer + hybridOverlayConfig: + description: |- + hybridOverlayConfig configures an additional overlay network for peers that are + not using OVN. + properties: + hybridClusterNetwork: + description: hybridClusterNetwork defines a network space + given to nodes on an additional overlay network. + items: + description: |- + ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size + HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If + the HostPrefix field is not used by the plugin, it can be left unset. + Not all network providers support multiple ClusterNetworks + properties: + cidr: + type: string + hostPrefix: + format: int32 + minimum: 0 + type: integer + type: object + type: array + x-kubernetes-list-type: atomic + hybridOverlayVXLANPort: + description: |- + hybridOverlayVXLANPort defines the VXLAN port number to be used by the additional overlay network. + Default is 4789 + format: int32 + type: integer + type: object + ipsecConfig: + default: + mode: Disabled + description: |- + ipsecConfig enables and configures IPsec for pods on the pod network within the + cluster. + properties: + full: + description: |- + full defines configuration parameters for the IPsec `Full` mode. + This is permitted only when mode is configured with `Full`, + and forbidden otherwise. + minProperties: 1 + properties: + encapsulation: + description: |- + encapsulation option to configure libreswan on how inter-pod traffic across nodes + are encapsulated to handle NAT traversal. When configured it uses UDP port 4500 + for the encapsulation. + Valid values are Always, Auto and omitted. + Always means enable UDP encapsulation regardless of whether NAT is detected. + Auto means enable UDP encapsulation based on the detection of NAT. + When omitted, this means no opinion and the platform is left to choose a reasonable + default, which is subject to change over time. The current default is Auto. + enum: + - Always + - Auto + type: string + type: object + mode: + description: |- + mode defines the behaviour of the ipsec configuration within the platform. + Valid values are `Disabled`, `External` and `Full`. + When 'Disabled', ipsec will not be enabled at the node level. + When 'External', ipsec is enabled on the node level but requires the user to configure the secure communication parameters. + This mode is for external secure communications and the configuration can be done using the k8s-nmstate operator. + When 'Full', ipsec is configured on the node level and inter-pod secure communication within the cluster is configured. + Note with `Full`, if ipsec is desired for communication with external (to the cluster) entities (such as storage arrays), + this is left to the user to configure. + enum: + - Disabled + - External + - Full + type: string + type: object + x-kubernetes-validations: + - message: ipsecConfig.mode is required + rule: self == oldSelf || has(self.mode) + - message: full is forbidden when mode is not Full + rule: 'has(self.mode) && self.mode == ''Full'' ? true : + !has(self.full)' + ipv4: + description: |- + ipv4 allows users to configure IP settings for IPv4 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The current default value is 100.64.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The current default subnet is 100.88.0.0/16 + The subnet must be large enough to accommodate one IP per node in your cluster + The value must be in proper IPV4 CIDR format + maxLength: 18 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV4 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 4 + - message: subnet must be in the range /0 to /30 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 30 + - message: first IP address octet must not be 0 + rule: isCIDR(self) && int(self.split('.')[0]) > 0 + type: object + ipv6: + description: |- + ipv6 allows users to configure IP settings for IPv6 connections. When ommitted, + this means no opinions and the default configuration is used. Check individual + fields within ipv4 for details of default values. + properties: + internalJoinSubnet: + description: |- + internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default value is fd98::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + internalTransitSwitchSubnet: + description: |- + internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally + by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect + architecture that connects the cluster routers on each node together to enable + east west traffic. The subnet chosen should not overlap with other networks + specified for OVN-Kubernetes as well as other networks used on the host. + When ommitted, this means no opinion and the platform is left to choose a reasonable + default which is subject to change over time. + The subnet must be large enough to accommodate one IP per node in your cluster + The current default subnet is fd97::/64 + The value must be in proper IPV6 CIDR format + Note that IPV6 dual addresses are not permitted + maxLength: 48 + type: string + x-kubernetes-validations: + - message: Subnet must be in valid IPV6 CIDR format + rule: isCIDR(self) && cidr(self).ip().family() == 6 + - message: subnet must be in the range /0 to /125 inclusive + rule: isCIDR(self) && cidr(self).prefixLength() <= 125 + type: object + mtu: + description: |- + mtu is the MTU to use for the tunnel interface. This must be 100 + bytes smaller than the uplink mtu. + Default is 1400 + format: int32 + minimum: 0 + type: integer + noOverlayConfig: + description: |- + noOverlayConfig contains configuration for no-overlay mode. + This configuration applies to the default network only. + It is required when transport is "NoOverlay". + When omitted, this means the user does not configure no-overlay mode options. + properties: + outboundSNAT: + description: |- + outboundSNAT defines the SNAT behavior for outbound traffic from pods. + Allowed values are "Enabled" and "Disabled". + When set to "Enabled", SNAT is performed on outbound traffic from pods. + When set to "Disabled", SNAT is not performed and pod IPs are preserved in outbound traffic. + This field is required when the network operates in no-overlay mode. + This field can be set to any value at installation time and can be changed afterwards. + enum: + - Enabled + - Disabled + type: string + routing: + description: |- + routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. + Allowed values are "Managed" and "Unmanaged". + When set to "Managed", OVN-Kubernetes manages the pod network routing configuration through BGP. + When set to "Unmanaged", users are responsible for configuring the pod network routing. + This field is required when the network operates in no-overlay mode. + This field is immutable once set. + enum: + - Managed + - Unmanaged + type: string + x-kubernetes-validations: + - message: routing is immutable once set + rule: self == oldSelf + required: + - outboundSNAT + - routing + type: object + policyAuditConfig: + description: |- + policyAuditConfig is the configuration for network policy audit events. If unset, + reported defaults are used. + properties: + destination: + default: "null" + description: |- + destination is the location for policy log messages. + Regardless of this config, persistent logs will always be dumped to the host + at /var/log/ovn/ however + Additionally syslog output may be configured as follows. + Valid values are: + - "libc" -> to use the libc syslog() function of the host node's journdald process + - "udp:host:port" -> for sending syslog over UDP + - "unix:file" -> for using the UNIX domain socket directly + - "null" -> to discard all messages logged to syslog + The default is "null" + type: string + maxFileSize: + default: 50 + description: |- + maxFilesSize is the max size an ACL_audit log file is allowed to reach before rotation occurs + Units are in MB and the Default is 50MB + format: int32 + minimum: 1 + type: integer + maxLogFiles: + default: 5 + description: maxLogFiles specifies the maximum number + of ACL_audit log files that can be present. + format: int32 + minimum: 1 + type: integer + rateLimit: + default: 20 + description: |- + rateLimit is the approximate maximum number of messages to generate per-second per-node. If + unset the default of 20 msg/sec is used. + format: int32 + minimum: 1 + type: integer + syslogFacility: + default: local0 + description: syslogFacility the RFC5424 facility for generated + messages, e.g. "kern". Default is "local0" + type: string + type: object + routeAdvertisements: + description: |- + routeAdvertisements determines if the functionality to advertise cluster + network routes through a dynamic routing protocol, such as BGP, is + enabled or not. This functionality is configured through the + ovn-kubernetes RouteAdvertisements CRD. Requires the 'FRR' routing + capability provider to be enabled as an additional routing capability. + Allowed values are "Enabled", "Disabled" and ommited. When omitted, this + means the user has no opinion and the platform is left to choose + reasonable defaults. These defaults are subject to change over time. The + current default is "Disabled". + enum: + - "" + - Enabled + - Disabled + type: string + transport: + description: |- + transport sets the transport mode for pods on the default network. + Allowed values are "NoOverlay" and "Geneve". + "NoOverlay" avoids tunnel encapsulation, routing pod traffic directly between nodes. + "Geneve" encapsulates pod traffic using Geneve tunnels between nodes. + When omitted, this means the user has no opinion and the platform chooses + a reasonable default which is subject to change over time. + The current default is "Geneve". + "NoOverlay" can only be set at installation time and cannot be changed afterwards. + "Geneve" may be set explicitly at any time to lock in the current default. + enum: + - NoOverlay + - Geneve + type: string + x-kubernetes-validations: + - message: transport is immutable once set + rule: self == oldSelf + v4InternalSubnet: + description: |- + v4InternalSubnet is a v4 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is 100.64.0.0/16 + type: string + v6InternalSubnet: + description: |- + v6InternalSubnet is a v6 subnet used internally by ovn-kubernetes in case the + default one is being already used by something else. It must not overlap with + any other subnet being used by OpenShift or by the node network. The size of the + subnet must be larger than the number of nodes. + Default is fd98::/64 + type: string + type: object + x-kubernetes-validations: + - message: routeAdvertisements must be Enabled when transport + is NoOverlay + rule: 'self.?transport.orValue('''') == ''NoOverlay'' ? self.?routeAdvertisements.orValue('''') + == ''Enabled'' : true' + - message: noOverlayConfig must be set if transport is NoOverlay, + and is forbidden otherwise + rule: 'self.?transport.orValue('''') == ''NoOverlay'' ? has(self.noOverlayConfig) + : !has(self.noOverlayConfig)' + - message: bgpManagedConfig is required when noOverlayConfig.routing + is Managed + rule: 'self.?noOverlayConfig.routing.orValue('''') == ''Managed'' + ? has(self.bgpManagedConfig) : true' + - message: transport can only be set to Geneve after installation + rule: '!has(self.transport) || self.transport == ''Geneve'' + || has(oldSelf.transport)' + - message: transport may not be removed once set + rule: '!has(oldSelf.transport) || has(self.transport)' + - message: noOverlayConfig may not be removed once set + rule: '!has(oldSelf.noOverlayConfig) || has(self.noOverlayConfig)' + type: + description: |- + type is the type of network + All NetworkTypes are supported except for NetworkTypeRaw + type: string + type: object + deployKubeProxy: + description: |- + deployKubeProxy specifies whether or not a standalone kube-proxy should + be deployed by the operator. Some network providers include kube-proxy + or similar functionality. If unset, the plugin will attempt to select + the correct value, which is false when ovn-kubernetes is used and true + otherwise. + type: boolean + disableMultiNetwork: + description: |- + disableMultiNetwork defaults to 'false' and this setting enables the pod multi-networking capability. + disableMultiNetwork when set to 'true' at cluster install time does not install the components, typically the Multus CNI and the network-attachment-definition CRD, + that enable the pod multi-networking capability. Setting the parameter to 'true' might be useful when you need install third-party CNI plugins, + but these plugins are not supported by Red Hat. Changing the parameter value as a postinstallation cluster task has no effect. + type: boolean + disableNetworkDiagnostics: + default: false + description: |- + disableNetworkDiagnostics specifies whether or not PodNetworkConnectivityCheck + CRs from a test pod to every node, apiserver and LB should be disabled or not. + If unset, this property defaults to 'false' and network diagnostics is enabled. + Setting this to 'true' would reduce the additional load of the pods performing the checks. + type: boolean + exportNetworkFlows: + description: |- + exportNetworkFlows enables and configures the export of network flow metadata from the pod network + by using protocols NetFlow, SFlow or IPFIX. Currently only supported on OVN-Kubernetes plugin. + If unset, flows will not be exported to any collector. + properties: + ipfix: + description: ipfix defines IPFIX configuration. + properties: + collectors: + description: ipfixCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + netFlow: + description: netFlow defines the NetFlow configuration. + properties: + collectors: + description: |- + netFlow defines the NetFlow collectors that will consume the flow data exported from OVS. + It is a list of strings formatted as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + sFlow: + description: sFlow defines the SFlow configuration. + properties: + collectors: + description: sFlowCollectors is list of strings formatted + as ip:port with a maximum of ten items + items: + pattern: ^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ + type: string + maxItems: 10 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + type: object + type: object + kubeProxyConfig: + description: |- + kubeProxyConfig lets us configure desired proxy configuration, if + deployKubeProxy is true. If not specified, sensible defaults will be chosen by + OpenShift directly. + properties: + bindAddress: + description: |- + The address to "bind" on + Defaults to 0.0.0.0 + type: string + iptablesSyncPeriod: + description: |- + An internal kube-proxy parameter. In older releases of OCP, this sometimes needed to be adjusted + in large clusters for performance reasons, but this is no longer necessary, and there is no reason + to change this from the default value. + Default: 30s + type: string + proxyArguments: + additionalProperties: + description: ProxyArgumentList is a list of arguments to pass + to the kubeproxy process + items: + type: string + type: array + x-kubernetes-list-type: atomic + description: Any additional arguments to pass to the kubeproxy + process + type: object + type: object + logLevel: + default: Normal + description: |- + logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for their operands. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + managementState: + description: managementState indicates whether and how the operator + should manage the component + pattern: ^(Managed|Unmanaged|Force|Removed)$ + type: string + migration: + description: |- + migration enables and configures cluster network migration, for network changes + that cannot be made instantly. + properties: + features: + description: |- + features was previously used to configure which network plugin features + would be migrated in a network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + properties: + egressFirewall: + default: true + description: |- + egressFirewall specified whether or not the Egress Firewall configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + egressIP: + default: true + description: |- + egressIP specified whether or not the Egress IP configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + multicast: + default: true + description: |- + multicast specified whether or not the multicast configuration was migrated. + DEPRECATED: network type migration is no longer supported. + type: boolean + type: object + mode: + description: |- + mode indicates the mode of network type migration. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + enum: + - Live + - Offline + - "" + type: string + mtu: + description: |- + mtu contains the MTU migration configuration. Set this to allow changing + the MTU values for the default network. If unset, the operation of + changing the MTU for the default network will be rejected. + properties: + machine: + description: |- + machine contains MTU migration configuration for the machine's uplink. + Needs to be migrated along with the default network MTU unless the + current uplink MTU already accommodates the default network MTU. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + network: + description: |- + network contains information about MTU migration for the default network. + Migrations are only allowed to MTU values lower than the machine's uplink + MTU by the minimum appropriate offset. + properties: + from: + description: from is the MTU to migrate from. + format: int32 + minimum: 0 + type: integer + to: + description: to is the MTU to migrate to. + format: int32 + minimum: 0 + type: integer + type: object + type: object + networkType: + description: |- + networkType was previously used when changing the default network type. + DEPRECATED: network type migration is no longer supported, and setting + this to a non-empty value will result in the network operator rejecting + the configuration. + type: string + type: object + x-kubernetes-validations: + - message: networkType migration in mode other than 'Live' may not + be configured at the same time as mtu migration + rule: '!has(self.mtu) || !has(self.networkType) || self.networkType + == "" || has(self.mode) && self.mode == ''Live''' + observedConfig: + description: |- + observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because + it is an input to the level for the operator + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + operatorLogLevel: + default: Normal + description: |- + operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a + simple way to manage coarse grained logging choices that operators have to interpret for themselves. + + Valid values are: "Normal", "Debug", "Trace", "TraceAll". + Defaults to "Normal". + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + type: string + serviceNetwork: + description: |- + serviceNetwork is the ip address pool to use for Service IPs + Currently, all existing network providers only support a single value + here, but this is an array to allow for growth. + items: + type: string + type: array + x-kubernetes-list-type: atomic + unsupportedConfigOverrides: + description: |- + unsupportedConfigOverrides overrides the final configuration that was computed by the operator. + Red Hat does not support the use of this field. + Misuse of this field could lead to unexpected behavior or conflict with other configuration options. + Seek guidance from the Red Hat support before using this field. + Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + useMultiNetworkPolicy: + description: |- + useMultiNetworkPolicy enables a controller which allows for + MultiNetworkPolicy objects to be used on additional networks as + created by Multus CNI. MultiNetworkPolicy are similar to NetworkPolicy + objects, but NetworkPolicy objects only apply to the primary interface. + With MultiNetworkPolicy, you can control the traffic that a pod can receive + over the secondary interfaces. If unset, this property defaults to 'false' + and MultiNetworkPolicy objects are ignored. If 'disableMultiNetwork' is + 'true' then the value of this field is ignored. + type: boolean + type: object + x-kubernetes-validations: + - message: invalid value for IPForwarding, valid values are 'Restricted' + or 'Global' + rule: '!has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig) || + !has(self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding) + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == oldSelf.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Restricted'' || self.defaultNetwork.ovnKubernetesConfig.gatewayConfig.ipForwarding + == ''Global''' + - message: Route advertisements cannot be Enabled if 'FRR' routing capability + provider is not available + rule: (has(self.additionalRoutingCapabilities) && ('FRR' in self.additionalRoutingCapabilities.providers)) + || !has(self.defaultNetwork) || !has(self.defaultNetwork.ovnKubernetesConfig) + || !has(self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements) + || self.defaultNetwork.ovnKubernetesConfig.routeAdvertisements != + 'Enabled' + status: + description: |- + NetworkStatus is detailed operator status, which is distilled + up to the Network clusteroperator object. + properties: + conditions: + description: conditions is a list of conditions and their status + items: + description: OperatorCondition is just the standard condition fields. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + type: string + reason: + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + generations: + description: generations are used to determine when an item needs + to be reconciled or has changed in a way that needs a reaction. + items: + description: GenerationStatus keeps track of the generation for + a given resource so that decisions about forced updates can be + made. + properties: + group: + description: group is the group of the thing you're tracking + type: string + hash: + description: hash is an optional field set for resources without + generation that are content sensitive like secrets and configmaps + type: string + lastGeneration: + description: lastGeneration is the last generation of the workload + controller involved + format: int64 + type: integer + name: + description: name is the name of the thing you're tracking + type: string + namespace: + description: namespace is where the thing you're tracking is + type: string + resource: + description: resource is the resource type of the thing you're + tracking + type: string + required: + - group + - name + - namespace + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - group + - resource + - namespace + - name + x-kubernetes-list-type: map + latestAvailableRevision: + description: latestAvailableRevision is the deploymentID of the most + recent deployment + format: int32 + type: integer + x-kubernetes-validations: + - message: must only increase + rule: self >= oldSelf + observedGeneration: + description: observedGeneration is the last generation change you've + dealt with + format: int64 + type: integer + readyReplicas: + description: readyReplicas indicates how many replicas are ready and + at the desired state + format: int32 + type: integer + version: + description: version is the level this availability applies to + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-Default.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-Default.crd.yaml index 2e65e97c84..58dcee7c30 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-Default.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-Default.crd.yaml @@ -46,6 +46,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -657,6 +749,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1259,6 +1485,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-OKD.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-OKD.crd.yaml index 1d16002284..eaffd23a32 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_80_machine-config_01_machineconfigurations-OKD.crd.yaml @@ -46,6 +46,98 @@ spec: description: spec is the specification of the desired behavior of the Machine Config Operator properties: + bootImageSkewEnforcement: + description: |- + bootImageSkewEnforcement allows an admin to configure how boot image version skew is + enforced on the cluster. + When omitted, this will default to Automatic for clusters that support automatic boot image updates. + For clusters that do not support automatic boot image updates, cluster upgrades will be disabled until + a skew enforcement mode has been specified. + When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed + acceptable for the current release payload. + properties: + manual: + description: |- + manual describes the current boot image of the cluster. + This should be set to the oldest boot image used amongst all machine resources in the cluster. + This must include either the RHCOS version of the boot image or the OCP release version which shipped with that + RHCOS boot image. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Manual and None. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''Manual'') ? has(self.manual) + : !has(self.manual)' failedRevisionLimit: description: |- failedRevisionLimit is the number of failed static pod installer revisions to keep on disk and in the api @@ -657,6 +749,140 @@ spec: description: status is the most recently observed status of the Machine Config Operator properties: + bootImageSkewEnforcementStatus: + description: |- + bootImageSkewEnforcementStatus reflects what the latest cluster-validated boot image skew enforcement + configuration is and will be used by Machine Config Controller while performing boot image skew enforcement. + When omitted, the MCO has no knowledge of how to enforce boot image skew. When the MCO does not know how + boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically + determine skew enforcement or there is an explicit skew enforcement configuration provided in the + spec.bootImageSkewEnforcement field. + properties: + automatic: + description: |- + automatic describes the current boot image of the cluster. + This will be populated by the MCO when performing boot image updates. This value will be compared against + the cluster's skew limit to determine skew compliance. + Required when mode is set to "Automatic" and forbidden otherwise. + minProperties: 1 + properties: + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + type: object + x-kubernetes-validations: + - message: at least one of ocpVersion or rhcosVersion is required + rule: has(self.ocpVersion) || has(self.rhcosVersion) + manual: + description: |- + manual describes the current boot image of the cluster. + This will be populated by the MCO using the values provided in the spec.bootImageSkewEnforcement.manual field. + This value will be compared against the cluster's skew limit to determine skew compliance. + Required when mode is set to "Manual" and forbidden otherwise. + properties: + mode: + description: |- + mode is used to configure which boot image field is defined in Manual mode. + Valid values are OCPVersion and RHCOSVersion. + OCPVersion means that the cluster admin is expected to set the OCP version associated with the last boot image update + in the OCPVersion field. + RHCOSVersion means that the cluster admin is expected to set the RHCOS version associated with the last boot image update + in the RHCOSVersion field. + This field is required. + enum: + - OCPVersion + - RHCOSVersion + type: string + ocpVersion: + description: |- + ocpVersion provides a string which represents the OCP version of the boot image. + This field must match the OCP semver compatible format of x.y.z. This field must be between + 5 and 10 characters long. + Required when mode is set to "OCPVersion" and forbidden otherwise. + maxLength: 10 + minLength: 5 + type: string + x-kubernetes-validations: + - message: ocpVersion must match the OCP semver compatible + format of x.y.z + rule: self.matches('^[0-9]+\\.[0-9]+\\.[0-9]+$') + rhcosVersion: + description: |- + rhcosVersion provides a string which represents the RHCOS version of the boot image + This field must match rhcosVersion formatting of [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] or the legacy + format of [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber]. This field must be between + 14 and 21 characters long. + Required when mode is set to "RHCOSVersion" and forbidden otherwise. + maxLength: 21 + minLength: 14 + type: string + x-kubernetes-validations: + - message: rhcosVersion must match format [major].[minor].[datestamp(YYYYMMDD)]-[buildnumber] + or must match legacy format [major].[minor].[timestamp(YYYYMMDDHHmm)]-[buildnumber] + rule: self.matches('^[0-9]+\\.[0-9]+\\.([0-9]{8}|[0-9]{12})-[0-9]+$') + required: + - mode + type: object + x-kubernetes-validations: + - message: ocpVersion is required when mode is OCPVersion, and + forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''OCPVersion'') ? has(self.ocpVersion) + : !has(self.ocpVersion)' + - message: rhcosVersion is required when mode is RHCOSVersion, + and forbidden otherwise + rule: 'has(self.mode) && (self.mode ==''RHCOSVersion'') ? has(self.rhcosVersion) + : !has(self.rhcosVersion)' + mode: + description: |- + mode determines the underlying behavior of skew enforcement mechanism. + Valid values are Automatic, Manual and None. + Automatic means that the MCO will perform boot image updates and store the + OCP & RHCOS version associated with the last boot image update in the automatic field. + Manual means that the cluster admin is expected to perform manual boot image updates and store the OCP + & RHCOS version associated with the last boot image update in the manual field. + In Automatic and Manual mode, the MCO will prevent upgrades when the boot image skew exceeds the + skew limit described by the release image. + None means that the MCO will no longer monitor the boot image skew. This may affect + the cluster's ability to scale. + This field is required. + enum: + - Automatic + - Manual + - None + type: string + required: + - mode + type: object + x-kubernetes-validations: + - message: automatic is required when mode is Automatic, and forbidden + otherwise + rule: 'has(self.mode) && (self.mode == ''Automatic'') ? has(self.automatic) + : !has(self.automatic)' + - message: manual is required when mode is Manual, and forbidden otherwise + rule: 'has(self.mode) && (self.mode == ''Manual'') ? has(self.manual) + : !has(self.manual)' conditions: description: conditions is a list of conditions and their status items: @@ -1259,6 +1485,32 @@ spec: required: - spec type: object + x-kubernetes-validations: + - message: when skew enforcement is in Automatic mode, a boot image configuration + is required + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() + : true' + - message: when skew enforcement is in Automatic mode, managedBootImages.machineManagers + must not be an empty list + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) + > 0 : true' + - message: when skew enforcement is in Automatic mode, any MachineAPI MachineSet + MachineManager must use selection mode 'All' + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, + m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io'') + || self.spec.managedBootImages.machineManagers.exists(m, m.resource == + ''machinesets'' && m.apiGroup == ''machine.openshift.io'' && m.selection.mode + == ''All'') : true' + - message: when skew enforcement is in Automatic mode, managedBootImagesStatus + must contain a MachineManager opting in all MachineAPI MachineSets + rule: 'self.?status.bootImageSkewEnforcementStatus.mode.orValue("") == ''Automatic'' + ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || + self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode + == ''All'' && m.resource == ''machinesets'' && m.apiGroup == ''machine.openshift.io''): + true' served: true storage: true subresources: diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go index 3bc6b81de4..3d3c8f4f82 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go @@ -390,6 +390,22 @@ func (in *AzureDiskEncryptionSet) DeepCopy() *AzureDiskEncryptionSet { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BGPManagedConfig) DeepCopyInto(out *BGPManagedConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPManagedConfig. +func (in *BGPManagedConfig) DeepCopy() *BGPManagedConfig { + if in == nil { + return nil + } + out := new(BGPManagedConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BootImageSkewEnforcementConfig) DeepCopyInto(out *BootImageSkewEnforcementConfig) { *out = *in @@ -3665,6 +3681,22 @@ func (in *NetworkStatus) DeepCopy() *NetworkStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NoOverlayConfig) DeepCopyInto(out *NoOverlayConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NoOverlayConfig. +func (in *NoOverlayConfig) DeepCopy() *NoOverlayConfig { + if in == nil { + return nil + } + out := new(NoOverlayConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NodeDisruptionPolicyClusterStatus) DeepCopyInto(out *NodeDisruptionPolicyClusterStatus) { *out = *in @@ -4158,6 +4190,8 @@ func (in *OVNKubernetesConfig) DeepCopyInto(out *OVNKubernetesConfig) { *out = new(IPv6OVNKubernetesConfig) **out = **in } + out.NoOverlayConfig = in.NoOverlayConfig + out.BGPManagedConfig = in.BGPManagedConfig return } diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml index 51a758804d..aaf0972908 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml @@ -69,6 +69,7 @@ clustercsidrivers.operator.openshift.io: Capability: "" Category: "" FeatureGates: + - AWSEuropeanSovereignCloudInstall - VSphereConfigurableMaxAllowedBlockVolumesPerNode FilenameOperatorName: csi-driver FilenameOperatorOrdering: "01" @@ -175,7 +176,8 @@ ingresscontrollers.operator.openshift.io: CRDName: ingresscontrollers.operator.openshift.io Capability: Ingress Category: "" - FeatureGates: [] + FeatureGates: + - IngressControllerDynamicConfigurationManager FilenameOperatorName: ingress FilenameOperatorOrdering: "00" FilenameRunLevel: "0000_50" @@ -305,8 +307,7 @@ machineconfigurations.operator.openshift.io: FeatureGates: - BootImageSkewEnforcement - IrreconcilableMachineConfig - - ManagedBootImages - - ManagedBootImages+ManagedBootImagesCPMS + - ManagedBootImagesCPMS FilenameOperatorName: machine-config FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_80" @@ -327,7 +328,8 @@ networks.operator.openshift.io: CRDName: networks.operator.openshift.io Capability: "" Category: "" - FeatureGates: [] + FeatureGates: + - NoOverlayMode FilenameOperatorName: network FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_70" diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go index 64aac26eb3..c3ed726028 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go @@ -466,7 +466,7 @@ func (Theme) SwaggerDoc() map[string]string { var map_AWSCSIDriverConfigSpec = map[string]string{ "": "AWSCSIDriverConfigSpec defines properties that can be configured for the AWS CSI driver.", - "kmsKeyARN": "kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key.", + "kmsKeyARN": "kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, rather than the default KMS key used by AWS. The value may be either the ARN or Alias ARN of a KMS key.\n\nThe ARN must follow the format: arn::kms:::(key|alias)/, where: is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), is the AWS region, is a 12-digit numeric identifier for the AWS account, is the KMS key ID or alias name.", "efsVolumeMetrics": "efsVolumeMetrics sets the configuration for collecting metrics from EFS volumes used by the EFS CSI Driver.", } @@ -1121,6 +1121,7 @@ var map_IngressControllerTuningOptions = map[string]string{ "healthCheckInterval": "healthCheckInterval defines how long the router waits between two consecutive health checks on its configured backends. This value is applied globally as a default for all routes, but may be overridden per-route by the route annotation \"router.openshift.io/haproxy.health.check.interval\".\n\nExpects an unsigned duration string of decimal numbers, each with optional fraction and a unit suffix, eg \"300ms\", \"1.5h\" or \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\" U+00B5 or \"μs\" U+03BC), \"ms\", \"s\", \"m\", \"h\".\n\nSetting this to less than 5s can cause excess traffic due to too frequent TCP health checks and accompanying SYN packet storms. Alternatively, setting this too high can result in increased latency, due to backend servers that are no longer available, but haven't yet been detected as such.\n\nAn empty or zero healthCheckInterval means no opinion and IngressController chooses a default, which is subject to change over time. Currently the default healthCheckInterval value is 5s.\n\nCurrently the minimum allowed value is 1s and the maximum allowed value is 2147483647ms (24.85 days). Both are subject to change over time.", "maxConnections": "maxConnections defines the maximum number of simultaneous connections that can be established per HAProxy process. Increasing this value allows each ingress controller pod to handle more connections but at the cost of additional system resources being consumed.\n\nPermitted values are: empty, 0, -1, and the range 2000-2000000.\n\nIf this field is empty or 0, the IngressController will use the default value of 50000, but the default is subject to change in future releases.\n\nIf the value is -1 then HAProxy will dynamically compute a maximum value based on the available ulimits in the running container. Selecting -1 (i.e., auto) will result in a large value being computed (~520000 on OpenShift >=4.10 clusters) and therefore each HAProxy process will incur significant memory usage compared to the current default of 50000.\n\nSetting a value that is greater than the current operating system limit will prevent the HAProxy process from starting.\n\nIf you choose a discrete value (e.g., 750000) and the router pod is migrated to a new node, there's no guarantee that that new node has identical ulimits configured. In such a scenario the pod would fail to start. If you have nodes with different ulimits configured (e.g., different tuned profiles) and you choose a discrete value then the guidance is to use -1 and let the value be computed dynamically at runtime.\n\nYou can monitor memory usage for router containers with the following metric: 'container_memory_working_set_bytes{container=\"router\",namespace=\"openshift-ingress\"}'.\n\nYou can monitor memory usage of individual HAProxy processes in router containers with the following metric: 'container_memory_working_set_bytes{container=\"router\",namespace=\"openshift-ingress\"}/container_processes{container=\"router\",namespace=\"openshift-ingress\"}'.", "reloadInterval": "reloadInterval defines the minimum interval at which the router is allowed to reload to accept new changes. Increasing this value can prevent the accumulation of HAProxy processes, depending on the scenario. Increasing this interval can also lessen load imbalance on a backend's servers when using the roundrobin balancing algorithm. Alternatively, decreasing this value may decrease latency since updates to HAProxy's configuration can take effect more quickly.\n\nThe value must be a time duration value; see . Currently, the minimum value allowed is 1s, and the maximum allowed value is 120s. Minimum and maximum allowed values may change in future versions of OpenShift. Note that if a duration outside of these bounds is provided, the value of reloadInterval will be capped/floored and not rejected (e.g. a duration of over 120s will be capped to 120s; the IngressController will not reject and replace this disallowed value with the default).\n\nA zero value for reloadInterval tells the IngressController to choose the default, which is currently 5s and subject to change without notice.\n\nThis field expects an unsigned duration string of decimal numbers, each with optional fraction and a unit suffix, e.g. \"300ms\", \"1.5h\" or \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\" U+00B5 or \"μs\" U+03BC), \"ms\", \"s\", \"m\", \"h\".\n\nNote: Setting a value significantly larger than the default of 5s can cause latency in observing updates to routes and their endpoints. HAProxy's configuration will be reloaded less frequently, and newly created routes will not be served until the subsequent reload.", + "configurationManagement": "configurationManagement specifies how OpenShift router should update the HAProxy configuration. The following values are valid for this field:\n\n* \"ForkAndReload\". * \"Dynamic\".\n\nOmitting this field means that the user has no opinion and the platform may choose a reasonable default. This default is subject to change over time. The current default is \"ForkAndReload\".\n\n\"ForkAndReload\" means that OpenShift router should rewrite the HAProxy configuration file and instruct HAProxy to fork and reload. This is OpenShift router's traditional approach.\n\n\"Dynamic\" means that OpenShift router may use HAProxy's control socket for some configuration updates and fall back to fork and reload for other configuration updates. This is a newer approach, which may be less mature than ForkAndReload. This setting can improve load-balancing fairness and metrics accuracy and reduce CPU and memory usage if HAProxy has frequent configuration updates for route and endpoints updates.\n\nNote: The \"Dynamic\" option is currently experimental and should not be enabled on production clusters.", } func (IngressControllerTuningOptions) SwaggerDoc() map[string]string { @@ -1669,6 +1670,16 @@ func (AdditionalRoutingCapabilities) SwaggerDoc() map[string]string { return map_AdditionalRoutingCapabilities } +var map_BGPManagedConfig = map[string]string{ + "": "BGPManagedConfig contains configuration options for BGP when routing is \"Managed\".", + "asNumber": "asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) to be used in the generated FRR configuration. Valid values are 1 to 4294967295. When omitted, this defaults to 64512.", + "bgpTopology": "bgpTopology defines the BGP topology to be used. Allowed values are \"FullMesh\". When set to \"FullMesh\", every node peers directly with every other node via BGP. This field is required when BGPManagedConfig is specified.", +} + +func (BGPManagedConfig) SwaggerDoc() map[string]string { + return map_BGPManagedConfig +} + var map_ClusterNetworkEntry = map[string]string{ "": "ClusterNetworkEntry is a subnet from which to allocate PodIPs. A network of size HostPrefix (in CIDR notation) will be allocated when nodes join the cluster. If the HostPrefix field is not used by the plugin, it can be left unset. Not all network providers support multiple ClusterNetworks", } @@ -1896,6 +1907,16 @@ func (NetworkStatus) SwaggerDoc() map[string]string { return map_NetworkStatus } +var map_NoOverlayConfig = map[string]string{ + "": "NoOverlayConfig contains configuration options for networks operating in no-overlay mode.", + "outboundSNAT": "outboundSNAT defines the SNAT behavior for outbound traffic from pods. Allowed values are \"Enabled\" and \"Disabled\". When set to \"Enabled\", SNAT is performed on outbound traffic from pods. When set to \"Disabled\", SNAT is not performed and pod IPs are preserved in outbound traffic. This field is required when the network operates in no-overlay mode. This field can be set to any value at installation time and can be changed afterwards.", + "routing": "routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. Allowed values are \"Managed\" and \"Unmanaged\". When set to \"Managed\", OVN-Kubernetes manages the pod network routing configuration through BGP. When set to \"Unmanaged\", users are responsible for configuring the pod network routing. This field is required when the network operates in no-overlay mode. This field is immutable once set.", +} + +func (NoOverlayConfig) SwaggerDoc() map[string]string { + return map_NoOverlayConfig +} + var map_OVNKubernetesConfig = map[string]string{ "": "ovnKubernetesConfig contains the configuration parameters for networks using the ovn-kubernetes network project", "mtu": "mtu is the MTU to use for the tunnel interface. This must be 100 bytes smaller than the uplink mtu. Default is 1400", @@ -1910,6 +1931,9 @@ var map_OVNKubernetesConfig = map[string]string{ "ipv4": "ipv4 allows users to configure IP settings for IPv4 connections. When ommitted, this means no opinions and the default configuration is used. Check individual fields within ipv4 for details of default values.", "ipv6": "ipv6 allows users to configure IP settings for IPv6 connections. When ommitted, this means no opinions and the default configuration is used. Check individual fields within ipv4 for details of default values.", "routeAdvertisements": "routeAdvertisements determines if the functionality to advertise cluster network routes through a dynamic routing protocol, such as BGP, is enabled or not. This functionality is configured through the ovn-kubernetes RouteAdvertisements CRD. Requires the 'FRR' routing capability provider to be enabled as an additional routing capability. Allowed values are \"Enabled\", \"Disabled\" and ommited. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default is \"Disabled\".", + "transport": "transport sets the transport mode for pods on the default network. Allowed values are \"NoOverlay\" and \"Geneve\". \"NoOverlay\" avoids tunnel encapsulation, routing pod traffic directly between nodes. \"Geneve\" encapsulates pod traffic using Geneve tunnels between nodes. When omitted, this means the user has no opinion and the platform chooses a reasonable default which is subject to change over time. The current default is \"Geneve\". \"NoOverlay\" can only be set at installation time and cannot be changed afterwards. \"Geneve\" may be set explicitly at any time to lock in the current default.", + "noOverlayConfig": "noOverlayConfig contains configuration for no-overlay mode. This configuration applies to the default network only. It is required when transport is \"NoOverlay\". When omitted, this means the user does not configure no-overlay mode options.", + "bgpManagedConfig": "bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) in no-overlay mode that specify routing=\"Managed\" in their noOverlayConfig. It is required when noOverlayConfig.routing is set to \"Managed\". When omitted, this means the user does not configure BGP for managed routing. This field can be set at installation time or on day 2, and can be modified at any time.", } func (OVNKubernetesConfig) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go b/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go index 5816f93628..719893f8a5 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go @@ -20,6 +20,7 @@ import ( // Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. // +openshift:compatibility-gen:level=4 // +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="clusterapi is a singleton, .metadata.name must be 'cluster'" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.status) || has(self.status)",message="status may not be removed once set" type ClusterAPI struct { metav1.TypeMeta `json:",inline"` @@ -78,6 +79,7 @@ type RevisionName string // ClusterAPIStatus describes the current state of the capi-operator. // +kubebuilder:validation:XValidation:rule="self.revisions.exists(r, r.name == self.desiredRevision && self.revisions.all(s, s.revision <= r.revision))",message="desiredRevision must be the name of the revision with the highest revision number" // +kubebuilder:validation:XValidation:rule="!has(self.currentRevision) || self.revisions.exists(r, r.name == self.currentRevision)",message="currentRevision must correspond to an entry in the revisions list" +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.observedRevisionGeneration) || has(self.observedRevisionGeneration)",message="observedRevisionGeneration may not be unset once set" type ClusterAPIStatus struct { // currentRevision is the name of the most recently fully applied revision. // It is written by the installer controller. If it is absent, it indicates @@ -111,6 +113,15 @@ type ClusterAPIStatus struct { // +kubebuilder:validation:XValidation:rule="self.all(new, oldSelf.exists(old, old.name == new.name) || oldSelf.all(old, new.revision > old.revision))",message="new revisions must have a revision number greater than all existing revisions" // +kubebuilder:validation:XValidation:rule="oldSelf.all(old, !self.exists(new, new.name == old.name) || self.exists(new, new == old))",message="existing revisions are immutable, but may be removed" Revisions []ClusterAPIInstallerRevision `json:"revisions,omitempty"` + + // observedRevisionGeneration is the generation of the ClusterAPI object that was last observed by the revision controller. + // If specified it must be greater than or equal to 1, and less than 2^53. It may not decrease or be unset once set. + // + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:validation:Maximum=9007199254740991 + // +kubebuilder:validation:XValidation:rule="self >= oldSelf",message="observedRevisionGeneration may not decrease" + ObservedRevisionGeneration int64 `json:"observedRevisionGeneration,omitempty"` } // +structType=atomic @@ -144,6 +155,17 @@ type ClusterAPIInstallerRevision struct { // +optional UnmanagedCustomResourceDefinitions []string `json:"unmanagedCustomResourceDefinitions,omitempty"` + // manifestSubstitutions is a list of envsubst style substitutions which + // will be applied to manifests in the revision during rendering. If + // defined it must not be empty, and may not contain more than 32 items. + // Each manifest substitution must have a unique key. + // +optional + // +listType=map + // +listMapKey=key + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + ManifestSubstitutions []ClusterAPIInstallerRevisionManifestSubstitution `json:"manifestSubstitutions,omitempty"` + // components is a list of components which will be installed by this // revision. Components will be installed in the order they are listed. If // omitted no components will be installed. @@ -157,6 +179,29 @@ type ClusterAPIInstallerRevision struct { Components []ClusterAPIInstallerComponent `json:"components,omitempty"` } +// ClusterAPIInstallerRevisionManifestSubstitution defines an envsubst style +// substitution which will be applied to manifests in a revision during +// rendering. +type ClusterAPIInstallerRevisionManifestSubstitution struct { + // key is the name of the envsubst variable to substitute. It must be a + // valid envsubst variable name, consisting of letters, digits, and + // underscores, and must start with a letter or underscore. The key must + // not be empty, and must not exceed 255 characters. + // +required + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + // +kubebuilder:validation:XValidation:rule="self.matches('^[A-Za-z_][A-Za-z0-9_]*$')",message="key must start with a letter or underscore, followed by letters, digits, or underscores" + Key string `json:"key,omitempty"` + + // value is the value to substitute for the envsubst variable. It may be + // empty, in which case the variable will be substituted with an empty + // string. The value must not exceed 4096 characters. + // +required + // +kubebuilder:validation:MinLength=0 + // +kubebuilder:validation:MaxLength=4096 + Value *string `json:"value,omitempty"` +} + // InstallerComponentType is the type of component to install. // +kubebuilder:validation:Enum=Image // +enum @@ -168,9 +213,24 @@ const ( ) // ClusterAPIInstallerComponent defines a component which will be installed by this revision. +type ClusterAPIInstallerComponent struct { + // name is the human-readable name of the component. The value has no + // effect, and will not be set if the component does not define a name in + // its manifests. If set it must consist of alphanumeric characters, or + // '-', and may not exceed 255 characters. + // +optional + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=255 + // +kubebuilder:validation:XValidation:rule="self.matches('^[A-Za-z0-9-]+$')",message="name must consist of alphanumeric characters or '-'" + Name string `json:"name,omitempty"` + + ClusterAPIInstallerComponentSource `json:",inline"` +} + +// ClusterAPIInstallerComponentSource defines the source of a component which will be installed by this revision. // +union // +kubebuilder:validation:XValidation:rule="self.type == 'Image' ? has(self.image) : !has(self.image)",message="image is required when type is Image, and forbidden otherwise" -type ClusterAPIInstallerComponent struct { +type ClusterAPIInstallerComponentSource struct { // type is the source type of the component. // The only valid value is Image. // When set to Image, the image field must be set and will define an image source for the component. diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.crd-manifests/0000_30_cluster-api_01_clusterapis.crd.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.crd-manifests/0000_30_cluster-api_01_clusterapis.crd.yaml index 6516a3ef0d..67d384d3eb 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.crd-manifests/0000_30_cluster-api_01_clusterapis.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.crd-manifests/0000_30_cluster-api_01_clusterapis.crd.yaml @@ -106,6 +106,17 @@ spec: maxLength: 255 minLength: 1 type: string + observedRevisionGeneration: + description: |- + observedRevisionGeneration is the generation of the ClusterAPI object that was last observed by the revision controller. + If specified it must be greater than or equal to 1, and less than 2^53. It may not decrease or be unset once set. + format: int64 + maximum: 9007199254740991 + minimum: 1 + type: integer + x-kubernetes-validations: + - message: observedRevisionGeneration may not decrease + rule: self >= oldSelf revisions: description: |- revisions is a list of all currently active revisions. A revision is @@ -168,6 +179,19 @@ spec: - profile - ref type: object + name: + description: |- + name is the human-readable name of the component. The value has no + effect, and will not be set if the component does not define a name in + its manifests. If set it must consist of alphanumeric characters, or + '-', and may not exceed 255 characters. + maxLength: 255 + minLength: 1 + type: string + x-kubernetes-validations: + - message: name must consist of alphanumeric characters + or '-' + rule: self.matches('^[A-Za-z0-9-]+$') type: description: |- type is the source type of the component. @@ -194,6 +218,49 @@ spec: maxLength: 255 minLength: 1 type: string + manifestSubstitutions: + description: |- + manifestSubstitutions is a list of envsubst style substitutions which + will be applied to manifests in the revision during rendering. If + defined it must not be empty, and may not contain more than 32 items. + Each manifest substitution must have a unique key. + items: + description: |- + ClusterAPIInstallerRevisionManifestSubstitution defines an envsubst style + substitution which will be applied to manifests in a revision during + rendering. + properties: + key: + description: |- + key is the name of the envsubst variable to substitute. It must be a + valid envsubst variable name, consisting of letters, digits, and + underscores, and must start with a letter or underscore. The key must + not be empty, and must not exceed 255 characters. + maxLength: 255 + minLength: 1 + type: string + x-kubernetes-validations: + - message: key must start with a letter or underscore, + followed by letters, digits, or underscores + rule: self.matches('^[A-Za-z_][A-Za-z0-9_]*$') + value: + description: |- + value is the value to substitute for the envsubst variable. It may be + empty, in which case the variable will be substituted with an empty + string. The value must not exceed 4096 characters. + maxLength: 4096 + minLength: 0 + type: string + required: + - key + - value + type: object + maxItems: 32 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - key + x-kubernetes-list-type: map name: description: name is the name of a revision. maxLength: 255 @@ -259,6 +326,8 @@ spec: list rule: '!has(self.currentRevision) || self.revisions.exists(r, r.name == self.currentRevision)' + - message: observedRevisionGeneration may not be unset once set + rule: '!has(oldSelf.observedRevisionGeneration) || has(self.observedRevisionGeneration)' required: - metadata - spec @@ -266,6 +335,8 @@ spec: x-kubernetes-validations: - message: clusterapi is a singleton, .metadata.name must be 'cluster' rule: self.metadata.name == 'cluster' + - message: status may not be removed once set + rule: '!has(oldSelf.status) || has(self.status)' served: true storage: true subresources: diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go index 1f3fd281e1..3c3dc8e7a5 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go @@ -61,7 +61,7 @@ func (in *ClusterAPI) DeepCopyObject() runtime.Object { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterAPIInstallerComponent) DeepCopyInto(out *ClusterAPIInstallerComponent) { *out = *in - out.Image = in.Image + out.ClusterAPIInstallerComponentSource = in.ClusterAPIInstallerComponentSource return } @@ -91,6 +91,23 @@ func (in *ClusterAPIInstallerComponentImage) DeepCopy() *ClusterAPIInstallerComp return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClusterAPIInstallerComponentSource) DeepCopyInto(out *ClusterAPIInstallerComponentSource) { + *out = *in + out.Image = in.Image + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterAPIInstallerComponentSource. +func (in *ClusterAPIInstallerComponentSource) DeepCopy() *ClusterAPIInstallerComponentSource { + if in == nil { + return nil + } + out := new(ClusterAPIInstallerComponentSource) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterAPIInstallerRevision) DeepCopyInto(out *ClusterAPIInstallerRevision) { *out = *in @@ -99,6 +116,13 @@ func (in *ClusterAPIInstallerRevision) DeepCopyInto(out *ClusterAPIInstallerRevi *out = make([]string, len(*in)) copy(*out, *in) } + if in.ManifestSubstitutions != nil { + in, out := &in.ManifestSubstitutions, &out.ManifestSubstitutions + *out = make([]ClusterAPIInstallerRevisionManifestSubstitution, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } if in.Components != nil { in, out := &in.Components, &out.Components *out = make([]ClusterAPIInstallerComponent, len(*in)) @@ -117,6 +141,27 @@ func (in *ClusterAPIInstallerRevision) DeepCopy() *ClusterAPIInstallerRevision { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClusterAPIInstallerRevisionManifestSubstitution) DeepCopyInto(out *ClusterAPIInstallerRevisionManifestSubstitution) { + *out = *in + if in.Value != nil { + in, out := &in.Value, &out.Value + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterAPIInstallerRevisionManifestSubstitution. +func (in *ClusterAPIInstallerRevisionManifestSubstitution) DeepCopy() *ClusterAPIInstallerRevisionManifestSubstitution { + if in == nil { + return nil + } + out := new(ClusterAPIInstallerRevisionManifestSubstitution) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterAPIList) DeepCopyInto(out *ClusterAPIList) { *out = *in diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go index 92cef1421a..bf4117768d 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go @@ -147,9 +147,8 @@ func (ClusterAPI) SwaggerDoc() map[string]string { } var map_ClusterAPIInstallerComponent = map[string]string{ - "": "ClusterAPIInstallerComponent defines a component which will be installed by this revision.", - "type": "type is the source type of the component. The only valid value is Image. When set to Image, the image field must be set and will define an image source for the component.", - "image": "image defines an image source for a component. The image must contain a /capi-operator-installer directory containing the component manifests.", + "": "ClusterAPIInstallerComponent defines a component which will be installed by this revision.", + "name": "name is the human-readable name of the component. The value has no effect, and will not be set if the component does not define a name in its manifests. If set it must consist of alphanumeric characters, or '-', and may not exceed 255 characters.", } func (ClusterAPIInstallerComponent) SwaggerDoc() map[string]string { @@ -166,11 +165,22 @@ func (ClusterAPIInstallerComponentImage) SwaggerDoc() map[string]string { return map_ClusterAPIInstallerComponentImage } +var map_ClusterAPIInstallerComponentSource = map[string]string{ + "": "ClusterAPIInstallerComponentSource defines the source of a component which will be installed by this revision.", + "type": "type is the source type of the component. The only valid value is Image. When set to Image, the image field must be set and will define an image source for the component.", + "image": "image defines an image source for a component. The image must contain a /capi-operator-installer directory containing the component manifests.", +} + +func (ClusterAPIInstallerComponentSource) SwaggerDoc() map[string]string { + return map_ClusterAPIInstallerComponentSource +} + var map_ClusterAPIInstallerRevision = map[string]string{ "name": "name is the name of a revision.", "revision": "revision is a monotonically increasing number that is assigned to a revision.", "contentID": "contentID uniquely identifies the content of this revision. The contentID must be between 1 and 255 characters long.", "unmanagedCustomResourceDefinitions": "unmanagedCustomResourceDefinitions is a list of the names of ClusterResourceDefinition (CRD) objects which are included in this revision, but which should not be installed or updated. If not set, all CRDs in the revision will be managed by the CAPI operator.", + "manifestSubstitutions": "manifestSubstitutions is a list of envsubst style substitutions which will be applied to manifests in the revision during rendering. If defined it must not be empty, and may not contain more than 32 items. Each manifest substitution must have a unique key.", "components": "components is a list of components which will be installed by this revision. Components will be installed in the order they are listed. If omitted no components will be installed.\n\nThe maximum number of components is 32.", } @@ -178,6 +188,16 @@ func (ClusterAPIInstallerRevision) SwaggerDoc() map[string]string { return map_ClusterAPIInstallerRevision } +var map_ClusterAPIInstallerRevisionManifestSubstitution = map[string]string{ + "": "ClusterAPIInstallerRevisionManifestSubstitution defines an envsubst style substitution which will be applied to manifests in a revision during rendering.", + "key": "key is the name of the envsubst variable to substitute. It must be a valid envsubst variable name, consisting of letters, digits, and underscores, and must start with a letter or underscore. The key must not be empty, and must not exceed 255 characters.", + "value": "value is the value to substitute for the envsubst variable. It may be empty, in which case the variable will be substituted with an empty string. The value must not exceed 4096 characters.", +} + +func (ClusterAPIInstallerRevisionManifestSubstitution) SwaggerDoc() map[string]string { + return map_ClusterAPIInstallerRevisionManifestSubstitution +} + var map_ClusterAPIList = map[string]string{ "": "ClusterAPIList contains a list of ClusterAPI configurations\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", @@ -198,10 +218,11 @@ func (ClusterAPISpec) SwaggerDoc() map[string]string { } var map_ClusterAPIStatus = map[string]string{ - "": "ClusterAPIStatus describes the current state of the capi-operator.", - "currentRevision": "currentRevision is the name of the most recently fully applied revision. It is written by the installer controller. If it is absent, it indicates that no revision has been fully applied yet. If set, currentRevision must correspond to an entry in the revisions list.", - "desiredRevision": "desiredRevision is the name of the desired revision. It is written by the revision controller. It must be set to the name of the entry in the revisions list with the highest revision number.", - "revisions": "revisions is a list of all currently active revisions. A revision is active until the installer controller updates currentRevision to a later revision. It is written by the revision controller.\n\nThe maximum number of revisions is 16. All revisions must have a unique name. All revisions must have a unique revision number. When adding a revision, the revision number must be greater than the highest revision number in the list. Revisions are immutable, although they can be deleted.", + "": "ClusterAPIStatus describes the current state of the capi-operator.", + "currentRevision": "currentRevision is the name of the most recently fully applied revision. It is written by the installer controller. If it is absent, it indicates that no revision has been fully applied yet. If set, currentRevision must correspond to an entry in the revisions list.", + "desiredRevision": "desiredRevision is the name of the desired revision. It is written by the revision controller. It must be set to the name of the entry in the revisions list with the highest revision number.", + "revisions": "revisions is a list of all currently active revisions. A revision is active until the installer controller updates currentRevision to a later revision. It is written by the revision controller.\n\nThe maximum number of revisions is 16. All revisions must have a unique name. All revisions must have a unique revision number. When adding a revision, the revision number must be greater than the highest revision number in the list. Revisions are immutable, although they can be deleted.", + "observedRevisionGeneration": "observedRevisionGeneration is the generation of the ClusterAPI object that was last observed by the revision controller. If specified it must be greater than or equal to 1, and less than 2^53. It may not decrease or be unset once set.", } func (ClusterAPIStatus) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/quota/v1/generated.proto b/vendor/github.com/openshift/api/quota/v1/generated.proto index fb7fed242a..998c594732 100644 --- a/vendor/github.com/openshift/api/quota/v1/generated.proto +++ b/vendor/github.com/openshift/api/quota/v1/generated.proto @@ -51,7 +51,7 @@ message AppliedClusterResourceQuotaList { // +kubebuilder:resource:path=clusterresourcequotas,scope=Cluster // +kubebuilder:subresource:status // +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/470 -// +openshift:file-pattern=cvoRunLevel=0000_03,operatorName=config-operator,operatorOrdering=01 +// +openshift:file-pattern=cvoRunLevel=0000_00,operatorName=apiserver,operatorOrdering=01 // +openshift:compatibility-gen:level=1 // +kubebuilder:metadata:annotations=release.openshift.io/bootstrap-required=true message ClusterResourceQuota { diff --git a/vendor/github.com/openshift/api/quota/v1/types.go b/vendor/github.com/openshift/api/quota/v1/types.go index 0cfb85f87e..9f60962146 100644 --- a/vendor/github.com/openshift/api/quota/v1/types.go +++ b/vendor/github.com/openshift/api/quota/v1/types.go @@ -17,7 +17,7 @@ import ( // +kubebuilder:resource:path=clusterresourcequotas,scope=Cluster // +kubebuilder:subresource:status // +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/470 -// +openshift:file-pattern=cvoRunLevel=0000_03,operatorName=config-operator,operatorOrdering=01 +// +openshift:file-pattern=cvoRunLevel=0000_00,operatorName=apiserver,operatorOrdering=01 // +openshift:compatibility-gen:level=1 // +kubebuilder:metadata:annotations=release.openshift.io/bootstrap-required=true type ClusterResourceQuota struct { diff --git a/vendor/github.com/openshift/api/quota/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/quota/v1/zz_generated.featuregated-crd-manifests.yaml index b0fae46f7d..1a56a512d7 100644 --- a/vendor/github.com/openshift/api/quota/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/quota/v1/zz_generated.featuregated-crd-manifests.yaml @@ -6,9 +6,9 @@ clusterresourcequotas.quota.openshift.io: Capability: "" Category: "" FeatureGates: [] - FilenameOperatorName: config-operator + FilenameOperatorName: apiserver FilenameOperatorOrdering: "01" - FilenameRunLevel: "0000_03" + FilenameRunLevel: "0000_00" GroupName: quota.openshift.io HasStatus: true KindName: ClusterResourceQuota diff --git a/vendor/github.com/openshift/client-go/apiextensions/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/apiextensions/applyconfigurations/internal/internal.go index 942959159e..7387a79dec 100644 --- a/vendor/github.com/openshift/client-go/apiextensions/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/apiextensions/applyconfigurations/internal/internal.go @@ -23,164 +23,12 @@ func Parser() *typed.Parser { var parserOnce sync.Once var parser *typed.Parser var schemaYAML = typed.YAMLObject(`types: -- name: com.github.openshift.api.apiextensions.v1alpha1.APIExcludedField - map: - fields: - - name: path - type: - scalar: string - - name: versions - type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.apiextensions.v1alpha1.APIVersions - map: - fields: - - name: additionalVersions - type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: defaultSelection - type: - scalar: string -- name: com.github.openshift.api.apiextensions.v1alpha1.CRDData - map: - fields: - - name: data - type: - scalar: string - - name: type - type: - scalar: string -- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirement - map: - fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementSpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementStatus - default: {} -- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementSpec - map: - fields: - - name: compatibilitySchema - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.CompatibilitySchema - default: {} - - name: customResourceDefinitionSchemaValidation - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.CustomResourceDefinitionSchemaValidation - default: {} - - name: objectSchemaValidation - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.ObjectSchemaValidation - default: {} -- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementStatus - map: - fields: - - name: conditions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type - - name: crdName - type: - scalar: string - - name: observedCRD - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.ObservedCRD - default: {} -- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilitySchema - map: - fields: - - name: customResourceDefinition - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.CRDData - default: {} - - name: excludedFields - type: - list: - elementType: - namedType: com.github.openshift.api.apiextensions.v1alpha1.APIExcludedField - elementRelationship: atomic - - name: requiredVersions - type: - namedType: com.github.openshift.api.apiextensions.v1alpha1.APIVersions - default: {} -- name: com.github.openshift.api.apiextensions.v1alpha1.CustomResourceDefinitionSchemaValidation - map: - fields: - - name: action - type: - scalar: string -- name: com.github.openshift.api.apiextensions.v1alpha1.ObjectSchemaValidation - map: - fields: - - name: action - type: - scalar: string - - name: matchConditions - type: - list: - elementType: - namedType: io.k8s.api.admissionregistration.v1.MatchCondition - elementRelationship: associative - keys: - - name - - name: namespaceSelector - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector - default: {} - - name: objectSelector - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector - default: {} -- name: com.github.openshift.api.apiextensions.v1alpha1.ObservedCRD - map: - fields: - - name: generation - type: - scalar: numeric - - name: uid - type: - scalar: string -- name: io.k8s.api.admissionregistration.v1.MatchCondition - map: - fields: - - name: expression - type: - scalar: string - default: "" - - name: name - type: - scalar: string - default: "" -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Condition +- name: Condition.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - name: lastTransitionTime type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: message type: scalar: string @@ -200,7 +48,7 @@ var schemaYAML = typed.YAMLObject(`types: type: scalar: string default: "" -- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 +- name: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io map: elementType: scalar: untyped @@ -212,14 +60,14 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector +- name: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - name: matchExpressions type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement + namedType: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic - name: matchLabels type: @@ -227,7 +75,7 @@ var schemaYAML = typed.YAMLObject(`types: elementType: scalar: string elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement +- name: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - name: key @@ -244,7 +92,7 @@ var schemaYAML = typed.YAMLObject(`types: elementType: scalar: string elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry +- name: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - name: apiVersion @@ -255,7 +103,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: fieldsV1 type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 + namedType: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io - name: manager type: scalar: string @@ -267,8 +115,19 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: time type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io +- name: MatchCondition.v1.admissionregistration.api.k8s.io + map: + fields: + - name: expression + type: + scalar: string + default: "" + - name: name + type: + scalar: string + default: "" +- name: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - name: annotations @@ -278,13 +137,13 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: creationTimestamp type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: deletionGracePeriodSeconds type: scalar: numeric - name: deletionTimestamp type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: finalizers type: list: @@ -306,7 +165,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry + namedType: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic - name: name type: @@ -318,7 +177,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference + namedType: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: associative keys: - uid @@ -331,7 +190,7 @@ var schemaYAML = typed.YAMLObject(`types: - name: uid type: scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference +- name: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - name: apiVersion @@ -357,8 +216,149 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string default: "" elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Time +- name: Time.v1.meta.apis.pkg.apimachinery.k8s.io scalar: untyped +- name: com.github.openshift.api.apiextensions.v1alpha1.APIExcludedField + map: + fields: + - name: path + type: + scalar: string + - name: versions + type: + list: + elementType: + scalar: string + elementRelationship: associative +- name: com.github.openshift.api.apiextensions.v1alpha1.APIVersions + map: + fields: + - name: additionalVersions + type: + list: + elementType: + scalar: string + elementRelationship: associative + - name: defaultSelection + type: + scalar: string +- name: com.github.openshift.api.apiextensions.v1alpha1.CRDData + map: + fields: + - name: data + type: + scalar: string + - name: type + type: + scalar: string +- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirement + map: + fields: + - name: apiVersion + type: + scalar: string + - name: kind + type: + scalar: string + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementStatus + default: {} +- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementSpec + map: + fields: + - name: compatibilitySchema + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.CompatibilitySchema + default: {} + - name: customResourceDefinitionSchemaValidation + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.CustomResourceDefinitionSchemaValidation + default: {} + - name: objectSchemaValidation + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.ObjectSchemaValidation + default: {} +- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementStatus + map: + fields: + - name: conditions + type: + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type + - name: crdName + type: + scalar: string + - name: observedCRD + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.ObservedCRD + default: {} +- name: com.github.openshift.api.apiextensions.v1alpha1.CompatibilitySchema + map: + fields: + - name: customResourceDefinition + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.CRDData + default: {} + - name: excludedFields + type: + list: + elementType: + namedType: com.github.openshift.api.apiextensions.v1alpha1.APIExcludedField + elementRelationship: atomic + - name: requiredVersions + type: + namedType: com.github.openshift.api.apiextensions.v1alpha1.APIVersions + default: {} +- name: com.github.openshift.api.apiextensions.v1alpha1.CustomResourceDefinitionSchemaValidation + map: + fields: + - name: action + type: + scalar: string +- name: com.github.openshift.api.apiextensions.v1alpha1.ObjectSchemaValidation + map: + fields: + - name: action + type: + scalar: string + - name: matchConditions + type: + list: + elementType: + namedType: MatchCondition.v1.admissionregistration.api.k8s.io + elementRelationship: associative + keys: + - name + - name: namespaceSelector + type: + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: objectSelector + type: + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} +- name: com.github.openshift.api.apiextensions.v1alpha1.ObservedCRD + map: + fields: + - name: generation + type: + scalar: numeric + - name: uid + type: + scalar: string - name: __untyped_atomic_ scalar: untyped list: diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverspec.go index 5b674ae05d..42392a353e 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverspec.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverspec.go @@ -2,6 +2,10 @@ package v1 +import ( + configv1 "github.com/openshift/api/config/v1" +) + // APIServerSpecApplyConfiguration represents a declarative configuration of the APIServerSpec type for use // with apply. type APIServerSpecApplyConfiguration struct { @@ -26,6 +30,37 @@ type APIServerSpecApplyConfiguration struct { // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. // The current default is the Intermediate profile. TLSSecurityProfile *TLSSecurityProfileApplyConfiguration `json:"tlsSecurityProfile,omitempty"` + // tlsAdherence controls if components in the cluster adhere to the TLS security profile + // configured on this APIServer resource. + // + // Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents". + // + // When set to "LegacyAdheringComponentsOnly", components that already honor the + // cluster-wide TLS profile continue to do so. Components that do not already honor + // it continue to use their individual TLS configurations. + // + // When set to "StrictAllComponents", all components must honor the configured TLS + // profile unless they have a component-specific TLS configuration that overrides + // it. This mode is recommended for security-conscious deployments and is required + // for certain compliance frameworks. + // + // Note: Some components such as Kubelet and IngressController have their own + // dedicated TLS configuration mechanisms via KubeletConfig and IngressController + // CRs respectively. When these component-specific TLS configurations are set, + // they take precedence over the cluster-wide tlsSecurityProfile. When not set, + // these components fall back to the cluster-wide default. + // + // Components that encounter an unknown value for tlsAdherence should treat it + // as "StrictAllComponents" and log a warning to ensure forward compatibility + // while defaulting to the more secure behavior. + // + // This field is optional. + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default is LegacyAdheringComponentsOnly. + // + // Once set, this field may be changed to a different value, but may not be removed. + TLSAdherence *configv1.TLSAdherencePolicy `json:"tlsAdherence,omitempty"` // audit specifies the settings for audit configuration to be applied to all OpenShift-provided // API servers in the cluster. Audit *AuditApplyConfiguration `json:"audit,omitempty"` @@ -79,6 +114,14 @@ func (b *APIServerSpecApplyConfiguration) WithTLSSecurityProfile(value *TLSSecur return b } +// WithTLSAdherence sets the TLSAdherence field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TLSAdherence field is set to the value of the last call. +func (b *APIServerSpecApplyConfiguration) WithTLSAdherence(value configv1.TLSAdherencePolicy) *APIServerSpecApplyConfiguration { + b.TLSAdherence = &value + return b +} + // WithAudit sets the Audit field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Audit field is set to the value of the last call. diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go index ec57615082..457cb43aca 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.go @@ -10,6 +10,11 @@ type AWSDNSSpecApplyConfiguration struct { // privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing // operations on the cluster's private hosted zone specified in the cluster DNS config. // When left empty, no role should be assumed. + // + // The ARN must follow the format: arn::iam:::role/, where: + // is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc), + // is a 12-digit numeric identifier for the AWS account, + // is the IAM role name. PrivateZoneIAMRole *string `json:"privateZoneIAMRole,omitempty"` } diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go index f5c63c6ae9..c01827c113 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go @@ -42,6 +42,8 @@ type InfrastructureStatusApplyConfiguration struct { // and the operators should not configure the operand for highly-available operation // The 'External' mode indicates that the control plane is hosted externally to the cluster and that // its components are not visible within the cluster. + // The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes + // that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. ControlPlaneTopology *configv1.TopologyMode `json:"controlPlaneTopology,omitempty"` // infrastructureTopology expresses the expectations for infrastructure services that do not run on control // plane nodes, usually indicated by a node selector for a `role` value diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/prefixedclaimmapping.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/prefixedclaimmapping.go index d9b0e87914..08ebf26a86 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/prefixedclaimmapping.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/prefixedclaimmapping.go @@ -11,7 +11,8 @@ type PrefixedClaimMappingApplyConfiguration struct { TokenClaimMappingApplyConfiguration `json:",inline"` // prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. // - // When omitted (""), no prefix is applied to the cluster identity attribute. + // When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute. + // Must not be set to a non-empty value when expression is set. // // Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c". Prefix *string `json:"prefix,omitempty"` diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/update.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/update.go index 6151b6b13a..db1128deb5 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/update.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/update.go @@ -47,6 +47,19 @@ type UpdateApplyConfiguration struct { // acceptRisks must not contain more than 1000 entries. // Entries in this list must be unique. AcceptRisks []AcceptRiskApplyConfiguration `json:"acceptRisks,omitempty"` + // mode determines how an update should be processed. + // The only valid value is "Preflight". + // When omitted, the cluster performs a normal update by applying the specified version or image to the cluster. + // This is the standard update behavior. + // When set to "Preflight", the cluster runs compatibility checks against the target release without + // performing an actual update. Compatibility results, including any detected risks, are reported + // in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update + // recommendation service. + // This allows administrators to assess update readiness and address issues before committing to the update. + // Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be + // verified across multiple minor versions. + // When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates. + Mode *configv1.UpdateMode `json:"mode,omitempty"` } // UpdateApplyConfiguration constructs a declarative configuration of the Update type for use with @@ -99,3 +112,11 @@ func (b *UpdateApplyConfiguration) WithAcceptRisks(values ...*AcceptRiskApplyCon } return b } + +// WithMode sets the Mode field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Mode field is set to the value of the last call. +func (b *UpdateApplyConfiguration) WithMode(value configv1.UpdateMode) *UpdateApplyConfiguration { + b.Mode = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/usernameclaimmapping.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/usernameclaimmapping.go index d33d6d71d8..8676ae891f 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/usernameclaimmapping.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/usernameclaimmapping.go @@ -29,11 +29,9 @@ type UsernameClaimMappingApplyConfiguration struct { // Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string). // // When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim. - // // The prefix field must be set when prefixPolicy is 'Prefix'. - // + // Must not be set to 'Prefix' when expression is set. // When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim. - // // When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time. // Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'. // diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/additionalalertmanagerconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/additionalalertmanagerconfig.go new file mode 100644 index 0000000000..6a699cd82a --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/additionalalertmanagerconfig.go @@ -0,0 +1,119 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// AdditionalAlertmanagerConfigApplyConfiguration represents a declarative configuration of the AdditionalAlertmanagerConfig type for use +// with apply. +// +// AdditionalAlertmanagerConfig represents configuration for additional Alertmanager instances. +// The `AdditionalAlertmanagerConfig` resource defines settings for how a +// component communicates with additional Alertmanager instances. +type AdditionalAlertmanagerConfigApplyConfiguration struct { + // name is a unique identifier for this Alertmanager configuration entry. + // The name must be a valid DNS subdomain (RFC 1123): lowercase alphanumeric characters, + // hyphens, or periods, and must start and end with an alphanumeric character. + // Minimum length is 1 character (empty string is invalid). + // Maximum length is 253 characters. + Name *string `json:"name,omitempty"` + // authorization configures the authentication method for Alertmanager connections. + // Supports bearer token authentication. When omitted, no authentication is used. + Authorization *AuthorizationConfigApplyConfiguration `json:"authorization,omitempty"` + // pathPrefix defines an optional URL path prefix to prepend to the Alertmanager API endpoints. + // For example, if your Alertmanager is behind a reverse proxy at "/alertmanager/", + // set this to "/alertmanager" so requests go to "/alertmanager/api/v1/alerts" instead of "/api/v1/alerts". + // This is commonly needed when Alertmanager is deployed behind ingress controllers or load balancers. + // When no prefix is needed, omit this field; do not set it to "/" as that would produce paths with double slashes (e.g. "//api/v1/alerts"). + // Must start with "/", must not end with "/", and must not be exactly "/". + // Must not contain query strings ("?") or fragments ("#"). + PathPrefix *string `json:"pathPrefix,omitempty"` + // scheme defines the URL scheme to use when communicating with Alertmanager + // instances. + // Possible values are `HTTP` or `HTTPS`. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The current default value is `HTTP`. + Scheme *configv1alpha1.AlertmanagerScheme `json:"scheme,omitempty"` + // staticConfigs is a list of statically configured Alertmanager endpoints in the form + // of `:`. Each entry must be a valid hostname, IPv4 address, or IPv6 address + // (in brackets) followed by a colon and a valid port number (1-65535). + // Examples: "alertmanager.example.com:9093", "192.168.1.100:9093", "[::1]:9093" + // At least one endpoint must be specified (minimum 1, maximum 10 endpoints). + // Each entry must be unique and non-empty (empty string is invalid). + StaticConfigs []string `json:"staticConfigs,omitempty"` + // timeoutSeconds defines the timeout in seconds for requests to Alertmanager. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Currently the default is 10 seconds. + // Minimum value is 1 second. + // Maximum value is 600 seconds (10 minutes). + TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty"` + // tlsConfig defines the TLS settings to use for Alertmanager connections. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + TLSConfig *TLSConfigApplyConfiguration `json:"tlsConfig,omitempty"` +} + +// AdditionalAlertmanagerConfigApplyConfiguration constructs a declarative configuration of the AdditionalAlertmanagerConfig type for use with +// apply. +func AdditionalAlertmanagerConfig() *AdditionalAlertmanagerConfigApplyConfiguration { + return &AdditionalAlertmanagerConfigApplyConfiguration{} +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithName(value string) *AdditionalAlertmanagerConfigApplyConfiguration { + b.Name = &value + return b +} + +// WithAuthorization sets the Authorization field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Authorization field is set to the value of the last call. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithAuthorization(value *AuthorizationConfigApplyConfiguration) *AdditionalAlertmanagerConfigApplyConfiguration { + b.Authorization = value + return b +} + +// WithPathPrefix sets the PathPrefix field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the PathPrefix field is set to the value of the last call. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithPathPrefix(value string) *AdditionalAlertmanagerConfigApplyConfiguration { + b.PathPrefix = &value + return b +} + +// WithScheme sets the Scheme field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Scheme field is set to the value of the last call. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithScheme(value configv1alpha1.AlertmanagerScheme) *AdditionalAlertmanagerConfigApplyConfiguration { + b.Scheme = &value + return b +} + +// WithStaticConfigs adds the given value to the StaticConfigs field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the StaticConfigs field. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithStaticConfigs(values ...string) *AdditionalAlertmanagerConfigApplyConfiguration { + for i := range values { + b.StaticConfigs = append(b.StaticConfigs, values[i]) + } + return b +} + +// WithTimeoutSeconds sets the TimeoutSeconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TimeoutSeconds field is set to the value of the last call. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithTimeoutSeconds(value int32) *AdditionalAlertmanagerConfigApplyConfiguration { + b.TimeoutSeconds = &value + return b +} + +// WithTLSConfig sets the TLSConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TLSConfig field is set to the value of the last call. +func (b *AdditionalAlertmanagerConfigApplyConfiguration) WithTLSConfig(value *TLSConfigApplyConfiguration) *AdditionalAlertmanagerConfigApplyConfiguration { + b.TLSConfig = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go index ebc4e4a6be..c47130a180 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/alertmanagercustomconfig.go @@ -47,7 +47,7 @@ type AlertmanagerCustomConfigApplyConfiguration struct { // - name: memory // request: 40Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` @@ -90,12 +90,10 @@ type AlertmanagerCustomConfigApplyConfiguration struct { // Minimum length for this list is 1. // Entries must have unique topologyKey and whenUnsatisfiable pairs. TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` - // volumeClaimTemplate Defines persistent storage for Alertmanager. Use this setting to - // configure the persistent volume claim, including storage class, volume - // size, and name. + // volumeClaimTemplate defines persistent storage for Alertmanager. Use this setting to + // configure the persistent volume claim, including storage class and volume size. // If omitted, the Pod uses ephemeral storage and alert data will not persist // across restarts. - // This field is optional. VolumeClaimTemplate *v1.PersistentVolumeClaim `json:"volumeClaimTemplate,omitempty"` } diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/authorizationconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/authorizationconfig.go new file mode 100644 index 0000000000..87d7c7eefe --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/authorizationconfig.go @@ -0,0 +1,44 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// AuthorizationConfigApplyConfiguration represents a declarative configuration of the AuthorizationConfig type for use +// with apply. +// +// AuthorizationConfig defines the authentication method for Alertmanager connections. +type AuthorizationConfigApplyConfiguration struct { + // type specifies the authentication type to use. + // Valid value is "BearerToken" (bearer token authentication). + // When set to BearerToken, the bearerToken field must be specified. + Type *configv1alpha1.AuthorizationType `json:"type,omitempty"` + // bearerToken defines the secret reference containing the bearer token. + // Required when type is "BearerToken", and forbidden otherwise. + // The secret must exist in the openshift-monitoring namespace. + BearerToken *SecretKeySelectorApplyConfiguration `json:"bearerToken,omitempty"` +} + +// AuthorizationConfigApplyConfiguration constructs a declarative configuration of the AuthorizationConfig type for use with +// apply. +func AuthorizationConfig() *AuthorizationConfigApplyConfiguration { + return &AuthorizationConfigApplyConfiguration{} +} + +// WithType sets the Type field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Type field is set to the value of the last call. +func (b *AuthorizationConfigApplyConfiguration) WithType(value configv1alpha1.AuthorizationType) *AuthorizationConfigApplyConfiguration { + b.Type = &value + return b +} + +// WithBearerToken sets the BearerToken field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BearerToken field is set to the value of the last call. +func (b *AuthorizationConfigApplyConfiguration) WithBearerToken(value *SecretKeySelectorApplyConfiguration) *AuthorizationConfigApplyConfiguration { + b.BearerToken = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/basicauth.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/basicauth.go new file mode 100644 index 0000000000..efad66668a --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/basicauth.go @@ -0,0 +1,38 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// BasicAuthApplyConfiguration represents a declarative configuration of the BasicAuth type for use +// with apply. +// +// BasicAuth defines basic authentication settings for the remote write endpoint URL. +type BasicAuthApplyConfiguration struct { + // username defines the secret reference containing the username for basic authentication. + // The secret must exist in the openshift-monitoring namespace. + Username *SecretKeySelectorApplyConfiguration `json:"username,omitempty"` + // password defines the secret reference containing the password for basic authentication. + // The secret must exist in the openshift-monitoring namespace. + Password *SecretKeySelectorApplyConfiguration `json:"password,omitempty"` +} + +// BasicAuthApplyConfiguration constructs a declarative configuration of the BasicAuth type for use with +// apply. +func BasicAuth() *BasicAuthApplyConfiguration { + return &BasicAuthApplyConfiguration{} +} + +// WithUsername sets the Username field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Username field is set to the value of the last call. +func (b *BasicAuthApplyConfiguration) WithUsername(value *SecretKeySelectorApplyConfiguration) *BasicAuthApplyConfiguration { + b.Username = value + return b +} + +// WithPassword sets the Password field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Password field is set to the value of the last call. +func (b *BasicAuthApplyConfiguration) WithPassword(value *SecretKeySelectorApplyConfiguration) *BasicAuthApplyConfiguration { + b.Password = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicy.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicy.go deleted file mode 100644 index 19a6917f99..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicy.go +++ /dev/null @@ -1,277 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - internal "github.com/openshift/client-go/config/applyconfigurations/internal" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - managedfields "k8s.io/apimachinery/pkg/util/managedfields" - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// ClusterImagePolicyApplyConfiguration represents a declarative configuration of the ClusterImagePolicy type for use -// with apply. -// -// # ClusterImagePolicy holds cluster-wide configuration for image signature verification -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -type ClusterImagePolicyApplyConfiguration struct { - v1.TypeMetaApplyConfiguration `json:",inline"` - // metadata is the standard object's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - *v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"` - // spec contains the configuration for the cluster image policy. - Spec *ClusterImagePolicySpecApplyConfiguration `json:"spec,omitempty"` - // status contains the observed state of the resource. - Status *ClusterImagePolicyStatusApplyConfiguration `json:"status,omitempty"` -} - -// ClusterImagePolicy constructs a declarative configuration of the ClusterImagePolicy type for use with -// apply. -func ClusterImagePolicy(name string) *ClusterImagePolicyApplyConfiguration { - b := &ClusterImagePolicyApplyConfiguration{} - b.WithName(name) - b.WithKind("ClusterImagePolicy") - b.WithAPIVersion("config.openshift.io/v1alpha1") - return b -} - -// ExtractClusterImagePolicyFrom extracts the applied configuration owned by fieldManager from -// clusterImagePolicy for the specified subresource. Pass an empty string for subresource to extract -// the main resource. Common subresources include "status", "scale", etc. -// clusterImagePolicy must be a unmodified ClusterImagePolicy API object that was retrieved from the Kubernetes API. -// ExtractClusterImagePolicyFrom provides a way to perform a extract/modify-in-place/apply workflow. -// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously -// applied if another fieldManager has updated or force applied any of the previously applied fields. -func ExtractClusterImagePolicyFrom(clusterImagePolicy *configv1alpha1.ClusterImagePolicy, fieldManager string, subresource string) (*ClusterImagePolicyApplyConfiguration, error) { - b := &ClusterImagePolicyApplyConfiguration{} - err := managedfields.ExtractInto(clusterImagePolicy, internal.Parser().Type("com.github.openshift.api.config.v1alpha1.ClusterImagePolicy"), fieldManager, b, subresource) - if err != nil { - return nil, err - } - b.WithName(clusterImagePolicy.Name) - - b.WithKind("ClusterImagePolicy") - b.WithAPIVersion("config.openshift.io/v1alpha1") - return b, nil -} - -// ExtractClusterImagePolicy extracts the applied configuration owned by fieldManager from -// clusterImagePolicy. If no managedFields are found in clusterImagePolicy for fieldManager, a -// ClusterImagePolicyApplyConfiguration is returned with only the Name, Namespace (if applicable), -// APIVersion and Kind populated. It is possible that no managed fields were found for because other -// field managers have taken ownership of all the fields previously owned by fieldManager, or because -// the fieldManager never owned fields any fields. -// clusterImagePolicy must be a unmodified ClusterImagePolicy API object that was retrieved from the Kubernetes API. -// ExtractClusterImagePolicy provides a way to perform a extract/modify-in-place/apply workflow. -// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously -// applied if another fieldManager has updated or force applied any of the previously applied fields. -func ExtractClusterImagePolicy(clusterImagePolicy *configv1alpha1.ClusterImagePolicy, fieldManager string) (*ClusterImagePolicyApplyConfiguration, error) { - return ExtractClusterImagePolicyFrom(clusterImagePolicy, fieldManager, "") -} - -// ExtractClusterImagePolicyStatus extracts the applied configuration owned by fieldManager from -// clusterImagePolicy for the status subresource. -func ExtractClusterImagePolicyStatus(clusterImagePolicy *configv1alpha1.ClusterImagePolicy, fieldManager string) (*ClusterImagePolicyApplyConfiguration, error) { - return ExtractClusterImagePolicyFrom(clusterImagePolicy, fieldManager, "status") -} - -func (b ClusterImagePolicyApplyConfiguration) IsApplyConfiguration() {} - -// WithKind sets the Kind field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Kind field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithKind(value string) *ClusterImagePolicyApplyConfiguration { - b.TypeMetaApplyConfiguration.Kind = &value - return b -} - -// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the APIVersion field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithAPIVersion(value string) *ClusterImagePolicyApplyConfiguration { - b.TypeMetaApplyConfiguration.APIVersion = &value - return b -} - -// WithName sets the Name field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Name field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithName(value string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Name = &value - return b -} - -// WithGenerateName sets the GenerateName field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the GenerateName field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithGenerateName(value string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.GenerateName = &value - return b -} - -// WithNamespace sets the Namespace field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Namespace field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithNamespace(value string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Namespace = &value - return b -} - -// WithUID sets the UID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the UID field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithUID(value types.UID) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.UID = &value - return b -} - -// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ResourceVersion field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithResourceVersion(value string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.ResourceVersion = &value - return b -} - -// WithGeneration sets the Generation field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Generation field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithGeneration(value int64) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Generation = &value - return b -} - -// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CreationTimestamp field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.CreationTimestamp = &value - return b -} - -// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionTimestamp field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value - return b -} - -// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value - return b -} - -// WithLabels puts the entries into the Labels field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Labels field, -// overwriting an existing map entries in Labels field with the same key. -func (b *ClusterImagePolicyApplyConfiguration) WithLabels(entries map[string]string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Labels[k] = v - } - return b -} - -// WithAnnotations puts the entries into the Annotations field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Annotations field, -// overwriting an existing map entries in Annotations field with the same key. -func (b *ClusterImagePolicyApplyConfiguration) WithAnnotations(entries map[string]string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Annotations[k] = v - } - return b -} - -// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the OwnerReferences field. -func (b *ClusterImagePolicyApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - if values[i] == nil { - panic("nil value passed to WithOwnerReferences") - } - b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i]) - } - return b -} - -// WithFinalizers adds the given value to the Finalizers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Finalizers field. -func (b *ClusterImagePolicyApplyConfiguration) WithFinalizers(values ...string) *ClusterImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i]) - } - return b -} - -func (b *ClusterImagePolicyApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { - if b.ObjectMetaApplyConfiguration == nil { - b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{} - } -} - -// WithSpec sets the Spec field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Spec field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithSpec(value *ClusterImagePolicySpecApplyConfiguration) *ClusterImagePolicyApplyConfiguration { - b.Spec = value - return b -} - -// WithStatus sets the Status field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Status field is set to the value of the last call. -func (b *ClusterImagePolicyApplyConfiguration) WithStatus(value *ClusterImagePolicyStatusApplyConfiguration) *ClusterImagePolicyApplyConfiguration { - b.Status = value - return b -} - -// GetKind retrieves the value of the Kind field in the declarative configuration. -func (b *ClusterImagePolicyApplyConfiguration) GetKind() *string { - return b.TypeMetaApplyConfiguration.Kind -} - -// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration. -func (b *ClusterImagePolicyApplyConfiguration) GetAPIVersion() *string { - return b.TypeMetaApplyConfiguration.APIVersion -} - -// GetName retrieves the value of the Name field in the declarative configuration. -func (b *ClusterImagePolicyApplyConfiguration) GetName() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Name -} - -// GetNamespace retrieves the value of the Namespace field in the declarative configuration. -func (b *ClusterImagePolicyApplyConfiguration) GetNamespace() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Namespace -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicyspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicyspec.go deleted file mode 100644 index 135aa592aa..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicyspec.go +++ /dev/null @@ -1,53 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// ClusterImagePolicySpecApplyConfiguration represents a declarative configuration of the ClusterImagePolicySpec type for use -// with apply. -// -// CLusterImagePolicySpec is the specification of the ClusterImagePolicy custom resource. -type ClusterImagePolicySpecApplyConfiguration struct { - // scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the "Docker Registry HTTP API V2". - // Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). - // More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository - // namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). - // Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. - // If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. - // In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories - // quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. - // If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. - // For additional details about the format, please refer to the document explaining the docker transport field, - // which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker - Scopes []configv1alpha1.ImageScope `json:"scopes,omitempty"` - // policy contains configuration to allow scopes to be verified, and defines how - // images not matching the verification policy will be treated. - Policy *ImageSigstoreVerificationPolicyApplyConfiguration `json:"policy,omitempty"` -} - -// ClusterImagePolicySpecApplyConfiguration constructs a declarative configuration of the ClusterImagePolicySpec type for use with -// apply. -func ClusterImagePolicySpec() *ClusterImagePolicySpecApplyConfiguration { - return &ClusterImagePolicySpecApplyConfiguration{} -} - -// WithScopes adds the given value to the Scopes field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Scopes field. -func (b *ClusterImagePolicySpecApplyConfiguration) WithScopes(values ...configv1alpha1.ImageScope) *ClusterImagePolicySpecApplyConfiguration { - for i := range values { - b.Scopes = append(b.Scopes, values[i]) - } - return b -} - -// WithPolicy sets the Policy field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Policy field is set to the value of the last call. -func (b *ClusterImagePolicySpecApplyConfiguration) WithPolicy(value *ImageSigstoreVerificationPolicyApplyConfiguration) *ClusterImagePolicySpecApplyConfiguration { - b.Policy = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicystatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicystatus.go deleted file mode 100644 index e01b2cac34..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clusterimagepolicystatus.go +++ /dev/null @@ -1,33 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// ClusterImagePolicyStatusApplyConfiguration represents a declarative configuration of the ClusterImagePolicyStatus type for use -// with apply. -type ClusterImagePolicyStatusApplyConfiguration struct { - // conditions provide details on the status of this API Resource. - Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"` -} - -// ClusterImagePolicyStatusApplyConfiguration constructs a declarative configuration of the ClusterImagePolicyStatus type for use with -// apply. -func ClusterImagePolicyStatus() *ClusterImagePolicyStatusApplyConfiguration { - return &ClusterImagePolicyStatusApplyConfiguration{} -} - -// WithConditions adds the given value to the Conditions field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Conditions field. -func (b *ClusterImagePolicyStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *ClusterImagePolicyStatusApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithConditions") - } - b.Conditions = append(b.Conditions, *values[i]) - } - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go index 53f29c3fdc..7638504d05 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/clustermonitoringspec.go @@ -18,6 +18,18 @@ type ClusterMonitoringSpecApplyConfiguration struct { // When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. // The current default value is `DefaultConfig`. AlertmanagerConfig *AlertmanagerConfigApplyConfiguration `json:"alertmanagerConfig,omitempty"` + // prometheusConfig provides configuration options for the default platform Prometheus instance + // that runs in the `openshift-monitoring` namespace. This configuration applies only to the + // platform Prometheus instance; user-workload Prometheus instances are configured separately. + // + // This field allows you to customize how the platform Prometheus is deployed and operated, including: + // - Pod scheduling (node selectors, tolerations, topology spread constraints) + // - Resource allocation (CPU, memory requests/limits) + // - Retention policies (how long metrics are stored) + // - External integrations (remote write, additional alertmanagers) + // + // This field is optional. When omitted, the platform chooses reasonable defaults, which may change over time. + PrometheusConfig *PrometheusConfigApplyConfiguration `json:"prometheusConfig,omitempty"` // metricsServerConfig is an optional field that can be used to configure the Kubernetes Metrics Server that runs in the openshift-monitoring namespace. // Specifically, it can configure how the Metrics Server instance is deployed, pod scheduling, its audit policy and log verbosity. // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. @@ -33,6 +45,25 @@ type ClusterMonitoringSpecApplyConfiguration struct { // between API versions. // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. PrometheusOperatorAdmissionWebhookConfig *PrometheusOperatorAdmissionWebhookConfigApplyConfiguration `json:"prometheusOperatorAdmissionWebhookConfig,omitempty"` + // openShiftStateMetricsConfig is an optional field that can be used to configure the openshift-state-metrics + // agent that runs in the openshift-monitoring namespace. The openshift-state-metrics agent generates metrics + // about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + OpenShiftStateMetricsConfig *OpenShiftStateMetricsConfigApplyConfiguration `json:"openShiftStateMetricsConfig,omitempty"` + // telemeterClientConfig is an optional field that can be used to configure the Telemeter Client + // component that runs in the openshift-monitoring namespace. The Telemeter Client collects + // selected monitoring metrics and forwards them to Red Hat for telemetry purposes. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // When set, at least one field must be specified within telemeterClientConfig. + TelemeterClientConfig *TelemeterClientConfigApplyConfiguration `json:"telemeterClientConfig,omitempty"` + // thanosQuerierConfig is an optional field that can be used to configure the Thanos Querier + // component that runs in the openshift-monitoring namespace. The Thanos Querier provides + // a global query view by aggregating and deduplicating metrics from multiple Prometheus instances. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The current default deploys the Thanos Querier on linux nodes with 5m CPU and 12Mi memory + // requests, and no custom tolerations or topology spread constraints. + // When set, at least one field must be specified within thanosQuerierConfig. + ThanosQuerierConfig *ThanosQuerierConfigApplyConfiguration `json:"thanosQuerierConfig,omitempty"` } // ClusterMonitoringSpecApplyConfiguration constructs a declarative configuration of the ClusterMonitoringSpec type for use with @@ -57,6 +88,14 @@ func (b *ClusterMonitoringSpecApplyConfiguration) WithAlertmanagerConfig(value * return b } +// WithPrometheusConfig sets the PrometheusConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the PrometheusConfig field is set to the value of the last call. +func (b *ClusterMonitoringSpecApplyConfiguration) WithPrometheusConfig(value *PrometheusConfigApplyConfiguration) *ClusterMonitoringSpecApplyConfiguration { + b.PrometheusConfig = value + return b +} + // WithMetricsServerConfig sets the MetricsServerConfig field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the MetricsServerConfig field is set to the value of the last call. @@ -80,3 +119,27 @@ func (b *ClusterMonitoringSpecApplyConfiguration) WithPrometheusOperatorAdmissio b.PrometheusOperatorAdmissionWebhookConfig = value return b } + +// WithOpenShiftStateMetricsConfig sets the OpenShiftStateMetricsConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the OpenShiftStateMetricsConfig field is set to the value of the last call. +func (b *ClusterMonitoringSpecApplyConfiguration) WithOpenShiftStateMetricsConfig(value *OpenShiftStateMetricsConfigApplyConfiguration) *ClusterMonitoringSpecApplyConfiguration { + b.OpenShiftStateMetricsConfig = value + return b +} + +// WithTelemeterClientConfig sets the TelemeterClientConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TelemeterClientConfig field is set to the value of the last call. +func (b *ClusterMonitoringSpecApplyConfiguration) WithTelemeterClientConfig(value *TelemeterClientConfigApplyConfiguration) *ClusterMonitoringSpecApplyConfiguration { + b.TelemeterClientConfig = value + return b +} + +// WithThanosQuerierConfig sets the ThanosQuerierConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ThanosQuerierConfig field is set to the value of the last call. +func (b *ClusterMonitoringSpecApplyConfiguration) WithThanosQuerierConfig(value *ThanosQuerierConfigApplyConfiguration) *ClusterMonitoringSpecApplyConfiguration { + b.ThanosQuerierConfig = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go index d600828b01..2240e1b154 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/containerresource.go @@ -9,6 +9,12 @@ import ( // ContainerResourceApplyConfiguration represents a declarative configuration of the ContainerResource type for use // with apply. // +// MaxItems on []ContainerResource fields is kept at 5 to stay within the +// Kubernetes CRD CEL validation cost budget (StaticEstimatedCRDCostLimit). +// The quantity() CEL function has a high fixed estimated cost per invocation, +// and the limit-vs-request comparison rule is costed per maxItems per location. +// With multiple structs in ClusterMonitoringSpec embedding []ContainerResource, +// maxItems > 5 causes the total estimated rule cost to exceed the budget. // ContainerResource defines a single resource requirement for a container. type ContainerResourceApplyConfiguration struct { // name of the resource (e.g. "cpu", "memory", "hugepages-2Mi"). @@ -18,6 +24,7 @@ type ContainerResourceApplyConfiguration struct { // request is the minimum amount of the resource required (e.g. "2Mi", "1Gi"). // This field is optional. // When limit is specified, request cannot be greater than limit. + // The value must be greater than 0 when specified. Request *resource.Quantity `json:"request,omitempty"` // limit is the maximum amount of the resource allowed (e.g. "2Mi", "1Gi"). // This field is optional. diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/dropequalactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/dropequalactionconfig.go new file mode 100644 index 0000000000..1e0a8e0014 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/dropequalactionconfig.go @@ -0,0 +1,29 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// DropEqualActionConfigApplyConfiguration represents a declarative configuration of the DropEqualActionConfig type for use +// with apply. +// +// DropEqualActionConfig configures the DropEqual action. +// Drops targets for which the concatenated source_labels do match the value of target_label. +// Requires Prometheus >= v2.41.0. +type DropEqualActionConfigApplyConfiguration struct { + // targetLabel is the label name whose value is compared to the concatenated source_labels; targets that match are dropped. + // Must be between 1 and 128 characters in length. + TargetLabel *string `json:"targetLabel,omitempty"` +} + +// DropEqualActionConfigApplyConfiguration constructs a declarative configuration of the DropEqualActionConfig type for use with +// apply. +func DropEqualActionConfig() *DropEqualActionConfigApplyConfiguration { + return &DropEqualActionConfigApplyConfiguration{} +} + +// WithTargetLabel sets the TargetLabel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetLabel field is set to the value of the last call. +func (b *DropEqualActionConfigApplyConfiguration) WithTargetLabel(value string) *DropEqualActionConfigApplyConfiguration { + b.TargetLabel = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/hashmodactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/hashmodactionconfig.go new file mode 100644 index 0000000000..453795b42b --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/hashmodactionconfig.go @@ -0,0 +1,40 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// HashModActionConfigApplyConfiguration represents a declarative configuration of the HashModActionConfig type for use +// with apply. +// +// HashModActionConfig configures the HashMod action. +// target_label is set to the modulus of a hash of the concatenated source_labels (target = hash % modulus). +type HashModActionConfigApplyConfiguration struct { + // targetLabel is the label name where the hash modulus result is written. + // Must be between 1 and 128 characters in length. + TargetLabel *string `json:"targetLabel,omitempty"` + // modulus is the divisor applied to the hash of the concatenated source label values (target = hash % modulus). + // Required when using the HashMod action so the intended behavior is explicit. + // Must be between 1 and 1000000. + Modulus *int64 `json:"modulus,omitempty"` +} + +// HashModActionConfigApplyConfiguration constructs a declarative configuration of the HashModActionConfig type for use with +// apply. +func HashModActionConfig() *HashModActionConfigApplyConfiguration { + return &HashModActionConfigApplyConfiguration{} +} + +// WithTargetLabel sets the TargetLabel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetLabel field is set to the value of the last call. +func (b *HashModActionConfigApplyConfiguration) WithTargetLabel(value string) *HashModActionConfigApplyConfiguration { + b.TargetLabel = &value + return b +} + +// WithModulus sets the Modulus field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Modulus field is set to the value of the last call. +func (b *HashModActionConfigApplyConfiguration) WithModulus(value int64) *HashModActionConfigApplyConfiguration { + b.Modulus = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicy.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicy.go deleted file mode 100644 index 68a813c1af..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicy.go +++ /dev/null @@ -1,279 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - internal "github.com/openshift/client-go/config/applyconfigurations/internal" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - managedfields "k8s.io/apimachinery/pkg/util/managedfields" - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// ImagePolicyApplyConfiguration represents a declarative configuration of the ImagePolicy type for use -// with apply. -// -// # ImagePolicy holds namespace-wide configuration for image signature verification -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -type ImagePolicyApplyConfiguration struct { - v1.TypeMetaApplyConfiguration `json:",inline"` - // metadata is the standard object's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - *v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"` - // spec holds user settable values for configuration - Spec *ImagePolicySpecApplyConfiguration `json:"spec,omitempty"` - // status contains the observed state of the resource. - Status *ImagePolicyStatusApplyConfiguration `json:"status,omitempty"` -} - -// ImagePolicy constructs a declarative configuration of the ImagePolicy type for use with -// apply. -func ImagePolicy(name, namespace string) *ImagePolicyApplyConfiguration { - b := &ImagePolicyApplyConfiguration{} - b.WithName(name) - b.WithNamespace(namespace) - b.WithKind("ImagePolicy") - b.WithAPIVersion("config.openshift.io/v1alpha1") - return b -} - -// ExtractImagePolicyFrom extracts the applied configuration owned by fieldManager from -// imagePolicy for the specified subresource. Pass an empty string for subresource to extract -// the main resource. Common subresources include "status", "scale", etc. -// imagePolicy must be a unmodified ImagePolicy API object that was retrieved from the Kubernetes API. -// ExtractImagePolicyFrom provides a way to perform a extract/modify-in-place/apply workflow. -// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously -// applied if another fieldManager has updated or force applied any of the previously applied fields. -func ExtractImagePolicyFrom(imagePolicy *configv1alpha1.ImagePolicy, fieldManager string, subresource string) (*ImagePolicyApplyConfiguration, error) { - b := &ImagePolicyApplyConfiguration{} - err := managedfields.ExtractInto(imagePolicy, internal.Parser().Type("com.github.openshift.api.config.v1alpha1.ImagePolicy"), fieldManager, b, subresource) - if err != nil { - return nil, err - } - b.WithName(imagePolicy.Name) - b.WithNamespace(imagePolicy.Namespace) - - b.WithKind("ImagePolicy") - b.WithAPIVersion("config.openshift.io/v1alpha1") - return b, nil -} - -// ExtractImagePolicy extracts the applied configuration owned by fieldManager from -// imagePolicy. If no managedFields are found in imagePolicy for fieldManager, a -// ImagePolicyApplyConfiguration is returned with only the Name, Namespace (if applicable), -// APIVersion and Kind populated. It is possible that no managed fields were found for because other -// field managers have taken ownership of all the fields previously owned by fieldManager, or because -// the fieldManager never owned fields any fields. -// imagePolicy must be a unmodified ImagePolicy API object that was retrieved from the Kubernetes API. -// ExtractImagePolicy provides a way to perform a extract/modify-in-place/apply workflow. -// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously -// applied if another fieldManager has updated or force applied any of the previously applied fields. -func ExtractImagePolicy(imagePolicy *configv1alpha1.ImagePolicy, fieldManager string) (*ImagePolicyApplyConfiguration, error) { - return ExtractImagePolicyFrom(imagePolicy, fieldManager, "") -} - -// ExtractImagePolicyStatus extracts the applied configuration owned by fieldManager from -// imagePolicy for the status subresource. -func ExtractImagePolicyStatus(imagePolicy *configv1alpha1.ImagePolicy, fieldManager string) (*ImagePolicyApplyConfiguration, error) { - return ExtractImagePolicyFrom(imagePolicy, fieldManager, "status") -} - -func (b ImagePolicyApplyConfiguration) IsApplyConfiguration() {} - -// WithKind sets the Kind field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Kind field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithKind(value string) *ImagePolicyApplyConfiguration { - b.TypeMetaApplyConfiguration.Kind = &value - return b -} - -// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the APIVersion field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithAPIVersion(value string) *ImagePolicyApplyConfiguration { - b.TypeMetaApplyConfiguration.APIVersion = &value - return b -} - -// WithName sets the Name field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Name field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithName(value string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Name = &value - return b -} - -// WithGenerateName sets the GenerateName field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the GenerateName field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithGenerateName(value string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.GenerateName = &value - return b -} - -// WithNamespace sets the Namespace field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Namespace field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithNamespace(value string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Namespace = &value - return b -} - -// WithUID sets the UID field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the UID field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithUID(value types.UID) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.UID = &value - return b -} - -// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ResourceVersion field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithResourceVersion(value string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.ResourceVersion = &value - return b -} - -// WithGeneration sets the Generation field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Generation field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithGeneration(value int64) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.Generation = &value - return b -} - -// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the CreationTimestamp field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.CreationTimestamp = &value - return b -} - -// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionTimestamp field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value - return b -} - -// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value - return b -} - -// WithLabels puts the entries into the Labels field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Labels field, -// overwriting an existing map entries in Labels field with the same key. -func (b *ImagePolicyApplyConfiguration) WithLabels(entries map[string]string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Labels[k] = v - } - return b -} - -// WithAnnotations puts the entries into the Annotations field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, the entries provided by each call will be put on the Annotations field, -// overwriting an existing map entries in Annotations field with the same key. -func (b *ImagePolicyApplyConfiguration) WithAnnotations(entries map[string]string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 { - b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries)) - } - for k, v := range entries { - b.ObjectMetaApplyConfiguration.Annotations[k] = v - } - return b -} - -// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the OwnerReferences field. -func (b *ImagePolicyApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - if values[i] == nil { - panic("nil value passed to WithOwnerReferences") - } - b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i]) - } - return b -} - -// WithFinalizers adds the given value to the Finalizers field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Finalizers field. -func (b *ImagePolicyApplyConfiguration) WithFinalizers(values ...string) *ImagePolicyApplyConfiguration { - b.ensureObjectMetaApplyConfigurationExists() - for i := range values { - b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i]) - } - return b -} - -func (b *ImagePolicyApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { - if b.ObjectMetaApplyConfiguration == nil { - b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{} - } -} - -// WithSpec sets the Spec field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Spec field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithSpec(value *ImagePolicySpecApplyConfiguration) *ImagePolicyApplyConfiguration { - b.Spec = value - return b -} - -// WithStatus sets the Status field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Status field is set to the value of the last call. -func (b *ImagePolicyApplyConfiguration) WithStatus(value *ImagePolicyStatusApplyConfiguration) *ImagePolicyApplyConfiguration { - b.Status = value - return b -} - -// GetKind retrieves the value of the Kind field in the declarative configuration. -func (b *ImagePolicyApplyConfiguration) GetKind() *string { - return b.TypeMetaApplyConfiguration.Kind -} - -// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration. -func (b *ImagePolicyApplyConfiguration) GetAPIVersion() *string { - return b.TypeMetaApplyConfiguration.APIVersion -} - -// GetName retrieves the value of the Name field in the declarative configuration. -func (b *ImagePolicyApplyConfiguration) GetName() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Name -} - -// GetNamespace retrieves the value of the Namespace field in the declarative configuration. -func (b *ImagePolicyApplyConfiguration) GetNamespace() *string { - b.ensureObjectMetaApplyConfigurationExists() - return b.ObjectMetaApplyConfiguration.Namespace -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicyfulciocawithrekorrootoftrust.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicyfulciocawithrekorrootoftrust.go deleted file mode 100644 index c9299e5000..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicyfulciocawithrekorrootoftrust.go +++ /dev/null @@ -1,52 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -// ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration represents a declarative configuration of the ImagePolicyFulcioCAWithRekorRootOfTrust type for use -// with apply. -// -// ImagePolicyFulcioCAWithRekorRootOfTrust defines the root of trust based on the Fulcio certificate and the Rekor public key. -type ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration struct { - // fulcioCAData contains inline base64-encoded data for the PEM format fulcio CA. - // fulcioCAData must be at most 8192 characters. - FulcioCAData []byte `json:"fulcioCAData,omitempty"` - // rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. - // rekorKeyData must be at most 8192 characters. - RekorKeyData []byte `json:"rekorKeyData,omitempty"` - // fulcioSubject specifies OIDC issuer and the email of the Fulcio authentication configuration. - FulcioSubject *PolicyFulcioSubjectApplyConfiguration `json:"fulcioSubject,omitempty"` -} - -// ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration constructs a declarative configuration of the ImagePolicyFulcioCAWithRekorRootOfTrust type for use with -// apply. -func ImagePolicyFulcioCAWithRekorRootOfTrust() *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration { - return &ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration{} -} - -// WithFulcioCAData adds the given value to the FulcioCAData field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the FulcioCAData field. -func (b *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration) WithFulcioCAData(values ...byte) *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration { - for i := range values { - b.FulcioCAData = append(b.FulcioCAData, values[i]) - } - return b -} - -// WithRekorKeyData adds the given value to the RekorKeyData field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the RekorKeyData field. -func (b *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration) WithRekorKeyData(values ...byte) *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration { - for i := range values { - b.RekorKeyData = append(b.RekorKeyData, values[i]) - } - return b -} - -// WithFulcioSubject sets the FulcioSubject field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the FulcioSubject field is set to the value of the last call. -func (b *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration) WithFulcioSubject(value *PolicyFulcioSubjectApplyConfiguration) *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration { - b.FulcioSubject = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicypkirootoftrust.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicypkirootoftrust.go deleted file mode 100644 index 42c3c0aa7c..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicypkirootoftrust.go +++ /dev/null @@ -1,51 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -// ImagePolicyPKIRootOfTrustApplyConfiguration represents a declarative configuration of the ImagePolicyPKIRootOfTrust type for use -// with apply. -// -// ImagePolicyPKIRootOfTrust defines the root of trust based on Root CA(s) and corresponding intermediate certificates. -type ImagePolicyPKIRootOfTrustApplyConfiguration struct { - // caRootsData contains base64-encoded data of a certificate bundle PEM file, which contains one or more CA roots in the PEM format. The total length of the data must not exceed 8192 characters. - CertificateAuthorityRootsData []byte `json:"caRootsData,omitempty"` - // caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters. - // caIntermediatesData requires caRootsData to be set. - CertificateAuthorityIntermediatesData []byte `json:"caIntermediatesData,omitempty"` - // pkiCertificateSubject defines the requirements imposed on the subject to which the certificate was issued. - PKICertificateSubject *PKICertificateSubjectApplyConfiguration `json:"pkiCertificateSubject,omitempty"` -} - -// ImagePolicyPKIRootOfTrustApplyConfiguration constructs a declarative configuration of the ImagePolicyPKIRootOfTrust type for use with -// apply. -func ImagePolicyPKIRootOfTrust() *ImagePolicyPKIRootOfTrustApplyConfiguration { - return &ImagePolicyPKIRootOfTrustApplyConfiguration{} -} - -// WithCertificateAuthorityRootsData adds the given value to the CertificateAuthorityRootsData field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the CertificateAuthorityRootsData field. -func (b *ImagePolicyPKIRootOfTrustApplyConfiguration) WithCertificateAuthorityRootsData(values ...byte) *ImagePolicyPKIRootOfTrustApplyConfiguration { - for i := range values { - b.CertificateAuthorityRootsData = append(b.CertificateAuthorityRootsData, values[i]) - } - return b -} - -// WithCertificateAuthorityIntermediatesData adds the given value to the CertificateAuthorityIntermediatesData field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the CertificateAuthorityIntermediatesData field. -func (b *ImagePolicyPKIRootOfTrustApplyConfiguration) WithCertificateAuthorityIntermediatesData(values ...byte) *ImagePolicyPKIRootOfTrustApplyConfiguration { - for i := range values { - b.CertificateAuthorityIntermediatesData = append(b.CertificateAuthorityIntermediatesData, values[i]) - } - return b -} - -// WithPKICertificateSubject sets the PKICertificateSubject field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the PKICertificateSubject field is set to the value of the last call. -func (b *ImagePolicyPKIRootOfTrustApplyConfiguration) WithPKICertificateSubject(value *PKICertificateSubjectApplyConfiguration) *ImagePolicyPKIRootOfTrustApplyConfiguration { - b.PKICertificateSubject = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicypublickeyrootoftrust.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicypublickeyrootoftrust.go deleted file mode 100644 index 317b1be6ad..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicypublickeyrootoftrust.go +++ /dev/null @@ -1,42 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -// ImagePolicyPublicKeyRootOfTrustApplyConfiguration represents a declarative configuration of the ImagePolicyPublicKeyRootOfTrust type for use -// with apply. -// -// ImagePolicyPublicKeyRootOfTrust defines the root of trust based on a sigstore public key. -type ImagePolicyPublicKeyRootOfTrustApplyConfiguration struct { - // keyData contains inline base64-encoded data for the PEM format public key. - // KeyData must be at most 8192 characters. - KeyData []byte `json:"keyData,omitempty"` - // rekorKeyData contains inline base64-encoded data for the PEM format from the Rekor public key. - // rekorKeyData must be at most 8192 characters. - RekorKeyData []byte `json:"rekorKeyData,omitempty"` -} - -// ImagePolicyPublicKeyRootOfTrustApplyConfiguration constructs a declarative configuration of the ImagePolicyPublicKeyRootOfTrust type for use with -// apply. -func ImagePolicyPublicKeyRootOfTrust() *ImagePolicyPublicKeyRootOfTrustApplyConfiguration { - return &ImagePolicyPublicKeyRootOfTrustApplyConfiguration{} -} - -// WithKeyData adds the given value to the KeyData field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the KeyData field. -func (b *ImagePolicyPublicKeyRootOfTrustApplyConfiguration) WithKeyData(values ...byte) *ImagePolicyPublicKeyRootOfTrustApplyConfiguration { - for i := range values { - b.KeyData = append(b.KeyData, values[i]) - } - return b -} - -// WithRekorKeyData adds the given value to the RekorKeyData field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the RekorKeyData field. -func (b *ImagePolicyPublicKeyRootOfTrustApplyConfiguration) WithRekorKeyData(values ...byte) *ImagePolicyPublicKeyRootOfTrustApplyConfiguration { - for i := range values { - b.RekorKeyData = append(b.RekorKeyData, values[i]) - } - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicyspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicyspec.go deleted file mode 100644 index 0d8cbf64b7..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicyspec.go +++ /dev/null @@ -1,53 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// ImagePolicySpecApplyConfiguration represents a declarative configuration of the ImagePolicySpec type for use -// with apply. -// -// ImagePolicySpec is the specification of the ImagePolicy CRD. -type ImagePolicySpecApplyConfiguration struct { - // scopes defines the list of image identities assigned to a policy. Each item refers to a scope in a registry implementing the "Docker Registry HTTP API V2". - // Scopes matching individual images are named Docker references in the fully expanded form, either using a tag or digest. For example, docker.io/library/busybox:latest (not busybox:latest). - // More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository - // namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number). - // Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not. - // If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored. - // In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories - // quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation. - // If a scope is configured in both the ClusterImagePolicy and the ImagePolicy, or if the scope in ImagePolicy is nested under one of the scopes from the ClusterImagePolicy, only the policy from the ClusterImagePolicy will be applied. - // For additional details about the format, please refer to the document explaining the docker transport field, - // which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker - Scopes []configv1alpha1.ImageScope `json:"scopes,omitempty"` - // policy contains configuration to allow scopes to be verified, and defines how - // images not matching the verification policy will be treated. - Policy *ImageSigstoreVerificationPolicyApplyConfiguration `json:"policy,omitempty"` -} - -// ImagePolicySpecApplyConfiguration constructs a declarative configuration of the ImagePolicySpec type for use with -// apply. -func ImagePolicySpec() *ImagePolicySpecApplyConfiguration { - return &ImagePolicySpecApplyConfiguration{} -} - -// WithScopes adds the given value to the Scopes field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Scopes field. -func (b *ImagePolicySpecApplyConfiguration) WithScopes(values ...configv1alpha1.ImageScope) *ImagePolicySpecApplyConfiguration { - for i := range values { - b.Scopes = append(b.Scopes, values[i]) - } - return b -} - -// WithPolicy sets the Policy field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Policy field is set to the value of the last call. -func (b *ImagePolicySpecApplyConfiguration) WithPolicy(value *ImageSigstoreVerificationPolicyApplyConfiguration) *ImagePolicySpecApplyConfiguration { - b.Policy = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicystatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicystatus.go deleted file mode 100644 index 59fc118561..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagepolicystatus.go +++ /dev/null @@ -1,33 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// ImagePolicyStatusApplyConfiguration represents a declarative configuration of the ImagePolicyStatus type for use -// with apply. -type ImagePolicyStatusApplyConfiguration struct { - // conditions provide details on the status of this API Resource. - Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"` -} - -// ImagePolicyStatusApplyConfiguration constructs a declarative configuration of the ImagePolicyStatus type for use with -// apply. -func ImagePolicyStatus() *ImagePolicyStatusApplyConfiguration { - return &ImagePolicyStatusApplyConfiguration{} -} - -// WithConditions adds the given value to the Conditions field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Conditions field. -func (b *ImagePolicyStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *ImagePolicyStatusApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithConditions") - } - b.Conditions = append(b.Conditions, *values[i]) - } - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagesigstoreverificationpolicy.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagesigstoreverificationpolicy.go deleted file mode 100644 index 3fa4e27478..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/imagesigstoreverificationpolicy.go +++ /dev/null @@ -1,36 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -// ImageSigstoreVerificationPolicyApplyConfiguration represents a declarative configuration of the ImageSigstoreVerificationPolicy type for use -// with apply. -// -// ImageSigstoreVerificationPolicy defines the verification policy for the items in the scopes list. -type ImageSigstoreVerificationPolicyApplyConfiguration struct { - // rootOfTrust specifies the root of trust for the policy. - RootOfTrust *PolicyRootOfTrustApplyConfiguration `json:"rootOfTrust,omitempty"` - // signedIdentity specifies what image identity the signature claims about the image. The required matchPolicy field specifies the approach used in the verification process to verify the identity in the signature and the actual image identity, the default matchPolicy is "MatchRepoDigestOrExact". - SignedIdentity *PolicyIdentityApplyConfiguration `json:"signedIdentity,omitempty"` -} - -// ImageSigstoreVerificationPolicyApplyConfiguration constructs a declarative configuration of the ImageSigstoreVerificationPolicy type for use with -// apply. -func ImageSigstoreVerificationPolicy() *ImageSigstoreVerificationPolicyApplyConfiguration { - return &ImageSigstoreVerificationPolicyApplyConfiguration{} -} - -// WithRootOfTrust sets the RootOfTrust field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the RootOfTrust field is set to the value of the last call. -func (b *ImageSigstoreVerificationPolicyApplyConfiguration) WithRootOfTrust(value *PolicyRootOfTrustApplyConfiguration) *ImageSigstoreVerificationPolicyApplyConfiguration { - b.RootOfTrust = value - return b -} - -// WithSignedIdentity sets the SignedIdentity field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the SignedIdentity field is set to the value of the last call. -func (b *ImageSigstoreVerificationPolicyApplyConfiguration) WithSignedIdentity(value *PolicyIdentityApplyConfiguration) *ImageSigstoreVerificationPolicyApplyConfiguration { - b.SignedIdentity = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/keepequalactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/keepequalactionconfig.go new file mode 100644 index 0000000000..a560a662a8 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/keepequalactionconfig.go @@ -0,0 +1,29 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// KeepEqualActionConfigApplyConfiguration represents a declarative configuration of the KeepEqualActionConfig type for use +// with apply. +// +// KeepEqualActionConfig configures the KeepEqual action. +// Drops targets for which the concatenated source_labels do not match the value of target_label. +// Requires Prometheus >= v2.41.0. +type KeepEqualActionConfigApplyConfiguration struct { + // targetLabel is the label name whose value is compared to the concatenated source_labels; targets that do not match are dropped. + // Must be between 1 and 128 characters in length. + TargetLabel *string `json:"targetLabel,omitempty"` +} + +// KeepEqualActionConfigApplyConfiguration constructs a declarative configuration of the KeepEqualActionConfig type for use with +// apply. +func KeepEqualActionConfig() *KeepEqualActionConfigApplyConfiguration { + return &KeepEqualActionConfigApplyConfiguration{} +} + +// WithTargetLabel sets the TargetLabel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetLabel field is set to the value of the last call. +func (b *KeepEqualActionConfigApplyConfiguration) WithTargetLabel(value string) *KeepEqualActionConfigApplyConfiguration { + b.TargetLabel = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/label.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/label.go new file mode 100644 index 0000000000..d1710cc9ab --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/label.go @@ -0,0 +1,39 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// LabelApplyConfiguration represents a declarative configuration of the Label type for use +// with apply. +// +// Label represents a key/value pair for external labels. +type LabelApplyConfiguration struct { + // key is the name of the label. + // Prometheus supports UTF-8 label names, so any valid UTF-8 string is allowed. + // Must be between 1 and 128 characters in length. + Key *string `json:"key,omitempty"` + // value is the value of the label. + // Must be between 1 and 128 characters in length. + Value *string `json:"value,omitempty"` +} + +// LabelApplyConfiguration constructs a declarative configuration of the Label type for use with +// apply. +func Label() *LabelApplyConfiguration { + return &LabelApplyConfiguration{} +} + +// WithKey sets the Key field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Key field is set to the value of the last call. +func (b *LabelApplyConfiguration) WithKey(value string) *LabelApplyConfiguration { + b.Key = &value + return b +} + +// WithValue sets the Value field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Value field is set to the value of the last call. +func (b *LabelApplyConfiguration) WithValue(value string) *LabelApplyConfiguration { + b.Value = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/labelmapactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/labelmapactionconfig.go new file mode 100644 index 0000000000..a16bd78779 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/labelmapactionconfig.go @@ -0,0 +1,30 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// LabelMapActionConfigApplyConfiguration represents a declarative configuration of the LabelMapActionConfig type for use +// with apply. +// +// LabelMapActionConfig configures the LabelMap action. +// Regex is matched against all source label names (not just source_labels). Matching label values are copied to new label names given by replacement, with match group references (${1}, ${2}, ...) substituted. +type LabelMapActionConfigApplyConfiguration struct { + // replacement is the template for new label names; match group references (${1}, ${2}, ...) are substituted from the matched label name. + // Required when using the LabelMap action so the intended behavior is explicit and the platform does not need to apply defaults. + // Use "$1" for the first capture group, "$2" for the second, etc. + // Must be between 1 and 255 characters in length. Empty string is invalid as it would produce invalid label names. + Replacement *string `json:"replacement,omitempty"` +} + +// LabelMapActionConfigApplyConfiguration constructs a declarative configuration of the LabelMapActionConfig type for use with +// apply. +func LabelMapActionConfig() *LabelMapActionConfigApplyConfiguration { + return &LabelMapActionConfigApplyConfiguration{} +} + +// WithReplacement sets the Replacement field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Replacement field is set to the value of the last call. +func (b *LabelMapActionConfigApplyConfiguration) WithReplacement(value string) *LabelMapActionConfigApplyConfiguration { + b.Replacement = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/lowercaseactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/lowercaseactionconfig.go new file mode 100644 index 0000000000..17fa48139a --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/lowercaseactionconfig.go @@ -0,0 +1,29 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// LowercaseActionConfigApplyConfiguration represents a declarative configuration of the LowercaseActionConfig type for use +// with apply. +// +// LowercaseActionConfig configures the Lowercase action. +// Maps the concatenated source_labels to their lower case and writes to target_label. +// Requires Prometheus >= v2.36.0. +type LowercaseActionConfigApplyConfiguration struct { + // targetLabel is the label name where the lower-cased value is written. + // Must be between 1 and 128 characters in length. + TargetLabel *string `json:"targetLabel,omitempty"` +} + +// LowercaseActionConfigApplyConfiguration constructs a declarative configuration of the LowercaseActionConfig type for use with +// apply. +func LowercaseActionConfig() *LowercaseActionConfigApplyConfiguration { + return &LowercaseActionConfigApplyConfiguration{} +} + +// WithTargetLabel sets the TargetLabel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetLabel field is set to the value of the last call. +func (b *LowercaseActionConfigApplyConfiguration) WithTargetLabel(value string) *LowercaseActionConfigApplyConfiguration { + b.TargetLabel = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metadataconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metadataconfig.go new file mode 100644 index 0000000000..f8e1627816 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metadataconfig.go @@ -0,0 +1,42 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// MetadataConfigApplyConfiguration represents a declarative configuration of the MetadataConfig type for use +// with apply. +// +// MetadataConfig defines whether and how to send series metadata to remote write storage. +type MetadataConfigApplyConfiguration struct { + // sendPolicy specifies whether to send metadata and how it is configured. + // Default: send metadata using platform-chosen defaults (e.g. send interval 30 seconds). + // Custom: send metadata using the settings in the custom field. + SendPolicy *configv1alpha1.MetadataConfigSendPolicy `json:"sendPolicy,omitempty"` + // custom defines custom metadata send settings. Required when sendPolicy is Custom (must have at least one property), and forbidden when sendPolicy is Default. + Custom *MetadataConfigCustomApplyConfiguration `json:"custom,omitempty"` +} + +// MetadataConfigApplyConfiguration constructs a declarative configuration of the MetadataConfig type for use with +// apply. +func MetadataConfig() *MetadataConfigApplyConfiguration { + return &MetadataConfigApplyConfiguration{} +} + +// WithSendPolicy sets the SendPolicy field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SendPolicy field is set to the value of the last call. +func (b *MetadataConfigApplyConfiguration) WithSendPolicy(value configv1alpha1.MetadataConfigSendPolicy) *MetadataConfigApplyConfiguration { + b.SendPolicy = &value + return b +} + +// WithCustom sets the Custom field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Custom field is set to the value of the last call. +func (b *MetadataConfigApplyConfiguration) WithCustom(value *MetadataConfigCustomApplyConfiguration) *MetadataConfigApplyConfiguration { + b.Custom = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metadataconfigcustom.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metadataconfigcustom.go new file mode 100644 index 0000000000..3f5e050697 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metadataconfigcustom.go @@ -0,0 +1,29 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// MetadataConfigCustomApplyConfiguration represents a declarative configuration of the MetadataConfigCustom type for use +// with apply. +// +// MetadataConfigCustom defines custom settings for sending series metadata when sendPolicy is Custom. +// At least one property must be set when sendPolicy is Custom (e.g. sendIntervalSeconds). +type MetadataConfigCustomApplyConfiguration struct { + // sendIntervalSeconds is the interval in seconds at which metadata is sent. + // When omitted, the platform chooses a reasonable default (e.g. 30 seconds). + // Minimum value is 1 second. Maximum value is 86400 seconds (24 hours). + SendIntervalSeconds *int32 `json:"sendIntervalSeconds,omitempty"` +} + +// MetadataConfigCustomApplyConfiguration constructs a declarative configuration of the MetadataConfigCustom type for use with +// apply. +func MetadataConfigCustom() *MetadataConfigCustomApplyConfiguration { + return &MetadataConfigCustomApplyConfiguration{} +} + +// WithSendIntervalSeconds sets the SendIntervalSeconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SendIntervalSeconds field is set to the value of the last call. +func (b *MetadataConfigCustomApplyConfiguration) WithSendIntervalSeconds(value int32) *MetadataConfigCustomApplyConfiguration { + b.SendIntervalSeconds = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go index ea4d945563..bc77df9d2f 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/metricsserverconfig.go @@ -58,7 +58,7 @@ type MetricsServerConfigApplyConfiguration struct { // - name: memory // request: 40Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/oauth2.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/oauth2.go new file mode 100644 index 0000000000..d58cc3e513 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/oauth2.go @@ -0,0 +1,82 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// OAuth2ApplyConfiguration represents a declarative configuration of the OAuth2 type for use +// with apply. +// +// OAuth2 defines OAuth2 authentication settings for the remote write endpoint. +type OAuth2ApplyConfiguration struct { + // clientId defines the secret reference containing the OAuth2 client ID. + // The secret must exist in the openshift-monitoring namespace. + ClientID *SecretKeySelectorApplyConfiguration `json:"clientId,omitempty"` + // clientSecret defines the secret reference containing the OAuth2 client secret. + // The secret must exist in the openshift-monitoring namespace. + ClientSecret *SecretKeySelectorApplyConfiguration `json:"clientSecret,omitempty"` + // tokenUrl is the URL to fetch the token from. + // Must be a valid URL with http or https scheme. + // Must be between 1 and 2048 characters in length. + TokenURL *string `json:"tokenUrl,omitempty"` + // scopes is a list of OAuth2 scopes to request. + // When omitted, no scopes are requested. + // Maximum of 20 scopes can be specified. + // Each scope must be between 1 and 256 characters. + Scopes []string `json:"scopes,omitempty"` + // endpointParams defines additional parameters to append to the token URL. + // When omitted, no additional parameters are sent. + // Maximum of 20 parameters can be specified. Entries must have unique names (name is the list key). + EndpointParams []OAuth2EndpointParamApplyConfiguration `json:"endpointParams,omitempty"` +} + +// OAuth2ApplyConfiguration constructs a declarative configuration of the OAuth2 type for use with +// apply. +func OAuth2() *OAuth2ApplyConfiguration { + return &OAuth2ApplyConfiguration{} +} + +// WithClientID sets the ClientID field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ClientID field is set to the value of the last call. +func (b *OAuth2ApplyConfiguration) WithClientID(value *SecretKeySelectorApplyConfiguration) *OAuth2ApplyConfiguration { + b.ClientID = value + return b +} + +// WithClientSecret sets the ClientSecret field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ClientSecret field is set to the value of the last call. +func (b *OAuth2ApplyConfiguration) WithClientSecret(value *SecretKeySelectorApplyConfiguration) *OAuth2ApplyConfiguration { + b.ClientSecret = value + return b +} + +// WithTokenURL sets the TokenURL field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TokenURL field is set to the value of the last call. +func (b *OAuth2ApplyConfiguration) WithTokenURL(value string) *OAuth2ApplyConfiguration { + b.TokenURL = &value + return b +} + +// WithScopes adds the given value to the Scopes field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Scopes field. +func (b *OAuth2ApplyConfiguration) WithScopes(values ...string) *OAuth2ApplyConfiguration { + for i := range values { + b.Scopes = append(b.Scopes, values[i]) + } + return b +} + +// WithEndpointParams adds the given value to the EndpointParams field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the EndpointParams field. +func (b *OAuth2ApplyConfiguration) WithEndpointParams(values ...*OAuth2EndpointParamApplyConfiguration) *OAuth2ApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithEndpointParams") + } + b.EndpointParams = append(b.EndpointParams, *values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/oauth2endpointparam.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/oauth2endpointparam.go new file mode 100644 index 0000000000..8372d30f8c --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/oauth2endpointparam.go @@ -0,0 +1,39 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// OAuth2EndpointParamApplyConfiguration represents a declarative configuration of the OAuth2EndpointParam type for use +// with apply. +// +// OAuth2EndpointParam defines a name/value parameter for the OAuth2 token URL. +type OAuth2EndpointParamApplyConfiguration struct { + // name is the parameter name. Must be between 1 and 256 characters. + Name *string `json:"name,omitempty"` + // value is the optional parameter value. When omitted, the query parameter is applied as ?name (no value). + // When set (including to the empty string), it is applied as ?name=value. Empty string may be used when the + // external system expects a parameter with an empty value (e.g. ?parameter=""). + // Must be between 0 and 2048 characters when present (aligned with common URL length recommendations). + Value *string `json:"value,omitempty"` +} + +// OAuth2EndpointParamApplyConfiguration constructs a declarative configuration of the OAuth2EndpointParam type for use with +// apply. +func OAuth2EndpointParam() *OAuth2EndpointParamApplyConfiguration { + return &OAuth2EndpointParamApplyConfiguration{} +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *OAuth2EndpointParamApplyConfiguration) WithName(value string) *OAuth2EndpointParamApplyConfiguration { + b.Name = &value + return b +} + +// WithValue sets the Value field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Value field is set to the value of the last call. +func (b *OAuth2EndpointParamApplyConfiguration) WithValue(value string) *OAuth2EndpointParamApplyConfiguration { + b.Value = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go new file mode 100644 index 0000000000..daef85c244 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/openshiftstatemetricsconfig.go @@ -0,0 +1,117 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1 "k8s.io/api/core/v1" +) + +// OpenShiftStateMetricsConfigApplyConfiguration represents a declarative configuration of the OpenShiftStateMetricsConfig type for use +// with apply. +// +// OpenShiftStateMetricsConfig provides configuration options for the openshift-state-metrics agent +// that runs in the `openshift-monitoring` namespace. The openshift-state-metrics agent generates +// metrics about the state of OpenShift-specific Kubernetes objects, such as routes, builds, and deployments. +type OpenShiftStateMetricsConfigApplyConfiguration struct { + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries. + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // resources defines the compute resource requests and limits for the openshift-state-metrics container. + // This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. + // When not specified, defaults are used by the platform. Requests cannot exceed limits. + // This field is optional. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 1m + // limit: null + // - name: memory + // request: 32Mi + // limit: null + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how openshift-state-metrics Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Default is empty list. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` +} + +// OpenShiftStateMetricsConfigApplyConfiguration constructs a declarative configuration of the OpenShiftStateMetricsConfig type for use with +// apply. +func OpenShiftStateMetricsConfig() *OpenShiftStateMetricsConfigApplyConfiguration { + return &OpenShiftStateMetricsConfigApplyConfiguration{} +} + +// WithNodeSelector puts the entries into the NodeSelector field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the NodeSelector field, +// overwriting an existing map entries in NodeSelector field with the same key. +func (b *OpenShiftStateMetricsConfigApplyConfiguration) WithNodeSelector(entries map[string]string) *OpenShiftStateMetricsConfigApplyConfiguration { + if b.NodeSelector == nil && len(entries) > 0 { + b.NodeSelector = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.NodeSelector[k] = v + } + return b +} + +// WithResources adds the given value to the Resources field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Resources field. +func (b *OpenShiftStateMetricsConfigApplyConfiguration) WithResources(values ...*ContainerResourceApplyConfiguration) *OpenShiftStateMetricsConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithResources") + } + b.Resources = append(b.Resources, *values[i]) + } + return b +} + +// WithTolerations adds the given value to the Tolerations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Tolerations field. +func (b *OpenShiftStateMetricsConfigApplyConfiguration) WithTolerations(values ...v1.Toleration) *OpenShiftStateMetricsConfigApplyConfiguration { + for i := range values { + b.Tolerations = append(b.Tolerations, values[i]) + } + return b +} + +// WithTopologySpreadConstraints adds the given value to the TopologySpreadConstraints field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the TopologySpreadConstraints field. +func (b *OpenShiftStateMetricsConfigApplyConfiguration) WithTopologySpreadConstraints(values ...v1.TopologySpreadConstraint) *OpenShiftStateMetricsConfigApplyConfiguration { + for i := range values { + b.TopologySpreadConstraints = append(b.TopologySpreadConstraints, values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/pkicertificatesubject.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/pkicertificatesubject.go deleted file mode 100644 index c9c93a2806..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/pkicertificatesubject.go +++ /dev/null @@ -1,39 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -// PKICertificateSubjectApplyConfiguration represents a declarative configuration of the PKICertificateSubject type for use -// with apply. -// -// PKICertificateSubject defines the requirements imposed on the subject to which the certificate was issued. -type PKICertificateSubjectApplyConfiguration struct { - // email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate. - // The email should be a valid email address and at most 320 characters in length. - Email *string `json:"email,omitempty"` - // hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate. - // The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length. - // It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk. - Hostname *string `json:"hostname,omitempty"` -} - -// PKICertificateSubjectApplyConfiguration constructs a declarative configuration of the PKICertificateSubject type for use with -// apply. -func PKICertificateSubject() *PKICertificateSubjectApplyConfiguration { - return &PKICertificateSubjectApplyConfiguration{} -} - -// WithEmail sets the Email field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Email field is set to the value of the last call. -func (b *PKICertificateSubjectApplyConfiguration) WithEmail(value string) *PKICertificateSubjectApplyConfiguration { - b.Email = &value - return b -} - -// WithHostname sets the Hostname field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Hostname field is set to the value of the last call. -func (b *PKICertificateSubjectApplyConfiguration) WithHostname(value string) *PKICertificateSubjectApplyConfiguration { - b.Hostname = &value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyfulciosubject.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyfulciosubject.go deleted file mode 100644 index 5c7bd5ed9e..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyfulciosubject.go +++ /dev/null @@ -1,38 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -// PolicyFulcioSubjectApplyConfiguration represents a declarative configuration of the PolicyFulcioSubject type for use -// with apply. -// -// PolicyFulcioSubject defines the OIDC issuer and the email of the Fulcio authentication configuration. -type PolicyFulcioSubjectApplyConfiguration struct { - // oidcIssuer contains the expected OIDC issuer. It will be verified that the Fulcio-issued certificate contains a (Fulcio-defined) certificate extension pointing at this OIDC issuer URL. When Fulcio issues certificates, it includes a value based on an URL inside the client-provided ID token. - // Example: "https://expected.OIDC.issuer/" - OIDCIssuer *string `json:"oidcIssuer,omitempty"` - // signedEmail holds the email address the the Fulcio certificate is issued for. - // Example: "expected-signing-user@example.com" - SignedEmail *string `json:"signedEmail,omitempty"` -} - -// PolicyFulcioSubjectApplyConfiguration constructs a declarative configuration of the PolicyFulcioSubject type for use with -// apply. -func PolicyFulcioSubject() *PolicyFulcioSubjectApplyConfiguration { - return &PolicyFulcioSubjectApplyConfiguration{} -} - -// WithOIDCIssuer sets the OIDCIssuer field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the OIDCIssuer field is set to the value of the last call. -func (b *PolicyFulcioSubjectApplyConfiguration) WithOIDCIssuer(value string) *PolicyFulcioSubjectApplyConfiguration { - b.OIDCIssuer = &value - return b -} - -// WithSignedEmail sets the SignedEmail field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the SignedEmail field is set to the value of the last call. -func (b *PolicyFulcioSubjectApplyConfiguration) WithSignedEmail(value string) *PolicyFulcioSubjectApplyConfiguration { - b.SignedEmail = &value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyidentity.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyidentity.go deleted file mode 100644 index 822e756774..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyidentity.go +++ /dev/null @@ -1,57 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// PolicyIdentityApplyConfiguration represents a declarative configuration of the PolicyIdentity type for use -// with apply. -// -// PolicyIdentity defines image identity the signature claims about the image. When omitted, the default matchPolicy is "MatchRepoDigestOrExact". -type PolicyIdentityApplyConfiguration struct { - // matchPolicy sets the type of matching to be used. - // Valid values are "MatchRepoDigestOrExact", "MatchRepository", "ExactRepository", "RemapIdentity". When omitted, the default value is "MatchRepoDigestOrExact". - // If set matchPolicy to ExactRepository, then the exactRepository must be specified. - // If set matchPolicy to RemapIdentity, then the remapIdentity must be specified. - // "MatchRepoDigestOrExact" means that the identity in the signature must be in the same repository as the image identity if the image identity is referenced by a digest. Otherwise, the identity in the signature must be the same as the image identity. - // "MatchRepository" means that the identity in the signature must be in the same repository as the image identity. - // "ExactRepository" means that the identity in the signature must be in the same repository as a specific identity specified by "repository". - // "RemapIdentity" means that the signature must be in the same as the remapped image identity. Remapped image identity is obtained by replacing the "prefix" with the specified “signedPrefix” if the the image identity matches the specified remapPrefix. - MatchPolicy *configv1alpha1.IdentityMatchPolicy `json:"matchPolicy,omitempty"` - // exactRepository is required if matchPolicy is set to "ExactRepository". - PolicyMatchExactRepository *PolicyMatchExactRepositoryApplyConfiguration `json:"exactRepository,omitempty"` - // remapIdentity is required if matchPolicy is set to "RemapIdentity". - PolicyMatchRemapIdentity *PolicyMatchRemapIdentityApplyConfiguration `json:"remapIdentity,omitempty"` -} - -// PolicyIdentityApplyConfiguration constructs a declarative configuration of the PolicyIdentity type for use with -// apply. -func PolicyIdentity() *PolicyIdentityApplyConfiguration { - return &PolicyIdentityApplyConfiguration{} -} - -// WithMatchPolicy sets the MatchPolicy field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the MatchPolicy field is set to the value of the last call. -func (b *PolicyIdentityApplyConfiguration) WithMatchPolicy(value configv1alpha1.IdentityMatchPolicy) *PolicyIdentityApplyConfiguration { - b.MatchPolicy = &value - return b -} - -// WithPolicyMatchExactRepository sets the PolicyMatchExactRepository field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the PolicyMatchExactRepository field is set to the value of the last call. -func (b *PolicyIdentityApplyConfiguration) WithPolicyMatchExactRepository(value *PolicyMatchExactRepositoryApplyConfiguration) *PolicyIdentityApplyConfiguration { - b.PolicyMatchExactRepository = value - return b -} - -// WithPolicyMatchRemapIdentity sets the PolicyMatchRemapIdentity field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the PolicyMatchRemapIdentity field is set to the value of the last call. -func (b *PolicyIdentityApplyConfiguration) WithPolicyMatchRemapIdentity(value *PolicyMatchRemapIdentityApplyConfiguration) *PolicyIdentityApplyConfiguration { - b.PolicyMatchRemapIdentity = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policymatchexactrepository.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policymatchexactrepository.go deleted file mode 100644 index 6420b8ed9e..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policymatchexactrepository.go +++ /dev/null @@ -1,29 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// PolicyMatchExactRepositoryApplyConfiguration represents a declarative configuration of the PolicyMatchExactRepository type for use -// with apply. -type PolicyMatchExactRepositoryApplyConfiguration struct { - // repository is the reference of the image identity to be matched. - // The value should be a repository name (by omitting the tag or digest) in a registry implementing the "Docker Registry HTTP API V2". For example, docker.io/library/busybox - Repository *configv1alpha1.IdentityRepositoryPrefix `json:"repository,omitempty"` -} - -// PolicyMatchExactRepositoryApplyConfiguration constructs a declarative configuration of the PolicyMatchExactRepository type for use with -// apply. -func PolicyMatchExactRepository() *PolicyMatchExactRepositoryApplyConfiguration { - return &PolicyMatchExactRepositoryApplyConfiguration{} -} - -// WithRepository sets the Repository field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Repository field is set to the value of the last call. -func (b *PolicyMatchExactRepositoryApplyConfiguration) WithRepository(value configv1alpha1.IdentityRepositoryPrefix) *PolicyMatchExactRepositoryApplyConfiguration { - b.Repository = &value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policymatchremapidentity.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policymatchremapidentity.go deleted file mode 100644 index 0b1a5098fa..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policymatchremapidentity.go +++ /dev/null @@ -1,45 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// PolicyMatchRemapIdentityApplyConfiguration represents a declarative configuration of the PolicyMatchRemapIdentity type for use -// with apply. -type PolicyMatchRemapIdentityApplyConfiguration struct { - // prefix is the prefix of the image identity to be matched. - // If the image identity matches the specified prefix, that prefix is replaced by the specified “signedPrefix” (otherwise it is used as unchanged and no remapping takes place). - // This useful when verifying signatures for a mirror of some other repository namespace that preserves the vendor’s repository structure. - // The prefix and signedPrefix values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, - // or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. - // For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox. - Prefix *configv1alpha1.IdentityRepositoryPrefix `json:"prefix,omitempty"` - // signedPrefix is the prefix of the image identity to be matched in the signature. The format is the same as "prefix". The values can be either host[:port] values (matching exactly the same host[:port], string), repository namespaces, - // or repositories (i.e. they must not contain tags/digests), and match as prefixes of the fully expanded form. - // For example, docker.io/library/busybox (not busybox) to specify that single repository, or docker.io/library (not an empty string) to specify the parent namespace of docker.io/library/busybox. - SignedPrefix *configv1alpha1.IdentityRepositoryPrefix `json:"signedPrefix,omitempty"` -} - -// PolicyMatchRemapIdentityApplyConfiguration constructs a declarative configuration of the PolicyMatchRemapIdentity type for use with -// apply. -func PolicyMatchRemapIdentity() *PolicyMatchRemapIdentityApplyConfiguration { - return &PolicyMatchRemapIdentityApplyConfiguration{} -} - -// WithPrefix sets the Prefix field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Prefix field is set to the value of the last call. -func (b *PolicyMatchRemapIdentityApplyConfiguration) WithPrefix(value configv1alpha1.IdentityRepositoryPrefix) *PolicyMatchRemapIdentityApplyConfiguration { - b.Prefix = &value - return b -} - -// WithSignedPrefix sets the SignedPrefix field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the SignedPrefix field is set to the value of the last call. -func (b *PolicyMatchRemapIdentityApplyConfiguration) WithSignedPrefix(value configv1alpha1.IdentityRepositoryPrefix) *PolicyMatchRemapIdentityApplyConfiguration { - b.SignedPrefix = &value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyrootoftrust.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyrootoftrust.go deleted file mode 100644 index b7a1877fc4..0000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/policyrootoftrust.go +++ /dev/null @@ -1,65 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// PolicyRootOfTrustApplyConfiguration represents a declarative configuration of the PolicyRootOfTrust type for use -// with apply. -// -// PolicyRootOfTrust defines the root of trust based on the selected policyType. -type PolicyRootOfTrustApplyConfiguration struct { - // policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust. - // "PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification. - // "FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification. - // "PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate. - PolicyType *configv1alpha1.PolicyType `json:"policyType,omitempty"` - // publicKey defines the root of trust based on a sigstore public key. - PublicKey *ImagePolicyPublicKeyRootOfTrustApplyConfiguration `json:"publicKey,omitempty"` - // fulcioCAWithRekor defines the root of trust based on the Fulcio certificate and the Rekor public key. - // For more information about Fulcio and Rekor, please refer to the document at: - // https://github.com/sigstore/fulcio and https://github.com/sigstore/rekor - FulcioCAWithRekor *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration `json:"fulcioCAWithRekor,omitempty"` - // pki defines the root of trust based on Bring Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and corresponding intermediate certificates. - PKI *ImagePolicyPKIRootOfTrustApplyConfiguration `json:"pki,omitempty"` -} - -// PolicyRootOfTrustApplyConfiguration constructs a declarative configuration of the PolicyRootOfTrust type for use with -// apply. -func PolicyRootOfTrust() *PolicyRootOfTrustApplyConfiguration { - return &PolicyRootOfTrustApplyConfiguration{} -} - -// WithPolicyType sets the PolicyType field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the PolicyType field is set to the value of the last call. -func (b *PolicyRootOfTrustApplyConfiguration) WithPolicyType(value configv1alpha1.PolicyType) *PolicyRootOfTrustApplyConfiguration { - b.PolicyType = &value - return b -} - -// WithPublicKey sets the PublicKey field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the PublicKey field is set to the value of the last call. -func (b *PolicyRootOfTrustApplyConfiguration) WithPublicKey(value *ImagePolicyPublicKeyRootOfTrustApplyConfiguration) *PolicyRootOfTrustApplyConfiguration { - b.PublicKey = value - return b -} - -// WithFulcioCAWithRekor sets the FulcioCAWithRekor field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the FulcioCAWithRekor field is set to the value of the last call. -func (b *PolicyRootOfTrustApplyConfiguration) WithFulcioCAWithRekor(value *ImagePolicyFulcioCAWithRekorRootOfTrustApplyConfiguration) *PolicyRootOfTrustApplyConfiguration { - b.FulcioCAWithRekor = value - return b -} - -// WithPKI sets the PKI field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the PKI field is set to the value of the last call. -func (b *PolicyRootOfTrustApplyConfiguration) WithPKI(value *ImagePolicyPKIRootOfTrustApplyConfiguration) *PolicyRootOfTrustApplyConfiguration { - b.PKI = value - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go new file mode 100644 index 0000000000..31d3b9f58e --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusconfig.go @@ -0,0 +1,282 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + v1 "k8s.io/api/core/v1" +) + +// PrometheusConfigApplyConfiguration represents a declarative configuration of the PrometheusConfig type for use +// with apply. +// +// PrometheusConfig provides configuration options for the Prometheus instance. +// Use this configuration to control +// Prometheus deployment, pod scheduling, resource allocation, retention policies, and external integrations. +type PrometheusConfigApplyConfiguration struct { + // additionalAlertmanagerConfigs configures additional Alertmanager instances that receive alerts from + // the Prometheus component. This is useful for organizations that need to: + // - Send alerts to external monitoring systems (like PagerDuty, Slack, or custom webhooks) + // - Route different types of alerts to different teams or systems + // - Integrate with existing enterprise alerting infrastructure + // - Maintain separate alert routing for compliance or organizational requirements + // When omitted, no additional Alertmanager instances are configured (default behavior). + // When provided, at least one configuration must be specified (minimum 1, maximum 10 items). + // Entries must have unique names (name is the list key). + AdditionalAlertmanagerConfigs []AdditionalAlertmanagerConfigApplyConfiguration `json:"additionalAlertmanagerConfigs,omitempty"` + // enforcedBodySizeLimitBytes enforces a body size limit (in bytes) for Prometheus scraped metrics. + // If a scraped target's body response is larger than the limit, the scrape will fail. + // This helps protect Prometheus from targets that return excessively large responses. + // The value is specified in bytes (e.g., 4194304 for 4MB, 1073741824 for 1GB). + // When omitted, the Cluster Monitoring Operator automatically calculates an appropriate + // limit based on cluster capacity. Set an explicit value to override the automatic calculation. + // Minimum value is 10240 (10kB). + // Maximum value is 1073741824 (1GB). + EnforcedBodySizeLimitBytes *int64 `json:"enforcedBodySizeLimitBytes,omitempty"` + // externalLabels defines labels to be attached to time series and alerts + // when communicating with external systems such as federation, remote storage, + // and Alertmanager. These labels are not stored with metrics on disk; they are + // only added when data leaves Prometheus (e.g., during federation queries, + // remote write, or alert notifications). + // At least 1 label must be specified when set, with a maximum of 50 labels allowed. + // Each label key must be unique within this list. + // When omitted, no external labels are applied. + ExternalLabels []LabelApplyConfiguration `json:"externalLabels,omitempty"` + // logLevel defines the verbosity of logs emitted by Prometheus. + // This field allows users to control the amount and severity of logs generated, which can be useful + // for debugging issues or reducing noise in production environments. + // Allowed values are Error, Warn, Info, and Debug. + // When set to Error, only errors will be logged. + // When set to Warn, both warnings and errors will be logged. + // When set to Info, general information, warnings, and errors will all be logged. + // When set to Debug, detailed debugging information will be logged. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, that is subject to change over time. + // The current default value is `Info`. + LogLevel *configv1alpha1.LogLevel `json:"logLevel,omitempty"` + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least one key-value pair (minimum of 1) + // and must not contain more than 10 entries. + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // queryLogFile specifies the file to which PromQL queries are logged. + // This setting can be either a filename, in which + // case the queries are saved to an `emptyDir` volume + // at `/var/log/prometheus`, or a full path to a location where + // an `emptyDir` volume will be mounted and the queries saved. + // Writing to `/dev/stderr`, `/dev/stdout` or `/dev/null` is supported, but + // writing to any other `/dev/` path is not supported. Relative paths are + // also not supported. + // By default, PromQL queries are not logged. + // Must be an absolute path starting with `/` or a simple filename without path separators. + // Must not contain consecutive slashes, end with a slash, or include '..' path traversal. + // Must contain only alphanumeric characters, '.', '_', '-', or '/'. + // Must be between 1 and 255 characters in length. + QueryLogFile *string `json:"queryLogFile,omitempty"` + // remoteWrite defines the remote write configuration, including URL, authentication, and relabeling settings. + // Remote write allows Prometheus to send metrics it collects to external long-term storage systems. + // When omitted, no remote write endpoints are configured. + // When provided, at least one configuration must be specified (minimum 1, maximum 10 items). + // Entries must have unique names (name is the list key). + RemoteWrite []RemoteWriteSpecApplyConfiguration `json:"remoteWrite,omitempty"` + // resources defines the compute resource requests and limits for the Prometheus container. + // This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. + // When not specified, defaults are used by the platform. Requests cannot exceed limits. + // This field is optional. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 4m + // limit: null + // - name: memory + // request: 40Mi + // limit: null + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` + // retention configures how long Prometheus retains metrics data and how much storage it can use. + // When omitted, the platform chooses reasonable defaults (currently 15 days retention, no size limit). + Retention *RetentionApplyConfiguration `json:"retention,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10 + // Minimum length for this list is 1 + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how Prometheus Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Default is empty list. + // Maximum length for this list is 10. + // Minimum length for this list is 1 + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` + // collectionProfile defines the metrics collection profile that Prometheus uses to collect + // metrics from the platform components. Supported values are `Full` or + // `Minimal`. In the `Full` profile (default), Prometheus collects all + // metrics that are exposed by the platform components. In the `Minimal` + // profile, Prometheus only collects metrics necessary for the default + // platform alerts, recording rules, telemetry and console dashboards. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is `Full`. + CollectionProfile *configv1alpha1.CollectionProfile `json:"collectionProfile,omitempty"` + // volumeClaimTemplate defines persistent storage for Prometheus. Use this setting to + // configure the persistent volume claim, including storage class and volume size. + // If omitted, the Pod uses ephemeral storage and Prometheus data will not persist + // across restarts. + VolumeClaimTemplate *v1.PersistentVolumeClaim `json:"volumeClaimTemplate,omitempty"` +} + +// PrometheusConfigApplyConfiguration constructs a declarative configuration of the PrometheusConfig type for use with +// apply. +func PrometheusConfig() *PrometheusConfigApplyConfiguration { + return &PrometheusConfigApplyConfiguration{} +} + +// WithAdditionalAlertmanagerConfigs adds the given value to the AdditionalAlertmanagerConfigs field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the AdditionalAlertmanagerConfigs field. +func (b *PrometheusConfigApplyConfiguration) WithAdditionalAlertmanagerConfigs(values ...*AdditionalAlertmanagerConfigApplyConfiguration) *PrometheusConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithAdditionalAlertmanagerConfigs") + } + b.AdditionalAlertmanagerConfigs = append(b.AdditionalAlertmanagerConfigs, *values[i]) + } + return b +} + +// WithEnforcedBodySizeLimitBytes sets the EnforcedBodySizeLimitBytes field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the EnforcedBodySizeLimitBytes field is set to the value of the last call. +func (b *PrometheusConfigApplyConfiguration) WithEnforcedBodySizeLimitBytes(value int64) *PrometheusConfigApplyConfiguration { + b.EnforcedBodySizeLimitBytes = &value + return b +} + +// WithExternalLabels adds the given value to the ExternalLabels field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the ExternalLabels field. +func (b *PrometheusConfigApplyConfiguration) WithExternalLabels(values ...*LabelApplyConfiguration) *PrometheusConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithExternalLabels") + } + b.ExternalLabels = append(b.ExternalLabels, *values[i]) + } + return b +} + +// WithLogLevel sets the LogLevel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the LogLevel field is set to the value of the last call. +func (b *PrometheusConfigApplyConfiguration) WithLogLevel(value configv1alpha1.LogLevel) *PrometheusConfigApplyConfiguration { + b.LogLevel = &value + return b +} + +// WithNodeSelector puts the entries into the NodeSelector field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the NodeSelector field, +// overwriting an existing map entries in NodeSelector field with the same key. +func (b *PrometheusConfigApplyConfiguration) WithNodeSelector(entries map[string]string) *PrometheusConfigApplyConfiguration { + if b.NodeSelector == nil && len(entries) > 0 { + b.NodeSelector = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.NodeSelector[k] = v + } + return b +} + +// WithQueryLogFile sets the QueryLogFile field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the QueryLogFile field is set to the value of the last call. +func (b *PrometheusConfigApplyConfiguration) WithQueryLogFile(value string) *PrometheusConfigApplyConfiguration { + b.QueryLogFile = &value + return b +} + +// WithRemoteWrite adds the given value to the RemoteWrite field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the RemoteWrite field. +func (b *PrometheusConfigApplyConfiguration) WithRemoteWrite(values ...*RemoteWriteSpecApplyConfiguration) *PrometheusConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithRemoteWrite") + } + b.RemoteWrite = append(b.RemoteWrite, *values[i]) + } + return b +} + +// WithResources adds the given value to the Resources field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Resources field. +func (b *PrometheusConfigApplyConfiguration) WithResources(values ...*ContainerResourceApplyConfiguration) *PrometheusConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithResources") + } + b.Resources = append(b.Resources, *values[i]) + } + return b +} + +// WithRetention sets the Retention field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Retention field is set to the value of the last call. +func (b *PrometheusConfigApplyConfiguration) WithRetention(value *RetentionApplyConfiguration) *PrometheusConfigApplyConfiguration { + b.Retention = value + return b +} + +// WithTolerations adds the given value to the Tolerations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Tolerations field. +func (b *PrometheusConfigApplyConfiguration) WithTolerations(values ...v1.Toleration) *PrometheusConfigApplyConfiguration { + for i := range values { + b.Tolerations = append(b.Tolerations, values[i]) + } + return b +} + +// WithTopologySpreadConstraints adds the given value to the TopologySpreadConstraints field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the TopologySpreadConstraints field. +func (b *PrometheusConfigApplyConfiguration) WithTopologySpreadConstraints(values ...v1.TopologySpreadConstraint) *PrometheusConfigApplyConfiguration { + for i := range values { + b.TopologySpreadConstraints = append(b.TopologySpreadConstraints, values[i]) + } + return b +} + +// WithCollectionProfile sets the CollectionProfile field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CollectionProfile field is set to the value of the last call. +func (b *PrometheusConfigApplyConfiguration) WithCollectionProfile(value configv1alpha1.CollectionProfile) *PrometheusConfigApplyConfiguration { + b.CollectionProfile = &value + return b +} + +// WithVolumeClaimTemplate sets the VolumeClaimTemplate field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the VolumeClaimTemplate field is set to the value of the last call. +func (b *PrometheusConfigApplyConfiguration) WithVolumeClaimTemplate(value v1.PersistentVolumeClaim) *PrometheusConfigApplyConfiguration { + b.VolumeClaimTemplate = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go index b35fb15fef..9eadb023ec 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatoradmissionwebhookconfig.go @@ -29,7 +29,7 @@ type PrometheusOperatorAdmissionWebhookConfigApplyConfiguration struct { // - name: memory // request: 30Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go index 2612926255..a0bac703d0 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusoperatorconfig.go @@ -46,7 +46,7 @@ type PrometheusOperatorConfigApplyConfiguration struct { // - name: memory // request: 40Mi // limit: null - // Maximum length for this list is 10. + // Maximum length for this list is 5. // Minimum length for this list is 1. // Each resource name must be unique within this list. Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusremotewriteheader.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusremotewriteheader.go new file mode 100644 index 0000000000..53e21d1f9d --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/prometheusremotewriteheader.go @@ -0,0 +1,40 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// PrometheusRemoteWriteHeaderApplyConfiguration represents a declarative configuration of the PrometheusRemoteWriteHeader type for use +// with apply. +// +// PrometheusRemoteWriteHeader defines a custom HTTP header for remote write requests. +// The header name must not be one of the reserved headers set by Prometheus (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate). +// Header names must contain only case-insensitive alphanumeric characters, hyphens (-), and underscores (_); other characters (e.g. emoji) are rejected by validation. +// Validation is enforced on the Headers field in RemoteWriteSpec. +type PrometheusRemoteWriteHeaderApplyConfiguration struct { + // name is the HTTP header name. Must not be a reserved header (see type documentation). + // Must contain only alphanumeric characters, hyphens, and underscores; invalid characters are rejected. Must be between 1 and 256 characters. + Name *string `json:"name,omitempty"` + // value is the HTTP header value. Must be at most 4096 characters. + Value *string `json:"value,omitempty"` +} + +// PrometheusRemoteWriteHeaderApplyConfiguration constructs a declarative configuration of the PrometheusRemoteWriteHeader type for use with +// apply. +func PrometheusRemoteWriteHeader() *PrometheusRemoteWriteHeaderApplyConfiguration { + return &PrometheusRemoteWriteHeaderApplyConfiguration{} +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *PrometheusRemoteWriteHeaderApplyConfiguration) WithName(value string) *PrometheusRemoteWriteHeaderApplyConfiguration { + b.Name = &value + return b +} + +// WithValue sets the Value field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Value field is set to the value of the last call. +func (b *PrometheusRemoteWriteHeaderApplyConfiguration) WithValue(value string) *PrometheusRemoteWriteHeaderApplyConfiguration { + b.Value = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/queueconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/queueconfig.go new file mode 100644 index 0000000000..a24ff44ace --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/queueconfig.go @@ -0,0 +1,129 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// QueueConfigApplyConfiguration represents a declarative configuration of the QueueConfig type for use +// with apply. +// +// QueueConfig allows tuning configuration for remote write queue parameters. +// Configure this when you need to control throughput, backpressure, or retry behavior—for example to avoid overloading the remote endpoint, to reduce memory usage, or to tune for high-cardinality workloads. Consider capacity, maxShards, and batchSendDeadlineSeconds for throughput; minBackoffMilliseconds and maxBackoffMilliseconds for retries; and rateLimitedAction when the remote returns HTTP 429. +type QueueConfigApplyConfiguration struct { + // capacity is the number of samples to buffer per shard before we start dropping them. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 10000. + // Minimum value is 1. + // Maximum value is 1000000. + Capacity *int32 `json:"capacity,omitempty"` + // maxShards is the maximum number of shards, i.e. amount of concurrency. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 200. + // Minimum value is 1. + // Maximum value is 10000. + MaxShards *int32 `json:"maxShards,omitempty"` + // minShards is the minimum number of shards, i.e. amount of concurrency. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 1. + // Minimum value is 1. + // Maximum value is 10000. + MinShards *int32 `json:"minShards,omitempty"` + // maxSamplesPerSend is the maximum number of samples per send. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 1000. + // Minimum value is 1. + // Maximum value is 100000. + MaxSamplesPerSend *int32 `json:"maxSamplesPerSend,omitempty"` + // batchSendDeadlineSeconds is the maximum time in seconds a sample will wait in buffer before being sent. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 second. + // Maximum value is 3600 seconds (1 hour). + BatchSendDeadlineSeconds *int32 `json:"batchSendDeadlineSeconds,omitempty"` + // minBackoffMilliseconds is the minimum retry delay in milliseconds. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 millisecond. + // Maximum value is 3600000 milliseconds (1 hour). + MinBackoffMilliseconds *int32 `json:"minBackoffMilliseconds,omitempty"` + // maxBackoffMilliseconds is the maximum retry delay in milliseconds. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 millisecond. + // Maximum value is 3600000 milliseconds (1 hour). + MaxBackoffMilliseconds *int32 `json:"maxBackoffMilliseconds,omitempty"` + // rateLimitedAction controls what to do when the remote write endpoint returns HTTP 429 (Too Many Requests). + // When omitted, no retries are performed on rate limit responses. + // When set to "Retry", Prometheus will retry such requests using the backoff settings above. + // Valid value when set is "Retry". + RateLimitedAction *configv1alpha1.RateLimitedAction `json:"rateLimitedAction,omitempty"` +} + +// QueueConfigApplyConfiguration constructs a declarative configuration of the QueueConfig type for use with +// apply. +func QueueConfig() *QueueConfigApplyConfiguration { + return &QueueConfigApplyConfiguration{} +} + +// WithCapacity sets the Capacity field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Capacity field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithCapacity(value int32) *QueueConfigApplyConfiguration { + b.Capacity = &value + return b +} + +// WithMaxShards sets the MaxShards field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the MaxShards field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithMaxShards(value int32) *QueueConfigApplyConfiguration { + b.MaxShards = &value + return b +} + +// WithMinShards sets the MinShards field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the MinShards field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithMinShards(value int32) *QueueConfigApplyConfiguration { + b.MinShards = &value + return b +} + +// WithMaxSamplesPerSend sets the MaxSamplesPerSend field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the MaxSamplesPerSend field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithMaxSamplesPerSend(value int32) *QueueConfigApplyConfiguration { + b.MaxSamplesPerSend = &value + return b +} + +// WithBatchSendDeadlineSeconds sets the BatchSendDeadlineSeconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BatchSendDeadlineSeconds field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithBatchSendDeadlineSeconds(value int32) *QueueConfigApplyConfiguration { + b.BatchSendDeadlineSeconds = &value + return b +} + +// WithMinBackoffMilliseconds sets the MinBackoffMilliseconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the MinBackoffMilliseconds field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithMinBackoffMilliseconds(value int32) *QueueConfigApplyConfiguration { + b.MinBackoffMilliseconds = &value + return b +} + +// WithMaxBackoffMilliseconds sets the MaxBackoffMilliseconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the MaxBackoffMilliseconds field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithMaxBackoffMilliseconds(value int32) *QueueConfigApplyConfiguration { + b.MaxBackoffMilliseconds = &value + return b +} + +// WithRateLimitedAction sets the RateLimitedAction field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the RateLimitedAction field is set to the value of the last call. +func (b *QueueConfigApplyConfiguration) WithRateLimitedAction(value configv1alpha1.RateLimitedAction) *QueueConfigApplyConfiguration { + b.RateLimitedAction = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/relabelactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/relabelactionconfig.go new file mode 100644 index 0000000000..cfcfc7b5cc --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/relabelactionconfig.go @@ -0,0 +1,135 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// RelabelActionConfigApplyConfiguration represents a declarative configuration of the RelabelActionConfig type for use +// with apply. +// +// RelabelActionConfig represents the action to perform and its configuration. +// Exactly one action-specific configuration must be specified based on the action type. +type RelabelActionConfigApplyConfiguration struct { + // type specifies the action to perform on the matched labels. + // Allowed values are Replace, Lowercase, Uppercase, Keep, Drop, KeepEqual, DropEqual, HashMod, LabelMap, LabelDrop, LabelKeep. + // + // When set to Replace, regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. If regex does not match, no replacement takes place. + // + // When set to Lowercase, the concatenated source_labels are mapped to their lower case. Requires Prometheus >= v2.36.0. + // + // When set to Uppercase, the concatenated source_labels are mapped to their upper case. Requires Prometheus >= v2.36.0. + // + // When set to Keep, targets for which regex does not match the concatenated source_labels are dropped. + // + // When set to Drop, targets for which regex matches the concatenated source_labels are dropped. + // + // When set to KeepEqual, targets for which the concatenated source_labels do not match target_label are dropped. Requires Prometheus >= v2.41.0. + // + // When set to DropEqual, targets for which the concatenated source_labels do match target_label are dropped. Requires Prometheus >= v2.41.0. + // + // When set to HashMod, target_label is set to the modulus of a hash of the concatenated source_labels. + // + // When set to LabelMap, regex is matched against all source label names (not just source_labels); matching label values are copied to new names given by replacement with ${1}, ${2}, ... substituted. + // + // When set to LabelDrop, regex is matched against all label names; any label that matches is removed. + // + // When set to LabelKeep, regex is matched against all label names; any label that does not match is removed. + Type *configv1alpha1.RelabelAction `json:"type,omitempty"` + // replace configures the Replace action. + // Required when type is Replace, and forbidden otherwise. + Replace *ReplaceActionConfigApplyConfiguration `json:"replace,omitempty"` + // hashMod configures the HashMod action. + // Required when type is HashMod, and forbidden otherwise. + HashMod *HashModActionConfigApplyConfiguration `json:"hashMod,omitempty"` + // labelMap configures the LabelMap action. + // Required when type is LabelMap, and forbidden otherwise. + LabelMap *LabelMapActionConfigApplyConfiguration `json:"labelMap,omitempty"` + // lowercase configures the Lowercase action. + // Required when type is Lowercase, and forbidden otherwise. + // Requires Prometheus >= v2.36.0. + Lowercase *LowercaseActionConfigApplyConfiguration `json:"lowercase,omitempty"` + // uppercase configures the Uppercase action. + // Required when type is Uppercase, and forbidden otherwise. + // Requires Prometheus >= v2.36.0. + Uppercase *UppercaseActionConfigApplyConfiguration `json:"uppercase,omitempty"` + // keepEqual configures the KeepEqual action. + // Required when type is KeepEqual, and forbidden otherwise. + // Requires Prometheus >= v2.41.0. + KeepEqual *KeepEqualActionConfigApplyConfiguration `json:"keepEqual,omitempty"` + // dropEqual configures the DropEqual action. + // Required when type is DropEqual, and forbidden otherwise. + // Requires Prometheus >= v2.41.0. + DropEqual *DropEqualActionConfigApplyConfiguration `json:"dropEqual,omitempty"` +} + +// RelabelActionConfigApplyConfiguration constructs a declarative configuration of the RelabelActionConfig type for use with +// apply. +func RelabelActionConfig() *RelabelActionConfigApplyConfiguration { + return &RelabelActionConfigApplyConfiguration{} +} + +// WithType sets the Type field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Type field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithType(value configv1alpha1.RelabelAction) *RelabelActionConfigApplyConfiguration { + b.Type = &value + return b +} + +// WithReplace sets the Replace field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Replace field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithReplace(value *ReplaceActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.Replace = value + return b +} + +// WithHashMod sets the HashMod field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the HashMod field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithHashMod(value *HashModActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.HashMod = value + return b +} + +// WithLabelMap sets the LabelMap field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the LabelMap field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithLabelMap(value *LabelMapActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.LabelMap = value + return b +} + +// WithLowercase sets the Lowercase field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Lowercase field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithLowercase(value *LowercaseActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.Lowercase = value + return b +} + +// WithUppercase sets the Uppercase field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Uppercase field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithUppercase(value *UppercaseActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.Uppercase = value + return b +} + +// WithKeepEqual sets the KeepEqual field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the KeepEqual field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithKeepEqual(value *KeepEqualActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.KeepEqual = value + return b +} + +// WithDropEqual sets the DropEqual field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the DropEqual field is set to the value of the last call. +func (b *RelabelActionConfigApplyConfiguration) WithDropEqual(value *DropEqualActionConfigApplyConfiguration) *RelabelActionConfigApplyConfiguration { + b.DropEqual = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/relabelconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/relabelconfig.go new file mode 100644 index 0000000000..efe191727e --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/relabelconfig.go @@ -0,0 +1,89 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// RelabelConfigApplyConfiguration represents a declarative configuration of the RelabelConfig type for use +// with apply. +// +// RelabelConfig represents a relabeling rule. +type RelabelConfigApplyConfiguration struct { + // name is a unique identifier for this relabel configuration. + // Must contain only alphanumeric characters, hyphens, and underscores. + // Must be between 1 and 63 characters in length. + Name *string `json:"name,omitempty"` + // sourceLabels specifies which label names to extract from each series for this relabeling rule. + // The values of these labels are joined together using the configured separator, + // and the resulting string is then matched against the regular expression. + // If a referenced label does not exist on a series, Prometheus substitutes an empty string. + // When omitted, the rule operates without extracting source labels (useful for actions like labelmap). + // Minimum of 1 and maximum of 10 source labels can be specified, each between 1 and 128 characters. + // Each entry must be unique. + // Label names beginning with "__" (two underscores) are reserved for internal Prometheus use and are not allowed. + // Label names SHOULD start with a letter (a-z, A-Z) or underscore (_), followed by zero or more letters, digits (0-9), or underscores for best compatibility. + // While Prometheus supports UTF-8 characters in label names (since v3.0.0), using the recommended character set + // ensures better compatibility with the wider ecosystem (tooling, third-party instrumentation, etc.). + SourceLabels []string `json:"sourceLabels,omitempty"` + // separator is the character sequence used to join source label values. + // Common examples: ";", ",", "::", "|||". + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is ";". + // Must be between 1 and 5 characters in length when specified. + Separator *string `json:"separator,omitempty"` + // regex is the regular expression to match against the concatenated source label values. + // Must be a valid RE2 regular expression (https://github.com/google/re2/wiki/Syntax). + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is "(.*)" to match everything. + // Must be between 1 and 1000 characters in length when specified. + Regex *string `json:"regex,omitempty"` + // action defines the action to perform on the matched labels and its configuration. + // Exactly one action-specific configuration must be specified based on the action type. + Action *RelabelActionConfigApplyConfiguration `json:"action,omitempty"` +} + +// RelabelConfigApplyConfiguration constructs a declarative configuration of the RelabelConfig type for use with +// apply. +func RelabelConfig() *RelabelConfigApplyConfiguration { + return &RelabelConfigApplyConfiguration{} +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *RelabelConfigApplyConfiguration) WithName(value string) *RelabelConfigApplyConfiguration { + b.Name = &value + return b +} + +// WithSourceLabels adds the given value to the SourceLabels field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the SourceLabels field. +func (b *RelabelConfigApplyConfiguration) WithSourceLabels(values ...string) *RelabelConfigApplyConfiguration { + for i := range values { + b.SourceLabels = append(b.SourceLabels, values[i]) + } + return b +} + +// WithSeparator sets the Separator field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Separator field is set to the value of the last call. +func (b *RelabelConfigApplyConfiguration) WithSeparator(value string) *RelabelConfigApplyConfiguration { + b.Separator = &value + return b +} + +// WithRegex sets the Regex field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Regex field is set to the value of the last call. +func (b *RelabelConfigApplyConfiguration) WithRegex(value string) *RelabelConfigApplyConfiguration { + b.Regex = &value + return b +} + +// WithAction sets the Action field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Action field is set to the value of the last call. +func (b *RelabelConfigApplyConfiguration) WithAction(value *RelabelActionConfigApplyConfiguration) *RelabelConfigApplyConfiguration { + b.Action = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewriteauthorization.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewriteauthorization.go new file mode 100644 index 0000000000..c32870d760 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewriteauthorization.go @@ -0,0 +1,100 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + v1 "k8s.io/api/core/v1" +) + +// RemoteWriteAuthorizationApplyConfiguration represents a declarative configuration of the RemoteWriteAuthorization type for use +// with apply. +// +// RemoteWriteAuthorization defines the authorization method for a remote write endpoint. +// Exactly one of the nested configs must be set according to the type discriminator. +type RemoteWriteAuthorizationApplyConfiguration struct { + // type specifies the authorization method to use. + // Allowed values are BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, ServiceAccount. + // + // When set to BearerToken, the bearer token is read from a Secret referenced by the bearerToken field. + // + // When set to BasicAuth, HTTP basic authentication is used; the basicAuth field (username and password from Secrets) must be set. + // + // When set to OAuth2, OAuth2 client credentials flow is used; the oauth2 field (clientId, clientSecret, tokenUrl) must be set. + // + // When set to SigV4, AWS Signature Version 4 is used for authentication; the sigv4 field must be set. + // + // When set to SafeAuthorization, credentials are read from a single Secret key (Prometheus SafeAuthorization pattern). The secret key typically contains a Bearer token. Use the safeAuthorization field. + // + // When set to ServiceAccount, the pod's service account token is used for machine identity. No additional field is required; the operator configures the token path. + Type *configv1alpha1.RemoteWriteAuthorizationType `json:"type,omitempty"` + // safeAuthorization defines the secret reference containing the credentials for authentication (e.g. Bearer token). + // Required when type is "SafeAuthorization", and forbidden otherwise. Maps to Prometheus SafeAuthorization. The secret must exist in the openshift-monitoring namespace. + SafeAuthorization *v1.SecretKeySelector `json:"safeAuthorization,omitempty"` + // bearerToken defines the secret reference containing the bearer token. + // Required when type is "BearerToken", and forbidden otherwise. + BearerToken *SecretKeySelectorApplyConfiguration `json:"bearerToken,omitempty"` + // basicAuth defines HTTP basic authentication credentials. + // Required when type is "BasicAuth", and forbidden otherwise. + BasicAuth *BasicAuthApplyConfiguration `json:"basicAuth,omitempty"` + // oauth2 defines OAuth2 client credentials authentication. + // Required when type is "OAuth2", and forbidden otherwise. + OAuth2 *OAuth2ApplyConfiguration `json:"oauth2,omitempty"` + // sigv4 defines AWS Signature Version 4 authentication. + // Required when type is "SigV4", and forbidden otherwise. + Sigv4 *Sigv4ApplyConfiguration `json:"sigv4,omitempty"` +} + +// RemoteWriteAuthorizationApplyConfiguration constructs a declarative configuration of the RemoteWriteAuthorization type for use with +// apply. +func RemoteWriteAuthorization() *RemoteWriteAuthorizationApplyConfiguration { + return &RemoteWriteAuthorizationApplyConfiguration{} +} + +// WithType sets the Type field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Type field is set to the value of the last call. +func (b *RemoteWriteAuthorizationApplyConfiguration) WithType(value configv1alpha1.RemoteWriteAuthorizationType) *RemoteWriteAuthorizationApplyConfiguration { + b.Type = &value + return b +} + +// WithSafeAuthorization sets the SafeAuthorization field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SafeAuthorization field is set to the value of the last call. +func (b *RemoteWriteAuthorizationApplyConfiguration) WithSafeAuthorization(value v1.SecretKeySelector) *RemoteWriteAuthorizationApplyConfiguration { + b.SafeAuthorization = &value + return b +} + +// WithBearerToken sets the BearerToken field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BearerToken field is set to the value of the last call. +func (b *RemoteWriteAuthorizationApplyConfiguration) WithBearerToken(value *SecretKeySelectorApplyConfiguration) *RemoteWriteAuthorizationApplyConfiguration { + b.BearerToken = value + return b +} + +// WithBasicAuth sets the BasicAuth field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BasicAuth field is set to the value of the last call. +func (b *RemoteWriteAuthorizationApplyConfiguration) WithBasicAuth(value *BasicAuthApplyConfiguration) *RemoteWriteAuthorizationApplyConfiguration { + b.BasicAuth = value + return b +} + +// WithOAuth2 sets the OAuth2 field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the OAuth2 field is set to the value of the last call. +func (b *RemoteWriteAuthorizationApplyConfiguration) WithOAuth2(value *OAuth2ApplyConfiguration) *RemoteWriteAuthorizationApplyConfiguration { + b.OAuth2 = value + return b +} + +// WithSigv4 sets the Sigv4 field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Sigv4 field is set to the value of the last call. +func (b *RemoteWriteAuthorizationApplyConfiguration) WithSigv4(value *Sigv4ApplyConfiguration) *RemoteWriteAuthorizationApplyConfiguration { + b.Sigv4 = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewritespec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewritespec.go new file mode 100644 index 0000000000..cbb3c0dbcf --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewritespec.go @@ -0,0 +1,175 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// RemoteWriteSpecApplyConfiguration represents a declarative configuration of the RemoteWriteSpec type for use +// with apply. +// +// RemoteWriteSpec represents configuration for remote write endpoints. +type RemoteWriteSpecApplyConfiguration struct { + // url is the URL of the remote write endpoint. + // Must be a valid URL with http or https scheme and a non-empty hostname. + // Query parameters, fragments, and user information (e.g. user:password@host) are not allowed. + // Empty string is invalid. Must be between 1 and 2048 characters in length. + URL *string `json:"url,omitempty"` + // name is a required identifier for this remote write configuration (name is the list key for the remoteWrite list). + // This name is used in metrics and logging to differentiate remote write queues. + // Must contain only alphanumeric characters, hyphens, and underscores. + // Must be between 1 and 63 characters in length. + Name *string `json:"name,omitempty"` + // authorization defines the authorization method for the remote write endpoint. + // When omitted, no authorization is performed. + // When set, type must be one of BearerToken, BasicAuth, OAuth2, SigV4, SafeAuthorization, or ServiceAccount; the corresponding nested config must be set (ServiceAccount has no config). + AuthorizationConfig *RemoteWriteAuthorizationApplyConfiguration `json:"authorization,omitempty"` + // headers specifies the custom HTTP headers to be sent along with each remote write request. + // Sending custom headers makes the configuration of a proxy in between optional and helps the + // receiver recognize the given source better. + // Clients MAY allow users to send custom HTTP headers; they MUST NOT allow users to configure + // them in such a way as to send reserved headers. Headers set by Prometheus cannot be overwritten. + // When omitted, no custom headers are sent. + // Maximum of 50 headers can be specified. Each header name must be unique. + // Each header name must contain only alphanumeric characters, hyphens, and underscores, and must not be a reserved Prometheus header (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate). + Headers []PrometheusRemoteWriteHeaderApplyConfiguration `json:"headers,omitempty"` + // metadataConfig configures the sending of series metadata to remote storage. + // When omitted, no metadata is sent. + // When set to sendPolicy: Default, metadata is sent using platform-chosen defaults (e.g. send interval 30 seconds). + // When set to sendPolicy: Custom, metadata is sent using the settings in the custom field (e.g. custom.sendIntervalSeconds). + MetadataConfig *MetadataConfigApplyConfiguration `json:"metadataConfig,omitempty"` + // proxyUrl defines an optional proxy URL. + // If the cluster-wide proxy is enabled, it replaces the proxyUrl setting. + // The cluster-wide proxy supports both HTTP and HTTPS proxies, with HTTPS taking precedence. + // When omitted, no proxy is used. + // Must be a valid URL with http or https scheme. + // Must be between 1 and 2048 characters in length. + ProxyURL *string `json:"proxyUrl,omitempty"` + // queueConfig allows tuning configuration for remote write queue parameters. + // When omitted, default queue configuration is used. + QueueConfig *QueueConfigApplyConfiguration `json:"queueConfig,omitempty"` + // remoteTimeoutSeconds defines the timeout in seconds for requests to the remote write endpoint. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // Minimum value is 1 second. + // Maximum value is 600 seconds (10 minutes). + RemoteTimeoutSeconds *int32 `json:"remoteTimeoutSeconds,omitempty"` + // exemplarsMode controls whether exemplars are sent via remote write. + // Valid values are "Send", "DoNotSend" and omitted. + // When set to "Send", Prometheus is configured to store a maximum of 100,000 exemplars in memory and send them with remote write. + // Note that this setting only applies to user-defined monitoring. It is not applicable to default in-cluster monitoring. + // When omitted or set to "DoNotSend", exemplars are not sent. + ExemplarsMode *configv1alpha1.ExemplarsMode `json:"exemplarsMode,omitempty"` + // tlsConfig defines TLS authentication settings for the remote write endpoint. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + TLSConfig *TLSConfigApplyConfiguration `json:"tlsConfig,omitempty"` + // writeRelabelConfigs is a list of relabeling rules to apply before sending data to the remote endpoint. + // When omitted, no relabeling is performed and all metrics are sent as-is. + // Minimum of 1 and maximum of 10 relabeling rules can be specified. + // Each rule must have a unique name. + WriteRelabelConfigs []RelabelConfigApplyConfiguration `json:"writeRelabelConfigs,omitempty"` +} + +// RemoteWriteSpecApplyConfiguration constructs a declarative configuration of the RemoteWriteSpec type for use with +// apply. +func RemoteWriteSpec() *RemoteWriteSpecApplyConfiguration { + return &RemoteWriteSpecApplyConfiguration{} +} + +// WithURL sets the URL field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the URL field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithURL(value string) *RemoteWriteSpecApplyConfiguration { + b.URL = &value + return b +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithName(value string) *RemoteWriteSpecApplyConfiguration { + b.Name = &value + return b +} + +// WithAuthorizationConfig sets the AuthorizationConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the AuthorizationConfig field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithAuthorizationConfig(value *RemoteWriteAuthorizationApplyConfiguration) *RemoteWriteSpecApplyConfiguration { + b.AuthorizationConfig = value + return b +} + +// WithHeaders adds the given value to the Headers field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Headers field. +func (b *RemoteWriteSpecApplyConfiguration) WithHeaders(values ...*PrometheusRemoteWriteHeaderApplyConfiguration) *RemoteWriteSpecApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithHeaders") + } + b.Headers = append(b.Headers, *values[i]) + } + return b +} + +// WithMetadataConfig sets the MetadataConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the MetadataConfig field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithMetadataConfig(value *MetadataConfigApplyConfiguration) *RemoteWriteSpecApplyConfiguration { + b.MetadataConfig = value + return b +} + +// WithProxyURL sets the ProxyURL field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ProxyURL field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithProxyURL(value string) *RemoteWriteSpecApplyConfiguration { + b.ProxyURL = &value + return b +} + +// WithQueueConfig sets the QueueConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the QueueConfig field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithQueueConfig(value *QueueConfigApplyConfiguration) *RemoteWriteSpecApplyConfiguration { + b.QueueConfig = value + return b +} + +// WithRemoteTimeoutSeconds sets the RemoteTimeoutSeconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the RemoteTimeoutSeconds field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithRemoteTimeoutSeconds(value int32) *RemoteWriteSpecApplyConfiguration { + b.RemoteTimeoutSeconds = &value + return b +} + +// WithExemplarsMode sets the ExemplarsMode field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ExemplarsMode field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithExemplarsMode(value configv1alpha1.ExemplarsMode) *RemoteWriteSpecApplyConfiguration { + b.ExemplarsMode = &value + return b +} + +// WithTLSConfig sets the TLSConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TLSConfig field is set to the value of the last call. +func (b *RemoteWriteSpecApplyConfiguration) WithTLSConfig(value *TLSConfigApplyConfiguration) *RemoteWriteSpecApplyConfiguration { + b.TLSConfig = value + return b +} + +// WithWriteRelabelConfigs adds the given value to the WriteRelabelConfigs field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the WriteRelabelConfigs field. +func (b *RemoteWriteSpecApplyConfiguration) WithWriteRelabelConfigs(values ...*RelabelConfigApplyConfiguration) *RemoteWriteSpecApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithWriteRelabelConfigs") + } + b.WriteRelabelConfigs = append(b.WriteRelabelConfigs, *values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/replaceactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/replaceactionconfig.go new file mode 100644 index 0000000000..7b9766c11b --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/replaceactionconfig.go @@ -0,0 +1,41 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// ReplaceActionConfigApplyConfiguration represents a declarative configuration of the ReplaceActionConfig type for use +// with apply. +// +// ReplaceActionConfig configures the Replace action. +// Regex is matched against the concatenated source_labels; target_label is set to replacement with match group references (${1}, ${2}, ...) substituted. No replacement if regex does not match. +type ReplaceActionConfigApplyConfiguration struct { + // targetLabel is the label name where the replacement result is written. + // Must be between 1 and 128 characters in length. + TargetLabel *string `json:"targetLabel,omitempty"` + // replacement is the value written to target_label when regex matches; match group references (${1}, ${2}, ...) are substituted. + // Required when using the Replace action so the intended behavior is explicit and the platform does not need to apply defaults. + // Use "$1" for the first capture group, "$2" for the second, etc. Use an empty string ("") to explicitly clear the target label value. + // Must be between 0 and 255 characters in length. + Replacement *string `json:"replacement,omitempty"` +} + +// ReplaceActionConfigApplyConfiguration constructs a declarative configuration of the ReplaceActionConfig type for use with +// apply. +func ReplaceActionConfig() *ReplaceActionConfigApplyConfiguration { + return &ReplaceActionConfigApplyConfiguration{} +} + +// WithTargetLabel sets the TargetLabel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetLabel field is set to the value of the last call. +func (b *ReplaceActionConfigApplyConfiguration) WithTargetLabel(value string) *ReplaceActionConfigApplyConfiguration { + b.TargetLabel = &value + return b +} + +// WithReplacement sets the Replacement field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Replacement field is set to the value of the last call. +func (b *ReplaceActionConfigApplyConfiguration) WithReplacement(value string) *ReplaceActionConfigApplyConfiguration { + b.Replacement = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/retention.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/retention.go new file mode 100644 index 0000000000..2ca903f21f --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/retention.go @@ -0,0 +1,46 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// RetentionApplyConfiguration represents a declarative configuration of the Retention type for use +// with apply. +// +// Retention configures how long Prometheus retains metrics data and how much storage it can use. +type RetentionApplyConfiguration struct { + // durationInDays specifies how many days Prometheus will retain metrics data. + // Prometheus automatically deletes data older than this duration. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is 15. + // Minimum value is 1 day. + // Maximum value is 365 days (1 year). + DurationInDays *int32 `json:"durationInDays,omitempty"` + // sizeInGiB specifies the maximum storage size in gibibytes (GiB) that Prometheus + // can use for data blocks and the write-ahead log (WAL). + // When the limit is reached, Prometheus will delete oldest data first. + // When omitted, no size limit is enforced and Prometheus uses available PersistentVolume capacity. + // Minimum value is 1 GiB. + // Maximum value is 16384 GiB (16 TiB). + SizeInGiB *int32 `json:"sizeInGiB,omitempty"` +} + +// RetentionApplyConfiguration constructs a declarative configuration of the Retention type for use with +// apply. +func Retention() *RetentionApplyConfiguration { + return &RetentionApplyConfiguration{} +} + +// WithDurationInDays sets the DurationInDays field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the DurationInDays field is set to the value of the last call. +func (b *RetentionApplyConfiguration) WithDurationInDays(value int32) *RetentionApplyConfiguration { + b.DurationInDays = &value + return b +} + +// WithSizeInGiB sets the SizeInGiB field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SizeInGiB field is set to the value of the last call. +func (b *RetentionApplyConfiguration) WithSizeInGiB(value int32) *RetentionApplyConfiguration { + b.SizeInGiB = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/secretkeyselector.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/secretkeyselector.go new file mode 100644 index 0000000000..a824180eda --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/secretkeyselector.go @@ -0,0 +1,40 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// SecretKeySelectorApplyConfiguration represents a declarative configuration of the SecretKeySelector type for use +// with apply. +// +// SecretKeySelector selects a key of a Secret in the `openshift-monitoring` namespace. +type SecretKeySelectorApplyConfiguration struct { + // name is the name of the secret in the `openshift-monitoring` namespace to select from. + // Must be a valid Kubernetes secret name (lowercase alphanumeric, '-' or '.', start/end with alphanumeric). + // Must be between 1 and 253 characters in length. + Name *string `json:"name,omitempty"` + // key is the key of the secret to select from. + // Must consist of alphanumeric characters, '-', '_', or '.'. + // Must be between 1 and 253 characters in length. + Key *string `json:"key,omitempty"` +} + +// SecretKeySelectorApplyConfiguration constructs a declarative configuration of the SecretKeySelector type for use with +// apply. +func SecretKeySelector() *SecretKeySelectorApplyConfiguration { + return &SecretKeySelectorApplyConfiguration{} +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *SecretKeySelectorApplyConfiguration) WithName(value string) *SecretKeySelectorApplyConfiguration { + b.Name = &value + return b +} + +// WithKey sets the Key field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Key field is set to the value of the last call. +func (b *SecretKeySelectorApplyConfiguration) WithKey(value string) *SecretKeySelectorApplyConfiguration { + b.Key = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/sigv4.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/sigv4.go new file mode 100644 index 0000000000..e0e37c4fdb --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/sigv4.go @@ -0,0 +1,78 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// Sigv4ApplyConfiguration represents a declarative configuration of the Sigv4 type for use +// with apply. +// +// Sigv4 defines AWS Signature Version 4 authentication settings. +// At least one of region, accessKey/secretKey, profile, or roleArn must be set so the platform can perform authentication. +type Sigv4ApplyConfiguration struct { + // region is the AWS region. + // When omitted, the region is derived from the environment or instance metadata. + // Must be between 1 and 128 characters. + Region *string `json:"region,omitempty"` + // accessKey defines the secret reference containing the AWS access key ID. + // The secret must exist in the openshift-monitoring namespace. + // When omitted, the access key is derived from the environment or instance metadata. + AccessKey *SecretKeySelectorApplyConfiguration `json:"accessKey,omitempty"` + // secretKey defines the secret reference containing the AWS secret access key. + // The secret must exist in the openshift-monitoring namespace. + // When omitted, the secret key is derived from the environment or instance metadata. + SecretKey *SecretKeySelectorApplyConfiguration `json:"secretKey,omitempty"` + // profile is the named AWS profile used to authenticate. + // When omitted, the default profile is used. + // Must be between 1 and 128 characters. + Profile *string `json:"profile,omitempty"` + // roleArn is the AWS Role ARN, an alternative to using AWS API keys. + // When omitted, API keys are used for authentication. + // Must be a valid AWS ARN format (e.g., "arn:aws:iam::123456789012:role/MyRole"). + // Must be between 1 and 512 characters. + RoleArn *string `json:"roleArn,omitempty"` +} + +// Sigv4ApplyConfiguration constructs a declarative configuration of the Sigv4 type for use with +// apply. +func Sigv4() *Sigv4ApplyConfiguration { + return &Sigv4ApplyConfiguration{} +} + +// WithRegion sets the Region field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Region field is set to the value of the last call. +func (b *Sigv4ApplyConfiguration) WithRegion(value string) *Sigv4ApplyConfiguration { + b.Region = &value + return b +} + +// WithAccessKey sets the AccessKey field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the AccessKey field is set to the value of the last call. +func (b *Sigv4ApplyConfiguration) WithAccessKey(value *SecretKeySelectorApplyConfiguration) *Sigv4ApplyConfiguration { + b.AccessKey = value + return b +} + +// WithSecretKey sets the SecretKey field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the SecretKey field is set to the value of the last call. +func (b *Sigv4ApplyConfiguration) WithSecretKey(value *SecretKeySelectorApplyConfiguration) *Sigv4ApplyConfiguration { + b.SecretKey = value + return b +} + +// WithProfile sets the Profile field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Profile field is set to the value of the last call. +func (b *Sigv4ApplyConfiguration) WithProfile(value string) *Sigv4ApplyConfiguration { + b.Profile = &value + return b +} + +// WithRoleArn sets the RoleArn field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the RoleArn field is set to the value of the last call. +func (b *Sigv4ApplyConfiguration) WithRoleArn(value string) *Sigv4ApplyConfiguration { + b.RoleArn = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go new file mode 100644 index 0000000000..9d4c5cc331 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/telemeterclientconfig.go @@ -0,0 +1,118 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1 "k8s.io/api/core/v1" +) + +// TelemeterClientConfigApplyConfiguration represents a declarative configuration of the TelemeterClientConfig type for use +// with apply. +// +// TelemeterClientConfig provides configuration options for the Telemeter Client component +// that runs in the `openshift-monitoring` namespace. The Telemeter Client collects selected +// monitoring metrics and forwards them to Red Hat for telemetry purposes. +// At least one field must be specified. +type TelemeterClientConfigApplyConfiguration struct { + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries. + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // resources defines the compute resource requests and limits for the Telemeter Client container. + // This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. + // When not specified, defaults are used by the platform. Requests cannot exceed limits. + // This field is optional. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 1m + // limit: null + // - name: memory + // request: 40Mi + // limit: null + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how Telemeter Client Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Default is empty list. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` +} + +// TelemeterClientConfigApplyConfiguration constructs a declarative configuration of the TelemeterClientConfig type for use with +// apply. +func TelemeterClientConfig() *TelemeterClientConfigApplyConfiguration { + return &TelemeterClientConfigApplyConfiguration{} +} + +// WithNodeSelector puts the entries into the NodeSelector field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the NodeSelector field, +// overwriting an existing map entries in NodeSelector field with the same key. +func (b *TelemeterClientConfigApplyConfiguration) WithNodeSelector(entries map[string]string) *TelemeterClientConfigApplyConfiguration { + if b.NodeSelector == nil && len(entries) > 0 { + b.NodeSelector = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.NodeSelector[k] = v + } + return b +} + +// WithResources adds the given value to the Resources field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Resources field. +func (b *TelemeterClientConfigApplyConfiguration) WithResources(values ...*ContainerResourceApplyConfiguration) *TelemeterClientConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithResources") + } + b.Resources = append(b.Resources, *values[i]) + } + return b +} + +// WithTolerations adds the given value to the Tolerations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Tolerations field. +func (b *TelemeterClientConfigApplyConfiguration) WithTolerations(values ...v1.Toleration) *TelemeterClientConfigApplyConfiguration { + for i := range values { + b.Tolerations = append(b.Tolerations, values[i]) + } + return b +} + +// WithTopologySpreadConstraints adds the given value to the TopologySpreadConstraints field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the TopologySpreadConstraints field. +func (b *TelemeterClientConfigApplyConfiguration) WithTopologySpreadConstraints(values ...v1.TopologySpreadConstraint) *TelemeterClientConfigApplyConfiguration { + for i := range values { + b.TopologySpreadConstraints = append(b.TopologySpreadConstraints, values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go new file mode 100644 index 0000000000..f2fda246e1 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierconfig.go @@ -0,0 +1,117 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + v1 "k8s.io/api/core/v1" +) + +// ThanosQuerierConfigApplyConfiguration represents a declarative configuration of the ThanosQuerierConfig type for use +// with apply. +// +// ThanosQuerierConfig provides configuration options for the Thanos Querier component +// that runs in the `openshift-monitoring` namespace. +// At least one field must be specified; an empty thanosQuerierConfig object is not allowed. +type ThanosQuerierConfigApplyConfiguration struct { + // nodeSelector defines the nodes on which the Pods are scheduled. + // nodeSelector is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // The current default value is `kubernetes.io/os: linux`. + // When specified, nodeSelector must contain at least 1 entry and must not contain more than 10 entries. + NodeSelector map[string]string `json:"nodeSelector,omitempty"` + // resources defines the compute resource requests and limits for the Thanos Querier container. + // resources is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Requests cannot exceed limits. + // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + // This is a simplified API that maps to Kubernetes ResourceRequirements. + // The current default values are: + // resources: + // - name: cpu + // request: 5m + // - name: memory + // request: 12Mi + // Maximum length for this list is 5. + // Minimum length for this list is 1. + // Each resource name must be unique within this list. + Resources []ContainerResourceApplyConfiguration `json:"resources,omitempty"` + // tolerations defines tolerations for the pods. + // tolerations is optional. + // + // When omitted, this means the user has no opinion and the platform is left + // to choose reasonable defaults. These defaults are subject to change over time. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + Tolerations []v1.Toleration `json:"tolerations,omitempty"` + // topologySpreadConstraints defines rules for how Thanos Querier Pods should be distributed + // across topology domains such as zones, nodes, or other user-defined labels. + // topologySpreadConstraints is optional. + // This helps improve high availability and resource efficiency by avoiding placing + // too many replicas in the same failure domain. + // + // When omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. + // This field maps directly to the `topologySpreadConstraints` field in the Pod spec. + // Defaults are empty/unset. + // Maximum length for this list is 10. + // Minimum length for this list is 1. + // Entries must have unique topologyKey and whenUnsatisfiable pairs. + TopologySpreadConstraints []v1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"` +} + +// ThanosQuerierConfigApplyConfiguration constructs a declarative configuration of the ThanosQuerierConfig type for use with +// apply. +func ThanosQuerierConfig() *ThanosQuerierConfigApplyConfiguration { + return &ThanosQuerierConfigApplyConfiguration{} +} + +// WithNodeSelector puts the entries into the NodeSelector field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the NodeSelector field, +// overwriting an existing map entries in NodeSelector field with the same key. +func (b *ThanosQuerierConfigApplyConfiguration) WithNodeSelector(entries map[string]string) *ThanosQuerierConfigApplyConfiguration { + if b.NodeSelector == nil && len(entries) > 0 { + b.NodeSelector = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.NodeSelector[k] = v + } + return b +} + +// WithResources adds the given value to the Resources field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Resources field. +func (b *ThanosQuerierConfigApplyConfiguration) WithResources(values ...*ContainerResourceApplyConfiguration) *ThanosQuerierConfigApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithResources") + } + b.Resources = append(b.Resources, *values[i]) + } + return b +} + +// WithTolerations adds the given value to the Tolerations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Tolerations field. +func (b *ThanosQuerierConfigApplyConfiguration) WithTolerations(values ...v1.Toleration) *ThanosQuerierConfigApplyConfiguration { + for i := range values { + b.Tolerations = append(b.Tolerations, values[i]) + } + return b +} + +// WithTopologySpreadConstraints adds the given value to the TopologySpreadConstraints field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the TopologySpreadConstraints field. +func (b *ThanosQuerierConfigApplyConfiguration) WithTopologySpreadConstraints(values ...v1.TopologySpreadConstraint) *ThanosQuerierConfigApplyConfiguration { + for i := range values { + b.TopologySpreadConstraints = append(b.TopologySpreadConstraints, values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/tlsconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/tlsconfig.go new file mode 100644 index 0000000000..dc74026618 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/tlsconfig.go @@ -0,0 +1,81 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// TLSConfigApplyConfiguration represents a declarative configuration of the TLSConfig type for use +// with apply. +// +// TLSConfig represents TLS configuration for Alertmanager connections. +// At least one TLS configuration option must be specified. +// For mutual TLS (mTLS), both cert and key must be specified together, or both omitted. +type TLSConfigApplyConfiguration struct { + // ca is an optional CA certificate to use for TLS connections. + // When omitted, the system's default CA bundle is used. + CA *SecretKeySelectorApplyConfiguration `json:"ca,omitempty"` + // cert is an optional client certificate to use for mutual TLS connections. + // When omitted, no client certificate is presented. + Cert *SecretKeySelectorApplyConfiguration `json:"cert,omitempty"` + // key is an optional client key to use for mutual TLS connections. + // When omitted, no client key is used. + Key *SecretKeySelectorApplyConfiguration `json:"key,omitempty"` + // serverName is an optional server name to use for TLS connections. + // When specified, must be a valid DNS subdomain as per RFC 1123. + // When omitted, the server name is derived from the URL. + // Must be between 1 and 253 characters in length. + ServerName *string `json:"serverName,omitempty"` + // certificateVerification determines the policy for TLS certificate verification. + // Allowed values are "Verify" (performs certificate verification, secure) and "SkipVerify" (skips verification, insecure). + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is "Verify". + CertificateVerification *configv1alpha1.CertificateVerificationType `json:"certificateVerification,omitempty"` +} + +// TLSConfigApplyConfiguration constructs a declarative configuration of the TLSConfig type for use with +// apply. +func TLSConfig() *TLSConfigApplyConfiguration { + return &TLSConfigApplyConfiguration{} +} + +// WithCA sets the CA field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CA field is set to the value of the last call. +func (b *TLSConfigApplyConfiguration) WithCA(value *SecretKeySelectorApplyConfiguration) *TLSConfigApplyConfiguration { + b.CA = value + return b +} + +// WithCert sets the Cert field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Cert field is set to the value of the last call. +func (b *TLSConfigApplyConfiguration) WithCert(value *SecretKeySelectorApplyConfiguration) *TLSConfigApplyConfiguration { + b.Cert = value + return b +} + +// WithKey sets the Key field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Key field is set to the value of the last call. +func (b *TLSConfigApplyConfiguration) WithKey(value *SecretKeySelectorApplyConfiguration) *TLSConfigApplyConfiguration { + b.Key = value + return b +} + +// WithServerName sets the ServerName field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ServerName field is set to the value of the last call. +func (b *TLSConfigApplyConfiguration) WithServerName(value string) *TLSConfigApplyConfiguration { + b.ServerName = &value + return b +} + +// WithCertificateVerification sets the CertificateVerification field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CertificateVerification field is set to the value of the last call. +func (b *TLSConfigApplyConfiguration) WithCertificateVerification(value configv1alpha1.CertificateVerificationType) *TLSConfigApplyConfiguration { + b.CertificateVerification = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/uppercaseactionconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/uppercaseactionconfig.go new file mode 100644 index 0000000000..6d3a6a804a --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/uppercaseactionconfig.go @@ -0,0 +1,29 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// UppercaseActionConfigApplyConfiguration represents a declarative configuration of the UppercaseActionConfig type for use +// with apply. +// +// UppercaseActionConfig configures the Uppercase action. +// Maps the concatenated source_labels to their upper case and writes to target_label. +// Requires Prometheus >= v2.36.0. +type UppercaseActionConfigApplyConfiguration struct { + // targetLabel is the label name where the upper-cased value is written. + // Must be between 1 and 128 characters in length. + TargetLabel *string `json:"targetLabel,omitempty"` +} + +// UppercaseActionConfigApplyConfiguration constructs a declarative configuration of the UppercaseActionConfig type for use with +// apply. +func UppercaseActionConfig() *UppercaseActionConfigApplyConfiguration { + return &UppercaseActionConfigApplyConfiguration{} +} + +// WithTargetLabel sets the TargetLabel field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TargetLabel field is set to the value of the last call. +func (b *UppercaseActionConfigApplyConfiguration) WithTargetLabel(value string) *UppercaseActionConfigApplyConfiguration { + b.TargetLabel = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go index 8c2fd43b21..e03df6b05e 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go @@ -23,92 +23,80 @@ func Parser() *typed.Parser { var parserOnce sync.Once var parser *typed.Parser var schemaYAML = typed.YAMLObject(`types: -- name: com.github.openshift.api.config.v1.APIServer +- name: Condition.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: apiVersion + - name: lastTransitionTime type: - scalar: string - - name: kind + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: message type: scalar: string - - name: metadata + default: "" + - name: observedGeneration type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + scalar: numeric + - name: reason type: - namedType: com.github.openshift.api.config.v1.APIServerSpec - default: {} + scalar: string + default: "" - name: status type: - namedType: com.github.openshift.api.config.v1.APIServerStatus - default: {} -- name: com.github.openshift.api.config.v1.APIServerEncryption - map: - fields: - - name: kms - type: - namedType: com.github.openshift.api.config.v1.KMSConfig + scalar: string + default: "" - name: type type: scalar: string - unions: - - discriminator: type - fields: - - fieldName: kms - discriminatorValue: KMS -- name: com.github.openshift.api.config.v1.APIServerNamedServingCert + default: "" +- name: ConfigMapKeySelector.v1.core.api.k8s.io map: fields: - - name: names + - name: key type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: servingCertificate + scalar: string + default: "" + - name: name type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} -- name: com.github.openshift.api.config.v1.APIServerServingCerts + scalar: string + default: "" + - name: optional + type: + scalar: boolean + elementRelationship: atomic +- name: Duration.v1.meta.apis.pkg.apimachinery.k8s.io + scalar: string +- name: EnvVar.v1.core.api.k8s.io map: fields: - - name: namedCertificates + - name: name type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.APIServerNamedServingCert - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.APIServerSpec + scalar: string + default: "" + - name: value + type: + scalar: string + - name: valueFrom + type: + namedType: EnvVarSource.v1.core.api.k8s.io +- name: EnvVarSource.v1.core.api.k8s.io map: fields: - - name: additionalCORSAllowedOrigins - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: audit + - name: configMapKeyRef type: - namedType: com.github.openshift.api.config.v1.Audit - default: {} - - name: clientCA + namedType: ConfigMapKeySelector.v1.core.api.k8s.io + - name: fieldRef type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: encryption + namedType: ObjectFieldSelector.v1.core.api.k8s.io + - name: fileKeyRef type: - namedType: com.github.openshift.api.config.v1.APIServerEncryption - default: {} - - name: servingCerts + namedType: FileKeySelector.v1.core.api.k8s.io + - name: resourceFieldRef type: - namedType: com.github.openshift.api.config.v1.APIServerServingCerts - default: {} - - name: tlsSecurityProfile + namedType: ResourceFieldSelector.v1.core.api.k8s.io + - name: secretKeyRef type: - namedType: com.github.openshift.api.config.v1.TLSSecurityProfile -- name: com.github.openshift.api.config.v1.APIServerStatus + namedType: SecretKeySelector.v1.core.api.k8s.io +- name: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io map: elementType: scalar: untyped @@ -120,201 +108,229 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.AWSDNSSpec +- name: FileKeySelector.v1.core.api.k8s.io map: fields: - - name: privateZoneIAMRole + - name: key type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.AWSIngressSpec - map: - fields: - - name: type + - name: optional type: - scalar: string - default: "" - unions: - - discriminator: type -- name: com.github.openshift.api.config.v1.AWSKMSConfig - map: - fields: - - name: keyARN + scalar: boolean + default: false + - name: path type: scalar: string default: "" - - name: region + - name: volumeName type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.AWSPlatformSpec + elementRelationship: atomic +- name: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: serviceEndpoints + - name: matchExpressions type: list: elementType: - namedType: com.github.openshift.api.config.v1.AWSServiceEndpoint + namedType: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic -- name: com.github.openshift.api.config.v1.AWSPlatformStatus + - name: matchLabels + type: + map: + elementType: + scalar: string + elementRelationship: atomic +- name: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: cloudLoadBalancerConfig - type: - namedType: com.github.openshift.api.config.v1.CloudLoadBalancerConfig - default: - dnsType: PlatformDefault - - name: ipFamily + - name: key type: scalar: string - default: IPv4 - - name: region + default: "" + - name: operator type: scalar: string default: "" - - name: resourceTags - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.AWSResourceTag - elementRelationship: atomic - - name: serviceEndpoints + - name: values type: list: elementType: - namedType: com.github.openshift.api.config.v1.AWSServiceEndpoint + scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.AWSResourceTag +- name: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: key + - name: apiVersion type: scalar: string - default: "" - - name: value + - name: fieldsType type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.AWSServiceEndpoint - map: - fields: - - name: name + - name: fieldsV1 + type: + namedType: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io + - name: manager type: scalar: string - default: "" - - name: url + - name: operation type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.AcceptRisk - map: - fields: - - name: name + - name: subresource type: scalar: string -- name: com.github.openshift.api.config.v1.AlibabaCloudPlatformSpec - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.AlibabaCloudPlatformStatus + - name: time + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io +- name: ModifyVolumeStatus.v1.core.api.k8s.io map: fields: - - name: region + - name: status type: scalar: string default: "" - - name: resourceGroupID + - name: targetVolumeAttributesClassName type: scalar: string - - name: resourceTags - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.AlibabaCloudResourceTag - elementRelationship: associative - keys: - - key -- name: com.github.openshift.api.config.v1.AlibabaCloudResourceTag +- name: ObjectFieldSelector.v1.core.api.k8s.io map: fields: - - name: key + - name: apiVersion type: scalar: string - default: "" - - name: value + - name: fieldPath type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.Audit + elementRelationship: atomic +- name: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: customRules + - name: annotations + type: + map: + elementType: + scalar: string + - name: creationTimestamp + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: deletionGracePeriodSeconds + type: + scalar: numeric + - name: deletionTimestamp + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: finalizers type: list: elementType: - namedType: com.github.openshift.api.config.v1.AuditCustomRule + scalar: string elementRelationship: associative - keys: - - group - - name: profile + - name: generateName type: scalar: string -- name: com.github.openshift.api.config.v1.AuditCustomRule - map: - fields: - - name: group + - name: generation type: - scalar: string - default: "" - - name: profile + scalar: numeric + - name: labels type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.Authentication - map: - fields: - - name: apiVersion + map: + elementType: + scalar: string + - name: managedFields + type: + list: + elementType: + namedType: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: atomic + - name: name type: scalar: string - - name: kind + - name: namespace type: scalar: string - - name: metadata + - name: ownerReferences type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} + list: + elementType: + namedType: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - uid + - name: resourceVersion + type: + scalar: string + - name: selfLink + type: + scalar: string + - name: uid + type: + scalar: string +- name: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: apiVersion + type: + scalar: string + default: "" + - name: blockOwnerDeletion + type: + scalar: boolean + - name: controller + type: + scalar: boolean + - name: kind + type: + scalar: string + default: "" + - name: name + type: + scalar: string + default: "" + - name: uid + type: + scalar: string + default: "" + elementRelationship: atomic +- name: PersistentVolumeClaim.v1.core.api.k8s.io + map: + fields: + - name: apiVersion + type: + scalar: string + - name: kind + type: + scalar: string + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.AuthenticationSpec + namedType: PersistentVolumeClaimSpec.v1.core.api.k8s.io default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.AuthenticationStatus + namedType: PersistentVolumeClaimStatus.v1.core.api.k8s.io default: {} -- name: com.github.openshift.api.config.v1.AuthenticationSpec +- name: PersistentVolumeClaimCondition.v1.core.api.k8s.io map: fields: - - name: oauthMetadata + - name: lastProbeTime type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: oidcProviders + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: lastTransitionTime type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.OIDCProvider - elementRelationship: associative - keys: - - name - - name: serviceAccountIssuer + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: message + type: + scalar: string + - name: reason + type: + scalar: string + - name: status type: scalar: string default: "" @@ -322,32 +338,85 @@ var schemaYAML = typed.YAMLObject(`types: type: scalar: string default: "" - - name: webhookTokenAuthenticator - type: - namedType: com.github.openshift.api.config.v1.WebhookTokenAuthenticator - - name: webhookTokenAuthenticators +- name: PersistentVolumeClaimSpec.v1.core.api.k8s.io + map: + fields: + - name: accessModes type: list: elementType: - namedType: com.github.openshift.api.config.v1.DeprecatedWebhookTokenAuthenticator + scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.AuthenticationStatus + - name: dataSource + type: + namedType: TypedLocalObjectReference.v1.core.api.k8s.io + - name: dataSourceRef + type: + namedType: TypedObjectReference.v1.core.api.k8s.io + - name: resources + type: + namedType: VolumeResourceRequirements.v1.core.api.k8s.io + default: {} + - name: selector + type: + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io + - name: storageClassName + type: + scalar: string + - name: volumeAttributesClassName + type: + scalar: string + - name: volumeMode + type: + scalar: string + - name: volumeName + type: + scalar: string +- name: PersistentVolumeClaimStatus.v1.core.api.k8s.io map: fields: - - name: integratedOAuthMetadata + - name: accessModes type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: oidcClients + list: + elementType: + scalar: string + elementRelationship: atomic + - name: allocatedResourceStatuses + type: + map: + elementType: + scalar: string + elementRelationship: separable + - name: allocatedResources + type: + map: + elementType: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io + - name: capacity + type: + map: + elementType: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io + - name: conditions type: list: elementType: - namedType: com.github.openshift.api.config.v1.OIDCClientStatus + namedType: PersistentVolumeClaimCondition.v1.core.api.k8s.io elementRelationship: associative keys: - - componentNamespace - - componentName -- name: com.github.openshift.api.config.v1.AzurePlatformSpec + - type + - name: currentVolumeAttributesClassName + type: + scalar: string + - name: modifyVolumeStatus + type: + namedType: ModifyVolumeStatus.v1.core.api.k8s.io + - name: phase + type: + scalar: string +- name: Quantity.resource.api.pkg.apimachinery.k8s.io + scalar: string +- name: RawExtension.runtime.pkg.apimachinery.k8s.io map: elementType: scalar: untyped @@ -359,136 +428,165 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.AzurePlatformStatus +- name: ResourceClaim.v1.core.api.k8s.io map: fields: - - name: armEndpoint + - name: name type: scalar: string - - name: cloudLoadBalancerConfig - type: - namedType: com.github.openshift.api.config.v1.CloudLoadBalancerConfig - default: - dnsType: PlatformDefault - - name: cloudName + default: "" + - name: request type: scalar: string - - name: ipFamily +- name: ResourceFieldSelector.v1.core.api.k8s.io + map: + fields: + - name: containerName type: scalar: string - default: IPv4 - - name: networkResourceGroupName + - name: divisor type: - scalar: string - - name: resourceGroupName + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io + - name: resource type: scalar: string default: "" - - name: resourceTags + elementRelationship: atomic +- name: ResourceRequirements.v1.core.api.k8s.io + map: + fields: + - name: claims type: list: elementType: - namedType: com.github.openshift.api.config.v1.AzureResourceTag - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.AzureResourceTag + namedType: ResourceClaim.v1.core.api.k8s.io + elementRelationship: associative + keys: + - name + - name: limits + type: + map: + elementType: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io + - name: requests + type: + map: + elementType: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io +- name: SecretKeySelector.v1.core.api.k8s.io map: fields: - name: key type: scalar: string default: "" - - name: value + - name: name type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.BareMetalPlatformLoadBalancer + - name: optional + type: + scalar: boolean + elementRelationship: atomic +- name: Time.v1.meta.apis.pkg.apimachinery.k8s.io + scalar: untyped +- name: Toleration.v1.core.api.k8s.io map: fields: - - name: type + - name: effect type: scalar: string - default: OpenShiftManagedDefault - unions: - - discriminator: type -- name: com.github.openshift.api.config.v1.BareMetalPlatformSpec + - name: key + type: + scalar: string + - name: operator + type: + scalar: string + - name: tolerationSeconds + type: + scalar: numeric + - name: value + type: + scalar: string +- name: TopologySpreadConstraint.v1.core.api.k8s.io map: fields: - - name: apiServerInternalIPs + - name: labelSelector type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: ingressIPs + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io + - name: matchLabelKeys type: list: elementType: scalar: string elementRelationship: atomic - - name: machineNetworks + - name: maxSkew type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.BareMetalPlatformStatus - map: - fields: - - name: apiServerInternalIP + scalar: numeric + default: 0 + - name: minDomains + type: + scalar: numeric + - name: nodeAffinityPolicy type: scalar: string - - name: apiServerInternalIPs + - name: nodeTaintsPolicy type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: dnsRecordsType + scalar: string + - name: topologyKey type: scalar: string - - name: ingressIP + default: "" + - name: whenUnsatisfiable type: scalar: string - - name: ingressIPs + default: "" +- name: TypedLocalObjectReference.v1.core.api.k8s.io + map: + fields: + - name: apiGroup type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: loadBalancer + scalar: string + - name: kind type: - namedType: com.github.openshift.api.config.v1.BareMetalPlatformLoadBalancer - default: - type: OpenShiftManagedDefault - - name: machineNetworks - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: nodeDNSIP + scalar: string + default: "" + - name: name type: scalar: string -- name: com.github.openshift.api.config.v1.BasicAuthIdentityProvider + default: "" + elementRelationship: atomic +- name: TypedObjectReference.v1.core.api.k8s.io map: fields: - - name: ca - type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: tlsClientCert + - name: apiGroup type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} - - name: tlsClientKey + scalar: string + - name: kind type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} - - name: url + scalar: string + default: "" + - name: name type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.Build + - name: namespace + type: + scalar: string +- name: VolumeResourceRequirements.v1.core.api.k8s.io + map: + fields: + - name: limits + type: + map: + elementType: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io + - name: requests + type: + map: + elementType: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io +- name: com.github.openshift.api.config.v1.APIServer map: fields: - name: apiVersion @@ -499,205 +597,188 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.BuildSpec + namedType: com.github.openshift.api.config.v1.APIServerSpec default: {} -- name: com.github.openshift.api.config.v1.BuildDefaults + - name: status + type: + namedType: com.github.openshift.api.config.v1.APIServerStatus + default: {} +- name: com.github.openshift.api.config.v1.APIServerEncryption map: fields: - - name: defaultProxy - type: - namedType: com.github.openshift.api.config.v1.ProxySpec - - name: env + - name: kms type: - list: - elementType: - namedType: io.k8s.api.core.v1.EnvVar - elementRelationship: atomic - - name: gitProxy + namedType: com.github.openshift.api.config.v1.KMSConfig + - name: type type: - namedType: com.github.openshift.api.config.v1.ProxySpec - - name: imageLabels + scalar: string + unions: + - discriminator: type + fields: + - fieldName: kms + discriminatorValue: KMS +- name: com.github.openshift.api.config.v1.APIServerNamedServingCert + map: + fields: + - name: names type: list: elementType: - namedType: com.github.openshift.api.config.v1.ImageLabel + scalar: string elementRelationship: atomic - - name: resources + - name: servingCertificate type: - namedType: io.k8s.api.core.v1.ResourceRequirements + namedType: com.github.openshift.api.config.v1.SecretNameReference default: {} -- name: com.github.openshift.api.config.v1.BuildOverrides +- name: com.github.openshift.api.config.v1.APIServerServingCerts map: fields: - - name: forcePull - type: - scalar: boolean - - name: imageLabels + - name: namedCertificates type: list: elementType: - namedType: com.github.openshift.api.config.v1.ImageLabel + namedType: com.github.openshift.api.config.v1.APIServerNamedServingCert elementRelationship: atomic - - name: nodeSelector - type: - map: - elementType: - scalar: string - - name: tolerations +- name: com.github.openshift.api.config.v1.APIServerSpec + map: + fields: + - name: additionalCORSAllowedOrigins type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.BuildSpec - map: - fields: - - name: additionalTrustedCA + - name: audit + type: + namedType: com.github.openshift.api.config.v1.Audit + default: {} + - name: clientCA type: namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} - - name: buildDefaults + - name: encryption type: - namedType: com.github.openshift.api.config.v1.BuildDefaults + namedType: com.github.openshift.api.config.v1.APIServerEncryption default: {} - - name: buildOverrides + - name: servingCerts type: - namedType: com.github.openshift.api.config.v1.BuildOverrides + namedType: com.github.openshift.api.config.v1.APIServerServingCerts default: {} -- name: com.github.openshift.api.config.v1.CloudControllerManagerStatus + - name: tlsAdherence + type: + scalar: string + - name: tlsSecurityProfile + type: + namedType: com.github.openshift.api.config.v1.TLSSecurityProfile +- name: com.github.openshift.api.config.v1.APIServerStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.AWSDNSSpec map: fields: - - name: state + - name: privateZoneIAMRole type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.CloudLoadBalancerConfig +- name: com.github.openshift.api.config.v1.AWSIngressSpec map: fields: - - name: clusterHosted - type: - namedType: com.github.openshift.api.config.v1.CloudLoadBalancerIPs - - name: dnsType + - name: type type: scalar: string - default: PlatformDefault + default: "" unions: - - discriminator: dnsType - fields: - - fieldName: clusterHosted - discriminatorValue: ClusterHosted -- name: com.github.openshift.api.config.v1.CloudLoadBalancerIPs + - discriminator: type +- name: com.github.openshift.api.config.v1.AWSKMSConfig map: fields: - - name: apiIntLoadBalancerIPs + - name: keyARN type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: apiLoadBalancerIPs + scalar: string + default: "" + - name: region type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: ingressLoadBalancerIPs + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.AWSPlatformSpec + map: + fields: + - name: serviceEndpoints type: list: elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1.ClusterCondition + namedType: com.github.openshift.api.config.v1.AWSServiceEndpoint + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.AWSPlatformStatus map: fields: - - name: promql - type: - namedType: com.github.openshift.api.config.v1.PromQLClusterCondition - - name: type + - name: cloudLoadBalancerConfig type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.ClusterImagePolicy - map: - fields: - - name: apiVersion + namedType: com.github.openshift.api.config.v1.CloudLoadBalancerConfig + default: + dnsType: PlatformDefault + - name: ipFamily type: scalar: string - - name: kind + default: IPv4 + - name: region type: scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1.ClusterImagePolicySpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.config.v1.ClusterImagePolicyStatus - default: {} -- name: com.github.openshift.api.config.v1.ClusterImagePolicySpec - map: - fields: - - name: policy - type: - namedType: com.github.openshift.api.config.v1.ImageSigstoreVerificationPolicy - default: {} - - name: scopes + default: "" + - name: resourceTags type: list: elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1.ClusterImagePolicyStatus - map: - fields: - - name: conditions + namedType: com.github.openshift.api.config.v1.AWSResourceTag + elementRelationship: atomic + - name: serviceEndpoints type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type -- name: com.github.openshift.api.config.v1.ClusterNetworkEntry + namedType: com.github.openshift.api.config.v1.AWSServiceEndpoint + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.AWSResourceTag map: fields: - - name: cidr + - name: key type: scalar: string default: "" - - name: hostPrefix + - name: value type: - scalar: numeric -- name: com.github.openshift.api.config.v1.ClusterOperator + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.AWSServiceEndpoint map: fields: - - name: apiVersion + - name: name type: scalar: string - - name: kind + default: "" + - name: url type: scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1.ClusterOperatorSpec - default: {} - - name: status + default: "" +- name: com.github.openshift.api.config.v1.AcceptRisk + map: + fields: + - name: name type: - namedType: com.github.openshift.api.config.v1.ClusterOperatorStatus - default: {} -- name: com.github.openshift.api.config.v1.ClusterOperatorSpec + scalar: string +- name: com.github.openshift.api.config.v1.AlibabaCloudPlatformSpec map: elementType: scalar: untyped @@ -709,53 +790,61 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.ClusterOperatorStatus +- name: com.github.openshift.api.config.v1.AlibabaCloudPlatformStatus map: fields: - - name: conditions - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.ClusterOperatorStatusCondition - elementRelationship: associative - keys: - - type - - name: extension + - name: region type: - namedType: __untyped_atomic_ - - name: relatedObjects + scalar: string + default: "" + - name: resourceGroupID type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.ObjectReference - elementRelationship: atomic - - name: versions + scalar: string + - name: resourceTags type: list: elementType: - namedType: com.github.openshift.api.config.v1.OperandVersion - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.ClusterOperatorStatusCondition + namedType: com.github.openshift.api.config.v1.AlibabaCloudResourceTag + elementRelationship: associative + keys: + - key +- name: com.github.openshift.api.config.v1.AlibabaCloudResourceTag map: fields: - - name: lastTransitionTime + - name: key type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: message + scalar: string + default: "" + - name: value type: scalar: string - - name: reason + default: "" +- name: com.github.openshift.api.config.v1.Audit + map: + fields: + - name: customRules + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.AuditCustomRule + elementRelationship: associative + keys: + - group + - name: profile type: scalar: string - - name: status +- name: com.github.openshift.api.config.v1.AuditCustomRule + map: + fields: + - name: group type: scalar: string default: "" - - name: type + - name: profile type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.ClusterVersion +- name: com.github.openshift.api.config.v1.Authentication map: fields: - name: apiVersion @@ -766,373 +855,339 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.ClusterVersionSpec + namedType: com.github.openshift.api.config.v1.AuthenticationSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.ClusterVersionStatus + namedType: com.github.openshift.api.config.v1.AuthenticationStatus default: {} -- name: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesSpec +- name: com.github.openshift.api.config.v1.AuthenticationSpec map: fields: - - name: additionalEnabledCapabilities + - name: oauthMetadata + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: oidcProviders type: list: elementType: - scalar: string - elementRelationship: atomic - - name: baselineCapabilitySet + namedType: com.github.openshift.api.config.v1.OIDCProvider + elementRelationship: associative + keys: + - name + - name: serviceAccountIssuer type: scalar: string -- name: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesStatus - map: - fields: - - name: enabledCapabilities + default: "" + - name: type + type: + scalar: string + default: "" + - name: webhookTokenAuthenticator + type: + namedType: com.github.openshift.api.config.v1.WebhookTokenAuthenticator + - name: webhookTokenAuthenticators type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1.DeprecatedWebhookTokenAuthenticator elementRelationship: atomic - - name: knownCapabilities +- name: com.github.openshift.api.config.v1.AuthenticationStatus + map: + fields: + - name: integratedOAuthMetadata + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: oidcClients type: list: elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.ClusterVersionSpec + namedType: com.github.openshift.api.config.v1.OIDCClientStatus + elementRelationship: associative + keys: + - componentNamespace + - componentName +- name: com.github.openshift.api.config.v1.AzurePlatformSpec + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.AzurePlatformStatus map: fields: - - name: capabilities + - name: armEndpoint type: - namedType: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesSpec - - name: channel + scalar: string + - name: cloudLoadBalancerConfig + type: + namedType: com.github.openshift.api.config.v1.CloudLoadBalancerConfig + default: + dnsType: PlatformDefault + - name: cloudName type: scalar: string - - name: clusterID + - name: ipFamily type: scalar: string - default: "" - - name: desiredUpdate + default: IPv4 + - name: networkResourceGroupName type: - namedType: com.github.openshift.api.config.v1.Update - - name: overrides + scalar: string + - name: resourceGroupName type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.ComponentOverride - elementRelationship: associative - keys: - - kind - - group - - namespace - - name - - name: signatureStores + scalar: string + default: "" + - name: resourceTags type: list: elementType: - namedType: com.github.openshift.api.config.v1.SignatureStore - elementRelationship: associative - keys: - - url - - name: upstream + namedType: com.github.openshift.api.config.v1.AzureResourceTag + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.AzureResourceTag + map: + fields: + - name: key type: scalar: string -- name: com.github.openshift.api.config.v1.ClusterVersionStatus + default: "" + - name: value + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.BareMetalPlatformLoadBalancer map: fields: - - name: availableUpdates - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.Release - elementRelationship: atomic - - name: capabilities + - name: type type: - namedType: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesStatus - default: {} - - name: conditionalUpdateRisks + scalar: string + default: OpenShiftManagedDefault + unions: + - discriminator: type +- name: com.github.openshift.api.config.v1.BareMetalPlatformSpec + map: + fields: + - name: apiServerInternalIPs type: list: elementType: - namedType: com.github.openshift.api.config.v1.ConditionalUpdateRisk - elementRelationship: associative - keys: - - name - - name: conditionalUpdates + scalar: string + elementRelationship: atomic + - name: ingressIPs type: list: elementType: - namedType: com.github.openshift.api.config.v1.ConditionalUpdate + scalar: string elementRelationship: atomic - - name: conditions + - name: machineNetworks type: list: elementType: - namedType: com.github.openshift.api.config.v1.ClusterOperatorStatusCondition - elementRelationship: associative - keys: - - type - - name: desired + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.BareMetalPlatformStatus + map: + fields: + - name: apiServerInternalIP type: - namedType: com.github.openshift.api.config.v1.Release - default: {} - - name: history + scalar: string + - name: apiServerInternalIPs type: list: elementType: - namedType: com.github.openshift.api.config.v1.UpdateHistory + scalar: string elementRelationship: atomic - - name: observedGeneration - type: - scalar: numeric - default: 0 - - name: versionHash + - name: dnsRecordsType type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.ComponentOverride - map: - fields: - - name: group + - name: ingressIP type: scalar: string - default: "" - - name: kind + - name: ingressIPs type: - scalar: string - default: "" - - name: name + list: + elementType: + scalar: string + elementRelationship: atomic + - name: loadBalancer type: - scalar: string - default: "" - - name: namespace + namedType: com.github.openshift.api.config.v1.BareMetalPlatformLoadBalancer + default: + type: OpenShiftManagedDefault + - name: machineNetworks type: - scalar: string - default: "" - - name: unmanaged + list: + elementType: + scalar: string + elementRelationship: atomic + - name: nodeDNSIP type: - scalar: boolean - default: false -- name: com.github.openshift.api.config.v1.ComponentRouteSpec + scalar: string +- name: com.github.openshift.api.config.v1.BasicAuthIdentityProvider map: fields: - - name: hostname + - name: ca + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: tlsClientCert + type: + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: tlsClientKey + type: + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: url type: scalar: string default: "" - - name: name +- name: com.github.openshift.api.config.v1.Build + map: + fields: + - name: apiVersion type: scalar: string - default: "" - - name: namespace + - name: kind type: scalar: string - default: "" - - name: servingCertKeyPairSecret + - name: metadata type: - namedType: com.github.openshift.api.config.v1.SecretNameReference + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} -- name: com.github.openshift.api.config.v1.ComponentRouteStatus + - name: spec + type: + namedType: com.github.openshift.api.config.v1.BuildSpec + default: {} +- name: com.github.openshift.api.config.v1.BuildDefaults map: fields: - - name: conditions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type - - name: consumingUsers + - name: defaultProxy type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: currentHostnames + namedType: com.github.openshift.api.config.v1.ProxySpec + - name: env type: list: elementType: - scalar: string + namedType: EnvVar.v1.core.api.k8s.io elementRelationship: atomic - - name: defaultHostname - type: - scalar: string - default: "" - - name: name - type: - scalar: string - default: "" - - name: namespace + - name: gitProxy type: - scalar: string - default: "" - - name: relatedObjects + namedType: com.github.openshift.api.config.v1.ProxySpec + - name: imageLabels type: list: elementType: - namedType: com.github.openshift.api.config.v1.ObjectReference + namedType: com.github.openshift.api.config.v1.ImageLabel elementRelationship: atomic -- name: com.github.openshift.api.config.v1.ConditionalUpdate - map: - fields: - - name: conditions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type - - name: release + - name: resources type: - namedType: com.github.openshift.api.config.v1.Release + namedType: ResourceRequirements.v1.core.api.k8s.io default: {} - - name: riskNames +- name: com.github.openshift.api.config.v1.BuildOverrides + map: + fields: + - name: forcePull type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: risks + scalar: boolean + - name: imageLabels type: list: elementType: - namedType: com.github.openshift.api.config.v1.ConditionalUpdateRisk - elementRelationship: associative - keys: - - name -- name: com.github.openshift.api.config.v1.ConditionalUpdateRisk - map: - fields: - - name: conditions + namedType: com.github.openshift.api.config.v1.ImageLabel + elementRelationship: atomic + - name: nodeSelector type: - list: + map: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type - - name: matchingRules + scalar: string + - name: tolerations type: list: elementType: - namedType: com.github.openshift.api.config.v1.ClusterCondition + namedType: Toleration.v1.core.api.k8s.io elementRelationship: atomic - - name: message - type: - scalar: string - default: "" - - name: name - type: - scalar: string - default: "" - - name: url - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.ConfigMapFileReference - map: - fields: - - name: key - type: - scalar: string - - name: name - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.ConfigMapNameReference - map: - fields: - - name: name - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.Console +- name: com.github.openshift.api.config.v1.BuildSpec map: fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata + - name: additionalTrustedCA type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} - - name: spec + - name: buildDefaults type: - namedType: com.github.openshift.api.config.v1.ConsoleSpec + namedType: com.github.openshift.api.config.v1.BuildDefaults default: {} - - name: status + - name: buildOverrides type: - namedType: com.github.openshift.api.config.v1.ConsoleStatus + namedType: com.github.openshift.api.config.v1.BuildOverrides default: {} -- name: com.github.openshift.api.config.v1.ConsoleAuthentication +- name: com.github.openshift.api.config.v1.CloudControllerManagerStatus map: fields: - - name: logoutRedirect + - name: state type: scalar: string -- name: com.github.openshift.api.config.v1.ConsoleSpec + default: "" +- name: com.github.openshift.api.config.v1.CloudLoadBalancerConfig map: fields: - - name: authentication + - name: clusterHosted type: - namedType: com.github.openshift.api.config.v1.ConsoleAuthentication - default: {} -- name: com.github.openshift.api.config.v1.ConsoleStatus - map: - fields: - - name: consoleURL + namedType: com.github.openshift.api.config.v1.CloudLoadBalancerIPs + - name: dnsType type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.Custom + default: PlatformDefault + unions: + - discriminator: dnsType + fields: + - fieldName: clusterHosted + discriminatorValue: ClusterHosted +- name: com.github.openshift.api.config.v1.CloudLoadBalancerIPs map: fields: - - name: configs + - name: apiIntLoadBalancerIPs type: list: elementType: - namedType: com.github.openshift.api.config.v1.GathererConfig + scalar: string elementRelationship: associative - keys: - - name -- name: com.github.openshift.api.config.v1.CustomFeatureGates - map: - fields: - - name: disabled + - name: apiLoadBalancerIPs type: list: elementType: scalar: string - elementRelationship: atomic - - name: enabled + elementRelationship: associative + - name: ingressLoadBalancerIPs type: list: elementType: scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.CustomTLSProfile + elementRelationship: associative +- name: com.github.openshift.api.config.v1.ClusterCondition map: fields: - - name: ciphers + - name: promql type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: minTLSVersion + namedType: com.github.openshift.api.config.v1.PromQLClusterCondition + - name: type type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.DNS +- name: com.github.openshift.api.config.v1.ClusterImagePolicy map: fields: - name: apiVersion @@ -1143,79 +1198,72 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.DNSSpec + namedType: com.github.openshift.api.config.v1.ClusterImagePolicySpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.DNSStatus + namedType: com.github.openshift.api.config.v1.ClusterImagePolicyStatus default: {} -- name: com.github.openshift.api.config.v1.DNSPlatformSpec +- name: com.github.openshift.api.config.v1.ClusterImagePolicySpec map: fields: - - name: aws - type: - namedType: com.github.openshift.api.config.v1.AWSDNSSpec - - name: type + - name: policy type: - scalar: string - default: "" - unions: - - discriminator: type - fields: - - fieldName: aws - discriminatorValue: AWS -- name: com.github.openshift.api.config.v1.DNSSpec + namedType: com.github.openshift.api.config.v1.ImageSigstoreVerificationPolicy + default: {} + - name: scopes + type: + list: + elementType: + scalar: string + elementRelationship: associative +- name: com.github.openshift.api.config.v1.ClusterImagePolicyStatus map: fields: - - name: baseDomain + - name: conditions + type: + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type +- name: com.github.openshift.api.config.v1.ClusterNetworkEntry + map: + fields: + - name: cidr type: scalar: string default: "" - - name: platform - type: - namedType: com.github.openshift.api.config.v1.DNSPlatformSpec - default: {} - - name: privateZone - type: - namedType: com.github.openshift.api.config.v1.DNSZone - - name: publicZone + - name: hostPrefix type: - namedType: com.github.openshift.api.config.v1.DNSZone -- name: com.github.openshift.api.config.v1.DNSStatus - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.DNSZone + scalar: numeric +- name: com.github.openshift.api.config.v1.ClusterOperator map: fields: - - name: id + - name: apiVersion type: scalar: string - - name: tags + - name: kind type: - map: - elementType: - scalar: string -- name: com.github.openshift.api.config.v1.DeprecatedWebhookTokenAuthenticator - map: - fields: - - name: kubeConfig + scalar: string + - name: metadata type: - namedType: com.github.openshift.api.config.v1.SecretNameReference + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} -- name: com.github.openshift.api.config.v1.EquinixMetalPlatformSpec + - name: spec + type: + namedType: com.github.openshift.api.config.v1.ClusterOperatorSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.config.v1.ClusterOperatorStatus + default: {} +- name: com.github.openshift.api.config.v1.ClusterOperatorSpec map: elementType: scalar: untyped @@ -1227,68 +1275,53 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.EquinixMetalPlatformStatus - map: - fields: - - name: apiServerInternalIP - type: - scalar: string - - name: ingressIP - type: - scalar: string -- name: com.github.openshift.api.config.v1.ExternalIPConfig +- name: com.github.openshift.api.config.v1.ClusterOperatorStatus map: fields: - - name: autoAssignCIDRs + - name: conditions type: list: elementType: - scalar: string - elementRelationship: atomic - - name: policy + namedType: com.github.openshift.api.config.v1.ClusterOperatorStatusCondition + elementRelationship: associative + keys: + - type + - name: extension type: - namedType: com.github.openshift.api.config.v1.ExternalIPPolicy -- name: com.github.openshift.api.config.v1.ExternalIPPolicy - map: - fields: - - name: allowedCIDRs + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io + - name: relatedObjects type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1.ObjectReference elementRelationship: atomic - - name: rejectedCIDRs + - name: versions type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1.OperandVersion elementRelationship: atomic -- name: com.github.openshift.api.config.v1.ExternalPlatformSpec +- name: com.github.openshift.api.config.v1.ClusterOperatorStatusCondition map: fields: - - name: platformName + - name: lastTransitionTime + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: message type: scalar: string - default: Unknown -- name: com.github.openshift.api.config.v1.ExternalPlatformStatus - map: - fields: - - name: cloudControllerManager + - name: reason type: - namedType: com.github.openshift.api.config.v1.CloudControllerManagerStatus - default: {} -- name: com.github.openshift.api.config.v1.ExtraMapping - map: - fields: - - name: key + scalar: string + - name: status type: scalar: string default: "" - - name: valueExpression + - name: type type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.FeatureGate +- name: com.github.openshift.api.config.v1.ClusterVersion map: fields: - name: apiVersion @@ -1299,318 +1332,267 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.FeatureGateSpec + namedType: com.github.openshift.api.config.v1.ClusterVersionSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.FeatureGateStatus + namedType: com.github.openshift.api.config.v1.ClusterVersionStatus default: {} -- name: com.github.openshift.api.config.v1.FeatureGateAttributes +- name: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesSpec map: fields: - - name: name + - name: additionalEnabledCapabilities + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: baselineCapabilitySet type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.FeatureGateDetails +- name: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesStatus map: fields: - - name: disabled + - name: enabledCapabilities type: list: elementType: - namedType: com.github.openshift.api.config.v1.FeatureGateAttributes + scalar: string elementRelationship: atomic - - name: enabled + - name: knownCapabilities type: list: elementType: - namedType: com.github.openshift.api.config.v1.FeatureGateAttributes + scalar: string elementRelationship: atomic - - name: version - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.FeatureGateSpec +- name: com.github.openshift.api.config.v1.ClusterVersionSpec map: fields: - - name: customNoUpgrade + - name: capabilities type: - namedType: com.github.openshift.api.config.v1.CustomFeatureGates - - name: featureSet + namedType: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesSpec + - name: channel type: scalar: string - unions: - - discriminator: featureSet - fields: - - fieldName: customNoUpgrade - discriminatorValue: CustomNoUpgrade -- name: com.github.openshift.api.config.v1.FeatureGateStatus - map: - fields: - - name: conditions + - name: clusterID + type: + scalar: string + default: "" + - name: desiredUpdate + type: + namedType: com.github.openshift.api.config.v1.Update + - name: overrides type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + namedType: com.github.openshift.api.config.v1.ComponentOverride elementRelationship: associative keys: - - type - - name: featureGates + - kind + - group + - namespace + - name + - name: signatureStores type: list: elementType: - namedType: com.github.openshift.api.config.v1.FeatureGateDetails + namedType: com.github.openshift.api.config.v1.SignatureStore elementRelationship: associative keys: - - version -- name: com.github.openshift.api.config.v1.GCPPlatformSpec - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.GCPPlatformStatus + - url + - name: upstream + type: + scalar: string +- name: com.github.openshift.api.config.v1.ClusterVersionStatus map: fields: - - name: cloudLoadBalancerConfig - type: - namedType: com.github.openshift.api.config.v1.CloudLoadBalancerConfig - default: - dnsType: PlatformDefault - - name: projectID + - name: availableUpdates type: - scalar: string - default: "" - - name: region + list: + elementType: + namedType: com.github.openshift.api.config.v1.Release + elementRelationship: atomic + - name: capabilities type: - scalar: string - default: "" - - name: resourceLabels + namedType: com.github.openshift.api.config.v1.ClusterVersionCapabilitiesStatus + default: {} + - name: conditionalUpdateRisks type: list: elementType: - namedType: com.github.openshift.api.config.v1.GCPResourceLabel + namedType: com.github.openshift.api.config.v1.ConditionalUpdateRisk elementRelationship: associative keys: - - key - - name: resourceTags + - name + - name: conditionalUpdates type: list: elementType: - namedType: com.github.openshift.api.config.v1.GCPResourceTag + namedType: com.github.openshift.api.config.v1.ConditionalUpdate + elementRelationship: atomic + - name: conditions + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.ClusterOperatorStatusCondition elementRelationship: associative keys: - - key -- name: com.github.openshift.api.config.v1.GCPResourceLabel - map: - fields: - - name: key + - type + - name: desired type: - scalar: string - default: "" - - name: value + namedType: com.github.openshift.api.config.v1.Release + default: {} + - name: history + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.UpdateHistory + elementRelationship: atomic + - name: observedGeneration + type: + scalar: numeric + default: 0 + - name: versionHash type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.GCPResourceTag +- name: com.github.openshift.api.config.v1.ComponentOverride map: fields: - - name: key + - name: group type: scalar: string default: "" - - name: parentID + - name: kind type: scalar: string default: "" - - name: value + - name: name type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.GatherConfig - map: - fields: - - name: dataPolicy - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: gatherers - type: - namedType: com.github.openshift.api.config.v1.Gatherers - default: {} - - name: storage - type: - namedType: com.github.openshift.api.config.v1.Storage - default: {} -- name: com.github.openshift.api.config.v1.GathererConfig - map: - fields: - - name: name + - name: namespace type: scalar: string - - name: state + default: "" + - name: unmanaged type: - scalar: string -- name: com.github.openshift.api.config.v1.Gatherers + scalar: boolean + default: false +- name: com.github.openshift.api.config.v1.ComponentRouteSpec map: fields: - - name: custom - type: - namedType: com.github.openshift.api.config.v1.Custom - default: {} - - name: mode + - name: hostname type: scalar: string - unions: - - discriminator: mode - fields: - - fieldName: custom - discriminatorValue: Custom -- name: com.github.openshift.api.config.v1.GitHubIdentityProvider - map: - fields: - - name: ca + default: "" + - name: name type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: clientID + scalar: string + default: "" + - name: namespace type: scalar: string default: "" - - name: clientSecret + - name: servingCertKeyPairSecret type: namedType: com.github.openshift.api.config.v1.SecretNameReference default: {} - - name: hostname +- name: com.github.openshift.api.config.v1.ComponentRouteStatus + map: + fields: + - name: conditions type: - scalar: string - default: "" - - name: organizations + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type + - name: consumingUsers type: list: elementType: scalar: string elementRelationship: atomic - - name: teams + - name: currentHostnames type: list: elementType: scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.GitLabIdentityProvider - map: - fields: - - name: ca - type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: clientID - type: - scalar: string - default: "" - - name: clientSecret - type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} - - name: url + - name: defaultHostname type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.GoogleIdentityProvider - map: - fields: - - name: clientID + - name: name type: scalar: string default: "" - - name: clientSecret - type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} - - name: hostedDomain + - name: namespace type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.HTPasswdIdentityProvider - map: - fields: - - name: fileData + - name: relatedObjects type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} -- name: com.github.openshift.api.config.v1.HubSource + list: + elementType: + namedType: com.github.openshift.api.config.v1.ObjectReference + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.ConditionalUpdate map: fields: - - name: disabled - type: - scalar: boolean - default: false - - name: name + - name: conditions type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.HubSourceStatus - map: - fields: - - name: message + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type + - name: release type: - scalar: string - - name: status + namedType: com.github.openshift.api.config.v1.Release + default: {} + - name: riskNames type: - scalar: string -- name: com.github.openshift.api.config.v1.IBMCloudPlatformSpec - map: - fields: - - name: serviceEndpoints + list: + elementType: + scalar: string + elementRelationship: associative + - name: risks type: list: elementType: - namedType: com.github.openshift.api.config.v1.IBMCloudServiceEndpoint + namedType: com.github.openshift.api.config.v1.ConditionalUpdateRisk elementRelationship: associative keys: - name -- name: com.github.openshift.api.config.v1.IBMCloudPlatformStatus +- name: com.github.openshift.api.config.v1.ConditionalUpdateRisk map: fields: - - name: cisInstanceCRN - type: - scalar: string - - name: dnsInstanceCRN - type: - scalar: string - - name: location - type: - scalar: string - - name: providerType - type: - scalar: string - - name: resourceGroupName - type: - scalar: string - - name: serviceEndpoints + - name: conditions type: list: elementType: - namedType: com.github.openshift.api.config.v1.IBMCloudServiceEndpoint + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: associative keys: - - name -- name: com.github.openshift.api.config.v1.IBMCloudServiceEndpoint - map: - fields: + - type + - name: matchingRules + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.ClusterCondition + elementRelationship: atomic + - name: message + type: + scalar: string + default: "" - name: name type: scalar: string @@ -1619,48 +1601,24 @@ var schemaYAML = typed.YAMLObject(`types: type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.IdentityProvider +- name: com.github.openshift.api.config.v1.ConfigMapFileReference map: fields: - - name: basicAuth - type: - namedType: com.github.openshift.api.config.v1.BasicAuthIdentityProvider - - name: github - type: - namedType: com.github.openshift.api.config.v1.GitHubIdentityProvider - - name: gitlab - type: - namedType: com.github.openshift.api.config.v1.GitLabIdentityProvider - - name: google - type: - namedType: com.github.openshift.api.config.v1.GoogleIdentityProvider - - name: htpasswd - type: - namedType: com.github.openshift.api.config.v1.HTPasswdIdentityProvider - - name: keystone - type: - namedType: com.github.openshift.api.config.v1.KeystoneIdentityProvider - - name: ldap - type: - namedType: com.github.openshift.api.config.v1.LDAPIdentityProvider - - name: mappingMethod + - name: key type: scalar: string - name: name type: scalar: string default: "" - - name: openID - type: - namedType: com.github.openshift.api.config.v1.OpenIDIdentityProvider - - name: requestHeader - type: - namedType: com.github.openshift.api.config.v1.RequestHeaderIdentityProvider - - name: type +- name: com.github.openshift.api.config.v1.ConfigMapNameReference + map: + fields: + - name: name type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.Image +- name: com.github.openshift.api.config.v1.Console map: fields: - name: apiVersion @@ -1671,113 +1629,76 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.ImageSpec + namedType: com.github.openshift.api.config.v1.ConsoleSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.ImageStatus + namedType: com.github.openshift.api.config.v1.ConsoleStatus default: {} -- name: com.github.openshift.api.config.v1.ImageContentPolicy +- name: com.github.openshift.api.config.v1.ConsoleAuthentication map: fields: - - name: apiVersion + - name: logoutRedirect type: scalar: string - - name: kind - type: - scalar: string - - name: metadata +- name: com.github.openshift.api.config.v1.ConsoleSpec + map: + fields: + - name: authentication type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: com.github.openshift.api.config.v1.ConsoleAuthentication default: {} - - name: spec +- name: com.github.openshift.api.config.v1.ConsoleStatus + map: + fields: + - name: consoleURL type: - namedType: com.github.openshift.api.config.v1.ImageContentPolicySpec - default: {} -- name: com.github.openshift.api.config.v1.ImageContentPolicySpec + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.Custom map: fields: - - name: repositoryDigestMirrors + - name: configs type: list: elementType: - namedType: com.github.openshift.api.config.v1.RepositoryDigestMirrors + namedType: com.github.openshift.api.config.v1.GathererConfig elementRelationship: associative keys: - - source -- name: com.github.openshift.api.config.v1.ImageDigestMirrorSet + - name +- name: com.github.openshift.api.config.v1.CustomFeatureGates map: fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1.ImageDigestMirrorSetSpec - default: {} - - name: status + - name: disabled type: - namedType: com.github.openshift.api.config.v1.ImageDigestMirrorSetStatus - default: {} -- name: com.github.openshift.api.config.v1.ImageDigestMirrorSetSpec - map: - fields: - - name: imageDigestMirrors + list: + elementType: + scalar: string + elementRelationship: atomic + - name: enabled type: list: elementType: - namedType: com.github.openshift.api.config.v1.ImageDigestMirrors + scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.ImageDigestMirrorSetStatus - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.ImageDigestMirrors +- name: com.github.openshift.api.config.v1.CustomTLSProfile map: fields: - - name: mirrorSourcePolicy - type: - scalar: string - - name: mirrors + - name: ciphers type: list: elementType: scalar: string - elementRelationship: associative - - name: source - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.ImageLabel - map: - fields: - - name: name + elementRelationship: atomic + - name: minTLSVersion type: scalar: string default: "" - - name: value - type: - scalar: string -- name: com.github.openshift.api.config.v1.ImagePolicy +- name: com.github.openshift.api.config.v1.DNS map: fields: - name: apiVersion @@ -1788,128 +1709,152 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.ImagePolicySpec + namedType: com.github.openshift.api.config.v1.DNSSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.ImagePolicyStatus + namedType: com.github.openshift.api.config.v1.DNSStatus default: {} -- name: com.github.openshift.api.config.v1.ImagePolicyFulcioCAWithRekorRootOfTrust +- name: com.github.openshift.api.config.v1.DNSPlatformSpec map: fields: - - name: fulcioCAData - type: - scalar: string - - name: fulcioSubject + - name: aws type: - namedType: com.github.openshift.api.config.v1.PolicyFulcioSubject - default: {} - - name: rekorKeyData + namedType: com.github.openshift.api.config.v1.AWSDNSSpec + - name: type type: scalar: string -- name: com.github.openshift.api.config.v1.ImagePolicyPKIRootOfTrust + default: "" + unions: + - discriminator: type + fields: + - fieldName: aws + discriminatorValue: AWS +- name: com.github.openshift.api.config.v1.DNSSpec map: fields: - - name: caIntermediatesData - type: - scalar: string - - name: caRootsData + - name: baseDomain type: scalar: string - - name: pkiCertificateSubject + default: "" + - name: platform type: - namedType: com.github.openshift.api.config.v1.PKICertificateSubject + namedType: com.github.openshift.api.config.v1.DNSPlatformSpec default: {} -- name: com.github.openshift.api.config.v1.ImagePolicyPublicKeyRootOfTrust - map: - fields: - - name: keyData + - name: privateZone type: - scalar: string - - name: rekorKeyData + namedType: com.github.openshift.api.config.v1.DNSZone + - name: publicZone type: - scalar: string -- name: com.github.openshift.api.config.v1.ImagePolicySpec + namedType: com.github.openshift.api.config.v1.DNSZone +- name: com.github.openshift.api.config.v1.DNSStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.DNSZone map: fields: - - name: policy + - name: id type: - namedType: com.github.openshift.api.config.v1.ImageSigstoreVerificationPolicy - default: {} - - name: scopes + scalar: string + - name: tags type: - list: + map: elementType: scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1.ImagePolicyStatus +- name: com.github.openshift.api.config.v1.DeprecatedWebhookTokenAuthenticator map: fields: - - name: conditions + - name: kubeConfig type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type -- name: com.github.openshift.api.config.v1.ImageSigstoreVerificationPolicy + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} +- name: com.github.openshift.api.config.v1.EquinixMetalPlatformSpec + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.EquinixMetalPlatformStatus map: fields: - - name: rootOfTrust + - name: apiServerInternalIP type: - namedType: com.github.openshift.api.config.v1.PolicyRootOfTrust - default: {} - - name: signedIdentity + scalar: string + - name: ingressIP type: - namedType: com.github.openshift.api.config.v1.PolicyIdentity -- name: com.github.openshift.api.config.v1.ImageSpec + scalar: string +- name: com.github.openshift.api.config.v1.ExternalIPConfig map: fields: - - name: additionalTrustedCA + - name: autoAssignCIDRs type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: allowedRegistriesForImport + list: + elementType: + scalar: string + elementRelationship: atomic + - name: policy + type: + namedType: com.github.openshift.api.config.v1.ExternalIPPolicy +- name: com.github.openshift.api.config.v1.ExternalIPPolicy + map: + fields: + - name: allowedCIDRs type: list: elementType: - namedType: com.github.openshift.api.config.v1.RegistryLocation + scalar: string elementRelationship: atomic - - name: externalRegistryHostnames + - name: rejectedCIDRs type: list: elementType: scalar: string elementRelationship: atomic - - name: imageStreamImportMode +- name: com.github.openshift.api.config.v1.ExternalPlatformSpec + map: + fields: + - name: platformName type: scalar: string - default: "" - - name: registrySources + default: Unknown +- name: com.github.openshift.api.config.v1.ExternalPlatformStatus + map: + fields: + - name: cloudControllerManager type: - namedType: com.github.openshift.api.config.v1.RegistrySources + namedType: com.github.openshift.api.config.v1.CloudControllerManagerStatus default: {} -- name: com.github.openshift.api.config.v1.ImageStatus +- name: com.github.openshift.api.config.v1.ExtraMapping map: fields: - - name: externalRegistryHostnames - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: imageStreamImportMode + - name: key type: scalar: string - - name: internalRegistryHostname + default: "" + - name: valueExpression type: scalar: string -- name: com.github.openshift.api.config.v1.ImageTagMirrorSet + default: "" +- name: com.github.openshift.api.config.v1.FeatureGate map: fields: - name: apiVersion @@ -1920,26 +1865,76 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.ImageTagMirrorSetSpec + namedType: com.github.openshift.api.config.v1.FeatureGateSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.ImageTagMirrorSetStatus + namedType: com.github.openshift.api.config.v1.FeatureGateStatus default: {} -- name: com.github.openshift.api.config.v1.ImageTagMirrorSetSpec +- name: com.github.openshift.api.config.v1.FeatureGateAttributes map: fields: - - name: imageTagMirrors + - name: name type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.ImageTagMirrors + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.FeatureGateDetails + map: + fields: + - name: disabled + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.FeatureGateAttributes elementRelationship: atomic -- name: com.github.openshift.api.config.v1.ImageTagMirrorSetStatus + - name: enabled + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.FeatureGateAttributes + elementRelationship: atomic + - name: version + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.FeatureGateSpec + map: + fields: + - name: customNoUpgrade + type: + namedType: com.github.openshift.api.config.v1.CustomFeatureGates + - name: featureSet + type: + scalar: string + unions: + - discriminator: featureSet + fields: + - fieldName: customNoUpgrade + discriminatorValue: CustomNoUpgrade +- name: com.github.openshift.api.config.v1.FeatureGateStatus + map: + fields: + - name: conditions + type: + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type + - name: featureGates + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.FeatureGateDetails + elementRelationship: associative + keys: + - version +- name: com.github.openshift.api.config.v1.GCPPlatformSpec map: elementType: scalar: untyped @@ -1951,172 +1946,287 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.ImageTagMirrors +- name: com.github.openshift.api.config.v1.GCPPlatformStatus map: fields: - - name: mirrorSourcePolicy + - name: cloudLoadBalancerConfig + type: + namedType: com.github.openshift.api.config.v1.CloudLoadBalancerConfig + default: + dnsType: PlatformDefault + - name: projectID type: scalar: string - - name: mirrors + default: "" + - name: region + type: + scalar: string + default: "" + - name: resourceLabels type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1.GCPResourceLabel elementRelationship: associative - - name: source + keys: + - key + - name: resourceTags + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.GCPResourceTag + elementRelationship: associative + keys: + - key +- name: com.github.openshift.api.config.v1.GCPResourceLabel + map: + fields: + - name: key type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.Infrastructure + - name: value + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.GCPResourceTag map: fields: - - name: apiVersion + - name: key type: scalar: string - - name: kind + default: "" + - name: parentID type: scalar: string - - name: metadata + default: "" + - name: value type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.GatherConfig + map: + fields: + - name: dataPolicy type: - namedType: com.github.openshift.api.config.v1.InfrastructureSpec + list: + elementType: + scalar: string + elementRelationship: atomic + - name: gatherers + type: + namedType: com.github.openshift.api.config.v1.Gatherers default: {} - - name: status + - name: storage type: - namedType: com.github.openshift.api.config.v1.InfrastructureStatus + namedType: com.github.openshift.api.config.v1.Storage default: {} -- name: com.github.openshift.api.config.v1.InfrastructureSpec +- name: com.github.openshift.api.config.v1.GathererConfig map: fields: - - name: cloudConfig + - name: name type: - namedType: com.github.openshift.api.config.v1.ConfigMapFileReference - default: {} - - name: platformSpec + scalar: string + - name: state type: - namedType: com.github.openshift.api.config.v1.PlatformSpec - default: {} -- name: com.github.openshift.api.config.v1.InfrastructureStatus + scalar: string +- name: com.github.openshift.api.config.v1.Gatherers map: fields: - - name: apiServerInternalURI + - name: custom type: - scalar: string - default: "" - - name: apiServerURL + namedType: com.github.openshift.api.config.v1.Custom + default: {} + - name: mode type: scalar: string - default: "" - - name: controlPlaneTopology + unions: + - discriminator: mode + fields: + - fieldName: custom + discriminatorValue: Custom +- name: com.github.openshift.api.config.v1.GitHubIdentityProvider + map: + fields: + - name: ca + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: clientID type: scalar: string default: "" - - name: cpuPartitioning + - name: clientSecret type: - scalar: string - default: None - - name: etcdDiscoveryDomain + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: hostname type: scalar: string default: "" - - name: infrastructureName + - name: organizations + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: teams + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.GitLabIdentityProvider + map: + fields: + - name: ca + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: clientID type: scalar: string default: "" - - name: infrastructureTopology + - name: clientSecret type: - scalar: string - - name: platform + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: url type: scalar: string - - name: platformStatus - type: - namedType: com.github.openshift.api.config.v1.PlatformStatus -- name: com.github.openshift.api.config.v1.Ingress + default: "" +- name: com.github.openshift.api.config.v1.GoogleIdentityProvider map: fields: - - name: apiVersion - type: - scalar: string - - name: kind + - name: clientID type: scalar: string - - name: metadata + default: "" + - name: clientSecret type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: com.github.openshift.api.config.v1.SecretNameReference default: {} - - name: spec + - name: hostedDomain type: - namedType: com.github.openshift.api.config.v1.IngressSpec - default: {} - - name: status + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.HTPasswdIdentityProvider + map: + fields: + - name: fileData type: - namedType: com.github.openshift.api.config.v1.IngressStatus + namedType: com.github.openshift.api.config.v1.SecretNameReference default: {} -- name: com.github.openshift.api.config.v1.IngressPlatformSpec +- name: com.github.openshift.api.config.v1.HubSource map: fields: - - name: aws + - name: disabled type: - namedType: com.github.openshift.api.config.v1.AWSIngressSpec - - name: type + scalar: boolean + default: false + - name: name type: scalar: string default: "" - unions: - - discriminator: type - fields: - - fieldName: aws - discriminatorValue: AWS -- name: com.github.openshift.api.config.v1.IngressSpec +- name: com.github.openshift.api.config.v1.HubSourceStatus map: fields: - - name: appsDomain + - name: message type: scalar: string - - name: componentRoutes + - name: status + type: + scalar: string +- name: com.github.openshift.api.config.v1.IBMCloudPlatformSpec + map: + fields: + - name: serviceEndpoints type: list: elementType: - namedType: com.github.openshift.api.config.v1.ComponentRouteSpec + namedType: com.github.openshift.api.config.v1.IBMCloudServiceEndpoint elementRelationship: associative keys: - - namespace - name - - name: domain +- name: com.github.openshift.api.config.v1.IBMCloudPlatformStatus + map: + fields: + - name: cisInstanceCRN type: scalar: string - default: "" - - name: loadBalancer + - name: dnsInstanceCRN type: - namedType: com.github.openshift.api.config.v1.LoadBalancer - default: {} - - name: requiredHSTSPolicies + scalar: string + - name: location type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.RequiredHSTSPolicy - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.IngressStatus - map: - fields: - - name: componentRoutes + scalar: string + - name: providerType + type: + scalar: string + - name: resourceGroupName + type: + scalar: string + - name: serviceEndpoints type: list: elementType: - namedType: com.github.openshift.api.config.v1.ComponentRouteStatus + namedType: com.github.openshift.api.config.v1.IBMCloudServiceEndpoint elementRelationship: associative keys: - - namespace - name - - name: defaultPlacement +- name: com.github.openshift.api.config.v1.IBMCloudServiceEndpoint + map: + fields: + - name: name type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.InsightsDataGather + - name: url + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.IdentityProvider + map: + fields: + - name: basicAuth + type: + namedType: com.github.openshift.api.config.v1.BasicAuthIdentityProvider + - name: github + type: + namedType: com.github.openshift.api.config.v1.GitHubIdentityProvider + - name: gitlab + type: + namedType: com.github.openshift.api.config.v1.GitLabIdentityProvider + - name: google + type: + namedType: com.github.openshift.api.config.v1.GoogleIdentityProvider + - name: htpasswd + type: + namedType: com.github.openshift.api.config.v1.HTPasswdIdentityProvider + - name: keystone + type: + namedType: com.github.openshift.api.config.v1.KeystoneIdentityProvider + - name: ldap + type: + namedType: com.github.openshift.api.config.v1.LDAPIdentityProvider + - name: mappingMethod + type: + scalar: string + - name: name + type: + scalar: string + default: "" + - name: openID + type: + namedType: com.github.openshift.api.config.v1.OpenIDIdentityProvider + - name: requestHeader + type: + namedType: com.github.openshift.api.config.v1.RequestHeaderIdentityProvider + - name: type + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.Image map: fields: - name: apiVersion @@ -2127,70 +2237,75 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.InsightsDataGatherSpec + namedType: com.github.openshift.api.config.v1.ImageSpec default: {} -- name: com.github.openshift.api.config.v1.InsightsDataGatherSpec - map: - fields: - - name: gatherConfig + - name: status type: - namedType: com.github.openshift.api.config.v1.GatherConfig + namedType: com.github.openshift.api.config.v1.ImageStatus default: {} -- name: com.github.openshift.api.config.v1.IntermediateTLSProfile - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.KMSConfig +- name: com.github.openshift.api.config.v1.ImageContentPolicy map: fields: - - name: aws + - name: apiVersion type: - namedType: com.github.openshift.api.config.v1.AWSKMSConfig - - name: type + scalar: string + - name: kind type: scalar: string - default: "" - unions: - - discriminator: type - fields: - - fieldName: aws - discriminatorValue: AWS -- name: com.github.openshift.api.config.v1.KeystoneIdentityProvider + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1.ImageContentPolicySpec + default: {} +- name: com.github.openshift.api.config.v1.ImageContentPolicySpec map: fields: - - name: ca + - name: repositoryDigestMirrors type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: domainName + list: + elementType: + namedType: com.github.openshift.api.config.v1.RepositoryDigestMirrors + elementRelationship: associative + keys: + - source +- name: com.github.openshift.api.config.v1.ImageDigestMirrorSet + map: + fields: + - name: apiVersion type: scalar: string - default: "" - - name: tlsClientCert + - name: kind type: - namedType: com.github.openshift.api.config.v1.SecretNameReference + scalar: string + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - - name: tlsClientKey + - name: spec type: - namedType: com.github.openshift.api.config.v1.SecretNameReference + namedType: com.github.openshift.api.config.v1.ImageDigestMirrorSetSpec default: {} - - name: url + - name: status type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.KubevirtPlatformSpec + namedType: com.github.openshift.api.config.v1.ImageDigestMirrorSetStatus + default: {} +- name: com.github.openshift.api.config.v1.ImageDigestMirrorSetSpec + map: + fields: + - name: imageDigestMirrors + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.ImageDigestMirrors + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.ImageDigestMirrorSetStatus map: elementType: scalar: untyped @@ -2202,250 +2317,223 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.KubevirtPlatformStatus +- name: com.github.openshift.api.config.v1.ImageDigestMirrors map: fields: - - name: apiServerInternalIP - type: - scalar: string - - name: ingressIP + - name: mirrorSourcePolicy type: scalar: string -- name: com.github.openshift.api.config.v1.LDAPAttributeMapping - map: - fields: - - name: email + - name: mirrors type: list: elementType: scalar: string - elementRelationship: atomic - - name: id + elementRelationship: associative + - name: source type: - list: - elementType: - scalar: string - elementRelationship: atomic + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.ImageLabel + map: + fields: - name: name type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: preferredUsername + scalar: string + default: "" + - name: value type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.LDAPIdentityProvider + scalar: string +- name: com.github.openshift.api.config.v1.ImagePolicy map: fields: - - name: attributes + - name: apiVersion type: - namedType: com.github.openshift.api.config.v1.LDAPAttributeMapping - default: {} - - name: bindDN + scalar: string + - name: kind type: scalar: string - default: "" - - name: bindPassword + - name: metadata type: - namedType: com.github.openshift.api.config.v1.SecretNameReference + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - - name: ca + - name: spec type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + namedType: com.github.openshift.api.config.v1.ImagePolicySpec default: {} - - name: insecure + - name: status type: - scalar: boolean - default: false - - name: url + namedType: com.github.openshift.api.config.v1.ImagePolicyStatus + default: {} +- name: com.github.openshift.api.config.v1.ImagePolicyFulcioCAWithRekorRootOfTrust + map: + fields: + - name: fulcioCAData type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.LoadBalancer + - name: fulcioSubject + type: + namedType: com.github.openshift.api.config.v1.PolicyFulcioSubject + default: {} + - name: rekorKeyData + type: + scalar: string +- name: com.github.openshift.api.config.v1.ImagePolicyPKIRootOfTrust map: fields: - - name: platform + - name: caIntermediatesData type: - namedType: com.github.openshift.api.config.v1.IngressPlatformSpec + scalar: string + - name: caRootsData + type: + scalar: string + - name: pkiCertificateSubject + type: + namedType: com.github.openshift.api.config.v1.PKICertificateSubject default: {} -- name: com.github.openshift.api.config.v1.MTUMigration +- name: com.github.openshift.api.config.v1.ImagePolicyPublicKeyRootOfTrust map: fields: - - name: machine + - name: keyData type: - namedType: com.github.openshift.api.config.v1.MTUMigrationValues - - name: network + scalar: string + - name: rekorKeyData type: - namedType: com.github.openshift.api.config.v1.MTUMigrationValues -- name: com.github.openshift.api.config.v1.MTUMigrationValues + scalar: string +- name: com.github.openshift.api.config.v1.ImagePolicySpec map: fields: - - name: from + - name: policy type: - scalar: numeric - - name: to + namedType: com.github.openshift.api.config.v1.ImageSigstoreVerificationPolicy + default: {} + - name: scopes type: - scalar: numeric -- name: com.github.openshift.api.config.v1.MaxAgePolicy + list: + elementType: + scalar: string + elementRelationship: associative +- name: com.github.openshift.api.config.v1.ImagePolicyStatus map: fields: - - name: largestMaxAge - type: - scalar: numeric - - name: smallestMaxAge + - name: conditions type: - scalar: numeric -- name: com.github.openshift.api.config.v1.ModernTLSProfile - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.Network + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type +- name: com.github.openshift.api.config.v1.ImageSigstoreVerificationPolicy map: fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + - name: rootOfTrust type: - namedType: com.github.openshift.api.config.v1.NetworkSpec + namedType: com.github.openshift.api.config.v1.PolicyRootOfTrust default: {} - - name: status + - name: signedIdentity type: - namedType: com.github.openshift.api.config.v1.NetworkStatus - default: {} -- name: com.github.openshift.api.config.v1.NetworkDiagnostics + namedType: com.github.openshift.api.config.v1.PolicyIdentity +- name: com.github.openshift.api.config.v1.ImageSpec map: fields: - - name: mode - type: - scalar: string - default: "" - - name: sourcePlacement - type: - namedType: com.github.openshift.api.config.v1.NetworkDiagnosticsSourcePlacement - default: {} - - name: targetPlacement + - name: additionalTrustedCA type: - namedType: com.github.openshift.api.config.v1.NetworkDiagnosticsTargetPlacement + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} -- name: com.github.openshift.api.config.v1.NetworkDiagnosticsSourcePlacement - map: - fields: - - name: nodeSelector + - name: allowedRegistriesForImport type: - map: + list: elementType: - scalar: string - - name: tolerations + namedType: com.github.openshift.api.config.v1.RegistryLocation + elementRelationship: atomic + - name: externalRegistryHostnames type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.NetworkDiagnosticsTargetPlacement + - name: imageStreamImportMode + type: + scalar: string + default: "" + - name: registrySources + type: + namedType: com.github.openshift.api.config.v1.RegistrySources + default: {} +- name: com.github.openshift.api.config.v1.ImageStatus map: fields: - - name: nodeSelector - type: - map: - elementType: - scalar: string - - name: tolerations + - name: externalRegistryHostnames type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + scalar: string elementRelationship: atomic -- name: com.github.openshift.api.config.v1.NetworkMigration - map: - fields: - - name: mtu + - name: imageStreamImportMode type: - namedType: com.github.openshift.api.config.v1.MTUMigration - - name: networkType + scalar: string + - name: internalRegistryHostname type: scalar: string -- name: com.github.openshift.api.config.v1.NetworkSpec +- name: com.github.openshift.api.config.v1.ImageTagMirrorSet map: fields: - - name: clusterNetwork + - name: apiVersion type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.ClusterNetworkEntry - elementRelationship: atomic - - name: externalIP + scalar: string + - name: kind type: - namedType: com.github.openshift.api.config.v1.ExternalIPConfig - - name: networkDiagnostics + scalar: string + - name: metadata type: - namedType: com.github.openshift.api.config.v1.NetworkDiagnostics + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - - name: networkType - type: - scalar: string - default: "" - - name: serviceNetwork + - name: spec type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: serviceNodePortRange + namedType: com.github.openshift.api.config.v1.ImageTagMirrorSetSpec + default: {} + - name: status type: - scalar: string -- name: com.github.openshift.api.config.v1.NetworkStatus + namedType: com.github.openshift.api.config.v1.ImageTagMirrorSetStatus + default: {} +- name: com.github.openshift.api.config.v1.ImageTagMirrorSetSpec map: fields: - - name: clusterNetwork + - name: imageTagMirrors type: list: elementType: - namedType: com.github.openshift.api.config.v1.ClusterNetworkEntry + namedType: com.github.openshift.api.config.v1.ImageTagMirrors elementRelationship: atomic - - name: clusterNetworkMTU +- name: com.github.openshift.api.config.v1.ImageTagMirrorSetStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.ImageTagMirrors + map: + fields: + - name: mirrorSourcePolicy type: - scalar: numeric - - name: conditions + scalar: string + - name: mirrors type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + scalar: string elementRelationship: associative - keys: - - type - - name: migration - type: - namedType: com.github.openshift.api.config.v1.NetworkMigration - - name: networkType + - name: source type: scalar: string - - name: serviceNetwork - type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.Node + default: "" +- name: com.github.openshift.api.config.v1.Infrastructure map: fields: - name: apiVersion @@ -2456,161 +2544,145 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.NodeSpec + namedType: com.github.openshift.api.config.v1.InfrastructureSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.NodeStatus + namedType: com.github.openshift.api.config.v1.InfrastructureStatus default: {} -- name: com.github.openshift.api.config.v1.NodeSpec +- name: com.github.openshift.api.config.v1.InfrastructureSpec map: fields: - - name: cgroupMode + - name: cloudConfig + type: + namedType: com.github.openshift.api.config.v1.ConfigMapFileReference + default: {} + - name: platformSpec + type: + namedType: com.github.openshift.api.config.v1.PlatformSpec + default: {} +- name: com.github.openshift.api.config.v1.InfrastructureStatus + map: + fields: + - name: apiServerInternalURI type: scalar: string - - name: minimumKubeletVersion + default: "" + - name: apiServerURL type: scalar: string default: "" - - name: workerLatencyProfile + - name: controlPlaneTopology type: scalar: string -- name: com.github.openshift.api.config.v1.NodeStatus - map: - fields: - - name: conditions + default: "" + - name: cpuPartitioning type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type -- name: com.github.openshift.api.config.v1.NutanixFailureDomain - map: - fields: - - name: cluster + scalar: string + default: None + - name: etcdDiscoveryDomain type: - namedType: com.github.openshift.api.config.v1.NutanixResourceIdentifier - default: {} - - name: name + scalar: string + default: "" + - name: infrastructureName type: scalar: string default: "" - - name: subnets + - name: infrastructureTopology type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.NutanixResourceIdentifier - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.NutanixPlatformLoadBalancer - map: - fields: - - name: type + scalar: string + - name: platform type: scalar: string - default: OpenShiftManagedDefault - unions: - - discriminator: type -- name: com.github.openshift.api.config.v1.NutanixPlatformSpec - map: - fields: - - name: failureDomains - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.NutanixFailureDomain - elementRelationship: associative - keys: - - name - - name: prismCentral - type: - namedType: com.github.openshift.api.config.v1.NutanixPrismEndpoint - default: {} - - name: prismElements + - name: platformStatus type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.NutanixPrismElementEndpoint - elementRelationship: associative - keys: - - name -- name: com.github.openshift.api.config.v1.NutanixPlatformStatus + namedType: com.github.openshift.api.config.v1.PlatformStatus +- name: com.github.openshift.api.config.v1.Ingress map: fields: - - name: apiServerInternalIP + - name: apiVersion type: scalar: string - - name: apiServerInternalIPs - type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: dnsRecordsType + - name: kind type: scalar: string - - name: ingressIP + - name: metadata type: - scalar: string - - name: ingressIPs + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: loadBalancer + namedType: com.github.openshift.api.config.v1.IngressSpec + default: {} + - name: status type: - namedType: com.github.openshift.api.config.v1.NutanixPlatformLoadBalancer - default: - type: OpenShiftManagedDefault -- name: com.github.openshift.api.config.v1.NutanixPrismElementEndpoint + namedType: com.github.openshift.api.config.v1.IngressStatus + default: {} +- name: com.github.openshift.api.config.v1.IngressPlatformSpec map: fields: - - name: endpoint + - name: aws type: - namedType: com.github.openshift.api.config.v1.NutanixPrismEndpoint - default: {} - - name: name + namedType: com.github.openshift.api.config.v1.AWSIngressSpec + - name: type type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.NutanixPrismEndpoint + unions: + - discriminator: type + fields: + - fieldName: aws + discriminatorValue: AWS +- name: com.github.openshift.api.config.v1.IngressSpec map: fields: - - name: address + - name: appsDomain + type: + scalar: string + - name: componentRoutes + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.ComponentRouteSpec + elementRelationship: associative + keys: + - namespace + - name + - name: domain type: scalar: string default: "" - - name: port + - name: loadBalancer type: - scalar: numeric - default: 0 -- name: com.github.openshift.api.config.v1.NutanixResourceIdentifier + namedType: com.github.openshift.api.config.v1.LoadBalancer + default: {} + - name: requiredHSTSPolicies + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.RequiredHSTSPolicy + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.IngressStatus map: fields: - - name: name + - name: componentRoutes type: - scalar: string - - name: type + list: + elementType: + namedType: com.github.openshift.api.config.v1.ComponentRouteStatus + elementRelationship: associative + keys: + - namespace + - name + - name: defaultPlacement type: scalar: string default: "" - - name: uuid - type: - scalar: string - unions: - - discriminator: type - fields: - - fieldName: name - discriminatorValue: Name - - fieldName: uuid - discriminatorValue: UUID -- name: com.github.openshift.api.config.v1.OAuth +- name: com.github.openshift.api.config.v1.InsightsDataGather map: fields: - name: apiVersion @@ -2621,34 +2693,20 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.OAuthSpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.config.v1.OAuthStatus + namedType: com.github.openshift.api.config.v1.InsightsDataGatherSpec default: {} -- name: com.github.openshift.api.config.v1.OAuthSpec +- name: com.github.openshift.api.config.v1.InsightsDataGatherSpec map: fields: - - name: identityProviders - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.IdentityProvider - elementRelationship: atomic - - name: templates - type: - namedType: com.github.openshift.api.config.v1.OAuthTemplates - default: {} - - name: tokenConfig + - name: gatherConfig type: - namedType: com.github.openshift.api.config.v1.TokenConfig + namedType: com.github.openshift.api.config.v1.GatherConfig default: {} -- name: com.github.openshift.api.config.v1.OAuthStatus +- name: com.github.openshift.api.config.v1.IntermediateTLSProfile map: elementType: scalar: untyped @@ -2660,152 +2718,154 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.OAuthTemplates +- name: com.github.openshift.api.config.v1.KMSConfig map: fields: - - name: error - type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} - - name: login + - name: aws type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} - - name: providerSelection + namedType: com.github.openshift.api.config.v1.AWSKMSConfig + - name: type type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} -- name: com.github.openshift.api.config.v1.OIDCClientConfig + scalar: string + default: "" + unions: + - discriminator: type + fields: + - fieldName: aws + discriminatorValue: AWS +- name: com.github.openshift.api.config.v1.KeystoneIdentityProvider map: fields: - - name: clientID + - name: ca + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: domainName type: scalar: string default: "" - - name: clientSecret + - name: tlsClientCert type: namedType: com.github.openshift.api.config.v1.SecretNameReference default: {} - - name: componentName + - name: tlsClientKey type: - scalar: string - default: "" - - name: componentNamespace + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: url type: scalar: string default: "" - - name: extraScopes - type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1.OIDCClientReference +- name: com.github.openshift.api.config.v1.KubevirtPlatformSpec + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.KubevirtPlatformStatus map: fields: - - name: clientID - type: - scalar: string - default: "" - - name: issuerURL + - name: apiServerInternalIP type: scalar: string - default: "" - - name: oidcProviderName + - name: ingressIP type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.OIDCClientStatus +- name: com.github.openshift.api.config.v1.LDAPAttributeMapping map: fields: - - name: componentName - type: - scalar: string - default: "" - - name: componentNamespace + - name: email type: - scalar: string - default: "" - - name: conditions + list: + elementType: + scalar: string + elementRelationship: atomic + - name: id type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type - - name: consumingUsers + scalar: string + elementRelationship: atomic + - name: name type: list: elementType: scalar: string - elementRelationship: associative - - name: currentOIDCClients + elementRelationship: atomic + - name: preferredUsername type: list: elementType: - namedType: com.github.openshift.api.config.v1.OIDCClientReference - elementRelationship: associative - keys: - - issuerURL - - clientID -- name: com.github.openshift.api.config.v1.OIDCProvider + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.LDAPIdentityProvider map: fields: - - name: claimMappings + - name: attributes type: - namedType: com.github.openshift.api.config.v1.TokenClaimMappings + namedType: com.github.openshift.api.config.v1.LDAPAttributeMapping default: {} - - name: claimValidationRules + - name: bindDN type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.TokenClaimValidationRule - elementRelationship: atomic - - name: issuer + scalar: string + default: "" + - name: bindPassword type: - namedType: com.github.openshift.api.config.v1.TokenIssuer + namedType: com.github.openshift.api.config.v1.SecretNameReference default: {} - - name: name + - name: ca + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: insecure + type: + scalar: boolean + default: false + - name: url type: scalar: string default: "" - - name: oidcClients +- name: com.github.openshift.api.config.v1.LoadBalancer + map: + fields: + - name: platform type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.OIDCClientConfig - elementRelationship: associative - keys: - - componentNamespace - - componentName - - name: userValidationRules + namedType: com.github.openshift.api.config.v1.IngressPlatformSpec + default: {} +- name: com.github.openshift.api.config.v1.MTUMigration + map: + fields: + - name: machine type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.TokenUserValidationRule - elementRelationship: associative - keys: - - expression -- name: com.github.openshift.api.config.v1.ObjectReference + namedType: com.github.openshift.api.config.v1.MTUMigrationValues + - name: network + type: + namedType: com.github.openshift.api.config.v1.MTUMigrationValues +- name: com.github.openshift.api.config.v1.MTUMigrationValues map: fields: - - name: group + - name: from type: - scalar: string - default: "" - - name: name + scalar: numeric + - name: to type: - scalar: string - default: "" - - name: namespace + scalar: numeric +- name: com.github.openshift.api.config.v1.MaxAgePolicy + map: + fields: + - name: largestMaxAge type: - scalar: string - - name: resource + scalar: numeric + - name: smallestMaxAge type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.OldTLSProfile + scalar: numeric +- name: com.github.openshift.api.config.v1.ModernTLSProfile map: elementType: scalar: untyped @@ -2817,150 +2877,141 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.OpenIDClaims +- name: com.github.openshift.api.config.v1.Network map: fields: - - name: email - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: groups + - name: apiVersion type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: name + scalar: string + - name: kind type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: preferredUsername + scalar: string + - name: metadata type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.OpenIDIdentityProvider - map: - fields: - - name: ca + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + namedType: com.github.openshift.api.config.v1.NetworkSpec default: {} - - name: claims + - name: status type: - namedType: com.github.openshift.api.config.v1.OpenIDClaims + namedType: com.github.openshift.api.config.v1.NetworkStatus default: {} - - name: clientID +- name: com.github.openshift.api.config.v1.NetworkDiagnostics + map: + fields: + - name: mode type: scalar: string default: "" - - name: clientSecret + - name: sourcePlacement type: - namedType: com.github.openshift.api.config.v1.SecretNameReference + namedType: com.github.openshift.api.config.v1.NetworkDiagnosticsSourcePlacement default: {} - - name: extraAuthorizeParameters + - name: targetPlacement + type: + namedType: com.github.openshift.api.config.v1.NetworkDiagnosticsTargetPlacement + default: {} +- name: com.github.openshift.api.config.v1.NetworkDiagnosticsSourcePlacement + map: + fields: + - name: nodeSelector type: map: elementType: scalar: string - - name: extraScopes + - name: tolerations type: list: elementType: - scalar: string + namedType: Toleration.v1.core.api.k8s.io elementRelationship: atomic - - name: issuer - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.OpenStackPlatformLoadBalancer - map: - fields: - - name: type - type: - scalar: string - default: OpenShiftManagedDefault - unions: - - discriminator: type -- name: com.github.openshift.api.config.v1.OpenStackPlatformSpec +- name: com.github.openshift.api.config.v1.NetworkDiagnosticsTargetPlacement map: fields: - - name: apiServerInternalIPs - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: ingressIPs + - name: nodeSelector type: - list: + map: elementType: scalar: string - elementRelationship: atomic - - name: machineNetworks + - name: tolerations type: list: elementType: - scalar: string + namedType: Toleration.v1.core.api.k8s.io elementRelationship: atomic -- name: com.github.openshift.api.config.v1.OpenStackPlatformStatus +- name: com.github.openshift.api.config.v1.NetworkMigration map: fields: - - name: apiServerInternalIP + - name: mtu + type: + namedType: com.github.openshift.api.config.v1.MTUMigration + - name: networkType type: scalar: string - - name: apiServerInternalIPs +- name: com.github.openshift.api.config.v1.NetworkSpec + map: + fields: + - name: clusterNetwork type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1.ClusterNetworkEntry elementRelationship: atomic - - name: cloudName + - name: externalIP type: - scalar: string - - name: dnsRecordsType + namedType: com.github.openshift.api.config.v1.ExternalIPConfig + - name: networkDiagnostics type: - scalar: string - - name: ingressIP + namedType: com.github.openshift.api.config.v1.NetworkDiagnostics + default: {} + - name: networkType type: scalar: string - - name: ingressIPs + default: "" + - name: serviceNetwork type: list: elementType: scalar: string elementRelationship: atomic - - name: loadBalancer + - name: serviceNodePortRange type: - namedType: com.github.openshift.api.config.v1.OpenStackPlatformLoadBalancer - default: - type: OpenShiftManagedDefault - - name: machineNetworks + scalar: string +- name: com.github.openshift.api.config.v1.NetworkStatus + map: + fields: + - name: clusterNetwork type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1.ClusterNetworkEntry elementRelationship: atomic - - name: nodeDNSIP + - name: clusterNetworkMTU type: - scalar: string -- name: com.github.openshift.api.config.v1.OperandVersion - map: - fields: - - name: name + scalar: numeric + - name: conditions type: - scalar: string - default: "" - - name: version + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type + - name: migration + type: + namedType: com.github.openshift.api.config.v1.NetworkMigration + - name: networkType type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.OperatorHub + - name: serviceNetwork + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.Node map: fields: - name: apiVersion @@ -2971,38 +3022,58 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1.OperatorHubSpec + namedType: com.github.openshift.api.config.v1.NodeSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1.OperatorHubStatus + namedType: com.github.openshift.api.config.v1.NodeStatus default: {} -- name: com.github.openshift.api.config.v1.OperatorHubSpec +- name: com.github.openshift.api.config.v1.NodeSpec map: fields: - - name: disableAllDefaultSources + - name: cgroupMode type: - scalar: boolean - - name: sources + scalar: string + - name: minimumKubeletVersion type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.HubSource - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.OperatorHubStatus + scalar: string + default: "" + - name: workerLatencyProfile + type: + scalar: string +- name: com.github.openshift.api.config.v1.NodeStatus map: fields: - - name: sources + - name: conditions type: list: elementType: - namedType: com.github.openshift.api.config.v1.HubSourceStatus + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type +- name: com.github.openshift.api.config.v1.NutanixFailureDomain + map: + fields: + - name: cluster + type: + namedType: com.github.openshift.api.config.v1.NutanixResourceIdentifier + default: {} + - name: name + type: + scalar: string + default: "" + - name: subnets + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.NutanixResourceIdentifier elementRelationship: atomic -- name: com.github.openshift.api.config.v1.OvirtPlatformLoadBalancer +- name: com.github.openshift.api.config.v1.NutanixPlatformLoadBalancer map: fields: - name: type @@ -3011,19 +3082,30 @@ var schemaYAML = typed.YAMLObject(`types: default: OpenShiftManagedDefault unions: - discriminator: type -- name: com.github.openshift.api.config.v1.OvirtPlatformSpec +- name: com.github.openshift.api.config.v1.NutanixPlatformSpec map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.OvirtPlatformStatus + fields: + - name: failureDomains + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.NutanixFailureDomain + elementRelationship: associative + keys: + - name + - name: prismCentral + type: + namedType: com.github.openshift.api.config.v1.NutanixPrismEndpoint + default: {} + - name: prismElements + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.NutanixPrismElementEndpoint + elementRelationship: associative + keys: + - name +- name: com.github.openshift.api.config.v1.NutanixPlatformStatus map: fields: - name: apiServerInternalIP @@ -3049,314 +3131,453 @@ var schemaYAML = typed.YAMLObject(`types: elementRelationship: associative - name: loadBalancer type: - namedType: com.github.openshift.api.config.v1.OvirtPlatformLoadBalancer + namedType: com.github.openshift.api.config.v1.NutanixPlatformLoadBalancer default: type: OpenShiftManagedDefault - - name: nodeDNSIP +- name: com.github.openshift.api.config.v1.NutanixPrismElementEndpoint + map: + fields: + - name: endpoint + type: + namedType: com.github.openshift.api.config.v1.NutanixPrismEndpoint + default: {} + - name: name type: scalar: string -- name: com.github.openshift.api.config.v1.PKICertificateSubject + default: "" +- name: com.github.openshift.api.config.v1.NutanixPrismEndpoint map: fields: - - name: email + - name: address type: scalar: string - - name: hostname + default: "" + - name: port type: - scalar: string -- name: com.github.openshift.api.config.v1.PersistentVolumeClaimReference + scalar: numeric + default: 0 +- name: com.github.openshift.api.config.v1.NutanixResourceIdentifier map: fields: - name: name type: scalar: string -- name: com.github.openshift.api.config.v1.PersistentVolumeConfig - map: - fields: - - name: claim + - name: type type: - namedType: com.github.openshift.api.config.v1.PersistentVolumeClaimReference - default: {} - - name: mountPath + scalar: string + default: "" + - name: uuid type: scalar: string -- name: com.github.openshift.api.config.v1.PlatformSpec + unions: + - discriminator: type + fields: + - fieldName: name + discriminatorValue: Name + - fieldName: uuid + discriminatorValue: UUID +- name: com.github.openshift.api.config.v1.OAuth map: fields: - - name: alibabaCloud + - name: apiVersion type: - namedType: com.github.openshift.api.config.v1.AlibabaCloudPlatformSpec - - name: aws + scalar: string + - name: kind type: - namedType: com.github.openshift.api.config.v1.AWSPlatformSpec - - name: azure + scalar: string + - name: metadata type: - namedType: com.github.openshift.api.config.v1.AzurePlatformSpec - - name: baremetal + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - namedType: com.github.openshift.api.config.v1.BareMetalPlatformSpec - - name: equinixMetal + namedType: com.github.openshift.api.config.v1.OAuthSpec + default: {} + - name: status type: - namedType: com.github.openshift.api.config.v1.EquinixMetalPlatformSpec - - name: external + namedType: com.github.openshift.api.config.v1.OAuthStatus + default: {} +- name: com.github.openshift.api.config.v1.OAuthSpec + map: + fields: + - name: identityProviders type: - namedType: com.github.openshift.api.config.v1.ExternalPlatformSpec - - name: gcp + list: + elementType: + namedType: com.github.openshift.api.config.v1.IdentityProvider + elementRelationship: atomic + - name: templates type: - namedType: com.github.openshift.api.config.v1.GCPPlatformSpec - - name: ibmcloud + namedType: com.github.openshift.api.config.v1.OAuthTemplates + default: {} + - name: tokenConfig type: - namedType: com.github.openshift.api.config.v1.IBMCloudPlatformSpec - - name: kubevirt + namedType: com.github.openshift.api.config.v1.TokenConfig + default: {} +- name: com.github.openshift.api.config.v1.OAuthStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.OAuthTemplates + map: + fields: + - name: error type: - namedType: com.github.openshift.api.config.v1.KubevirtPlatformSpec - - name: nutanix + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: login type: - namedType: com.github.openshift.api.config.v1.NutanixPlatformSpec - - name: openstack + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: providerSelection type: - namedType: com.github.openshift.api.config.v1.OpenStackPlatformSpec - - name: ovirt + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} +- name: com.github.openshift.api.config.v1.OIDCClientConfig + map: + fields: + - name: clientID type: - namedType: com.github.openshift.api.config.v1.OvirtPlatformSpec - - name: powervs + scalar: string + default: "" + - name: clientSecret type: - namedType: com.github.openshift.api.config.v1.PowerVSPlatformSpec - - name: type + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: componentName type: scalar: string default: "" - - name: vsphere + - name: componentNamespace type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformSpec -- name: com.github.openshift.api.config.v1.PlatformStatus + scalar: string + default: "" + - name: extraScopes + type: + list: + elementType: + scalar: string + elementRelationship: associative +- name: com.github.openshift.api.config.v1.OIDCClientReference map: fields: - - name: alibabaCloud - type: - namedType: com.github.openshift.api.config.v1.AlibabaCloudPlatformStatus - - name: aws - type: - namedType: com.github.openshift.api.config.v1.AWSPlatformStatus - - name: azure + - name: clientID type: - namedType: com.github.openshift.api.config.v1.AzurePlatformStatus - - name: baremetal + scalar: string + default: "" + - name: issuerURL type: - namedType: com.github.openshift.api.config.v1.BareMetalPlatformStatus - - name: equinixMetal + scalar: string + default: "" + - name: oidcProviderName type: - namedType: com.github.openshift.api.config.v1.EquinixMetalPlatformStatus - - name: external + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.OIDCClientStatus + map: + fields: + - name: componentName type: - namedType: com.github.openshift.api.config.v1.ExternalPlatformStatus - - name: gcp + scalar: string + default: "" + - name: componentNamespace type: - namedType: com.github.openshift.api.config.v1.GCPPlatformStatus - - name: ibmcloud + scalar: string + default: "" + - name: conditions type: - namedType: com.github.openshift.api.config.v1.IBMCloudPlatformStatus - - name: kubevirt + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type + - name: consumingUsers type: - namedType: com.github.openshift.api.config.v1.KubevirtPlatformStatus - - name: nutanix + list: + elementType: + scalar: string + elementRelationship: associative + - name: currentOIDCClients type: - namedType: com.github.openshift.api.config.v1.NutanixPlatformStatus - - name: openstack + list: + elementType: + namedType: com.github.openshift.api.config.v1.OIDCClientReference + elementRelationship: associative + keys: + - issuerURL + - clientID +- name: com.github.openshift.api.config.v1.OIDCProvider + map: + fields: + - name: claimMappings type: - namedType: com.github.openshift.api.config.v1.OpenStackPlatformStatus - - name: ovirt + namedType: com.github.openshift.api.config.v1.TokenClaimMappings + default: {} + - name: claimValidationRules type: - namedType: com.github.openshift.api.config.v1.OvirtPlatformStatus - - name: powervs + list: + elementType: + namedType: com.github.openshift.api.config.v1.TokenClaimValidationRule + elementRelationship: atomic + - name: issuer type: - namedType: com.github.openshift.api.config.v1.PowerVSPlatformStatus - - name: type + namedType: com.github.openshift.api.config.v1.TokenIssuer + default: {} + - name: name type: scalar: string default: "" - - name: vsphere + - name: oidcClients type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformStatus -- name: com.github.openshift.api.config.v1.PolicyFulcioSubject + list: + elementType: + namedType: com.github.openshift.api.config.v1.OIDCClientConfig + elementRelationship: associative + keys: + - componentNamespace + - componentName + - name: userValidationRules + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.TokenUserValidationRule + elementRelationship: associative + keys: + - expression +- name: com.github.openshift.api.config.v1.ObjectReference map: fields: - - name: oidcIssuer + - name: group type: scalar: string default: "" - - name: signedEmail + - name: name type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.PolicyIdentity - map: - fields: - - name: exactRepository + - name: namespace type: - namedType: com.github.openshift.api.config.v1.PolicyMatchExactRepository - - name: matchPolicy + scalar: string + - name: resource type: scalar: string default: "" - - name: remapIdentity - type: - namedType: com.github.openshift.api.config.v1.PolicyMatchRemapIdentity - unions: - - discriminator: matchPolicy - fields: - - fieldName: exactRepository - discriminatorValue: PolicyMatchExactRepository - - fieldName: remapIdentity - discriminatorValue: PolicyMatchRemapIdentity -- name: com.github.openshift.api.config.v1.PolicyMatchExactRepository +- name: com.github.openshift.api.config.v1.OldTLSProfile + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.OpenIDClaims map: fields: - - name: repository + - name: email type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.PolicyMatchRemapIdentity + list: + elementType: + scalar: string + elementRelationship: atomic + - name: groups + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: name + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: preferredUsername + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.OpenIDIdentityProvider map: fields: - - name: prefix + - name: ca type: - scalar: string - default: "" - - name: signedPrefix + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} + - name: claims + type: + namedType: com.github.openshift.api.config.v1.OpenIDClaims + default: {} + - name: clientID type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.PolicyRootOfTrust - map: - fields: - - name: fulcioCAWithRekor + - name: clientSecret type: - namedType: com.github.openshift.api.config.v1.ImagePolicyFulcioCAWithRekorRootOfTrust - - name: pki + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} + - name: extraAuthorizeParameters type: - namedType: com.github.openshift.api.config.v1.ImagePolicyPKIRootOfTrust - - name: policyType + map: + elementType: + scalar: string + - name: extraScopes + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: issuer type: scalar: string default: "" - - name: publicKey +- name: com.github.openshift.api.config.v1.OpenStackPlatformLoadBalancer + map: + fields: + - name: type type: - namedType: com.github.openshift.api.config.v1.ImagePolicyPublicKeyRootOfTrust + scalar: string + default: OpenShiftManagedDefault unions: - - discriminator: policyType - fields: - - fieldName: fulcioCAWithRekor - discriminatorValue: FulcioCAWithRekor - - fieldName: pki - discriminatorValue: PKI - - fieldName: publicKey - discriminatorValue: PublicKey -- name: com.github.openshift.api.config.v1.PowerVSPlatformSpec + - discriminator: type +- name: com.github.openshift.api.config.v1.OpenStackPlatformSpec map: fields: - - name: serviceEndpoints + - name: apiServerInternalIPs type: list: elementType: - namedType: com.github.openshift.api.config.v1.PowerVSServiceEndpoint - elementRelationship: associative - keys: - - name -- name: com.github.openshift.api.config.v1.PowerVSPlatformStatus + scalar: string + elementRelationship: atomic + - name: ingressIPs + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: machineNetworks + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.OpenStackPlatformStatus map: fields: - - name: cisInstanceCRN + - name: apiServerInternalIP type: scalar: string - - name: dnsInstanceCRN + - name: apiServerInternalIPs + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: cloudName type: scalar: string - - name: region + - name: dnsRecordsType type: scalar: string - default: "" - - name: resourceGroup + - name: ingressIP type: scalar: string - default: "" - - name: serviceEndpoints + - name: ingressIPs type: list: elementType: - namedType: com.github.openshift.api.config.v1.PowerVSServiceEndpoint - elementRelationship: associative - keys: - - name - - name: zone + scalar: string + elementRelationship: atomic + - name: loadBalancer + type: + namedType: com.github.openshift.api.config.v1.OpenStackPlatformLoadBalancer + default: + type: OpenShiftManagedDefault + - name: machineNetworks + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: nodeDNSIP type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.PowerVSServiceEndpoint +- name: com.github.openshift.api.config.v1.OperandVersion map: fields: - name: name type: scalar: string default: "" - - name: url + - name: version type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.PrefixedClaimMapping +- name: com.github.openshift.api.config.v1.OperatorHub map: fields: - - name: claim + - name: apiVersion type: scalar: string - default: "" - - name: expression + - name: kind type: scalar: string - - name: prefix + - name: metadata type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.ProfileCustomizations - map: - fields: - - name: dynamicResourceAllocation + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.Project + namedType: com.github.openshift.api.config.v1.OperatorHubSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.config.v1.OperatorHubStatus + default: {} +- name: com.github.openshift.api.config.v1.OperatorHubSpec map: fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata + - name: disableAllDefaultSources type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + scalar: boolean + - name: sources type: - namedType: com.github.openshift.api.config.v1.ProjectSpec - default: {} - - name: status + list: + elementType: + namedType: com.github.openshift.api.config.v1.HubSource + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.OperatorHubStatus + map: + fields: + - name: sources type: - namedType: com.github.openshift.api.config.v1.ProjectStatus - default: {} -- name: com.github.openshift.api.config.v1.ProjectSpec + list: + elementType: + namedType: com.github.openshift.api.config.v1.HubSourceStatus + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.OvirtPlatformLoadBalancer map: fields: - - name: projectRequestMessage + - name: type type: scalar: string - default: "" - - name: projectRequestTemplate - type: - namedType: com.github.openshift.api.config.v1.TemplateReference - default: {} -- name: com.github.openshift.api.config.v1.ProjectStatus + default: OpenShiftManagedDefault + unions: + - discriminator: type +- name: com.github.openshift.api.config.v1.OvirtPlatformSpec map: elementType: scalar: untyped @@ -3368,824 +3589,557 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.PromQLClusterCondition - map: - fields: - - name: promql - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.Proxy +- name: com.github.openshift.api.config.v1.OvirtPlatformStatus map: fields: - - name: apiVersion - type: - scalar: string - - name: kind + - name: apiServerInternalIP type: scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1.ProxySpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.config.v1.ProxyStatus - default: {} -- name: com.github.openshift.api.config.v1.ProxySpec - map: - fields: - - name: httpProxy + - name: apiServerInternalIPs type: - scalar: string - - name: httpsProxy + list: + elementType: + scalar: string + elementRelationship: associative + - name: dnsRecordsType type: scalar: string - - name: noProxy + - name: ingressIP type: scalar: string - - name: readinessEndpoints + - name: ingressIPs type: list: elementType: scalar: string - elementRelationship: atomic - - name: trustedCA + elementRelationship: associative + - name: loadBalancer type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} -- name: com.github.openshift.api.config.v1.ProxyStatus + namedType: com.github.openshift.api.config.v1.OvirtPlatformLoadBalancer + default: + type: OpenShiftManagedDefault + - name: nodeDNSIP + type: + scalar: string +- name: com.github.openshift.api.config.v1.PKICertificateSubject map: fields: - - name: httpProxy + - name: email type: scalar: string - - name: httpsProxy + - name: hostname type: scalar: string - - name: noProxy +- name: com.github.openshift.api.config.v1.PersistentVolumeClaimReference + map: + fields: + - name: name type: scalar: string -- name: com.github.openshift.api.config.v1.RegistryLocation +- name: com.github.openshift.api.config.v1.PersistentVolumeConfig map: fields: - - name: domainName + - name: claim type: - scalar: string - default: "" - - name: insecure + namedType: com.github.openshift.api.config.v1.PersistentVolumeClaimReference + default: {} + - name: mountPath type: - scalar: boolean -- name: com.github.openshift.api.config.v1.RegistrySources + scalar: string +- name: com.github.openshift.api.config.v1.PlatformSpec map: fields: - - name: allowedRegistries + - name: alibabaCloud type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: blockedRegistries + namedType: com.github.openshift.api.config.v1.AlibabaCloudPlatformSpec + - name: aws type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: containerRuntimeSearchRegistries + namedType: com.github.openshift.api.config.v1.AWSPlatformSpec + - name: azure type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: insecureRegistries + namedType: com.github.openshift.api.config.v1.AzurePlatformSpec + - name: baremetal type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.Release - map: - fields: - - name: architecture + namedType: com.github.openshift.api.config.v1.BareMetalPlatformSpec + - name: equinixMetal type: - scalar: string - - name: channels + namedType: com.github.openshift.api.config.v1.EquinixMetalPlatformSpec + - name: external type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: image + namedType: com.github.openshift.api.config.v1.ExternalPlatformSpec + - name: gcp type: - scalar: string - default: "" - - name: url + namedType: com.github.openshift.api.config.v1.GCPPlatformSpec + - name: ibmcloud type: - scalar: string - - name: version + namedType: com.github.openshift.api.config.v1.IBMCloudPlatformSpec + - name: kubevirt type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.RepositoryDigestMirrors - map: - fields: - - name: allowMirrorByTags + namedType: com.github.openshift.api.config.v1.KubevirtPlatformSpec + - name: nutanix type: - scalar: boolean - - name: mirrors + namedType: com.github.openshift.api.config.v1.NutanixPlatformSpec + - name: openstack type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: source + namedType: com.github.openshift.api.config.v1.OpenStackPlatformSpec + - name: ovirt + type: + namedType: com.github.openshift.api.config.v1.OvirtPlatformSpec + - name: powervs + type: + namedType: com.github.openshift.api.config.v1.PowerVSPlatformSpec + - name: type type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.RequestHeaderIdentityProvider + - name: vsphere + type: + namedType: com.github.openshift.api.config.v1.VSpherePlatformSpec +- name: com.github.openshift.api.config.v1.PlatformStatus map: fields: - - name: ca + - name: alibabaCloud type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: challengeURL + namedType: com.github.openshift.api.config.v1.AlibabaCloudPlatformStatus + - name: aws type: - scalar: string - default: "" - - name: clientCommonNames + namedType: com.github.openshift.api.config.v1.AWSPlatformStatus + - name: azure type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: emailHeaders + namedType: com.github.openshift.api.config.v1.AzurePlatformStatus + - name: baremetal type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: headers + namedType: com.github.openshift.api.config.v1.BareMetalPlatformStatus + - name: equinixMetal type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: loginURL + namedType: com.github.openshift.api.config.v1.EquinixMetalPlatformStatus + - name: external type: - scalar: string - default: "" - - name: nameHeaders + namedType: com.github.openshift.api.config.v1.ExternalPlatformStatus + - name: gcp type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: preferredUsernameHeaders + namedType: com.github.openshift.api.config.v1.GCPPlatformStatus + - name: ibmcloud type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.RequiredHSTSPolicy - map: - fields: - - name: domainPatterns + namedType: com.github.openshift.api.config.v1.IBMCloudPlatformStatus + - name: kubevirt type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: includeSubDomainsPolicy + namedType: com.github.openshift.api.config.v1.KubevirtPlatformStatus + - name: nutanix type: - scalar: string - - name: maxAge + namedType: com.github.openshift.api.config.v1.NutanixPlatformStatus + - name: openstack type: - namedType: com.github.openshift.api.config.v1.MaxAgePolicy - default: {} - - name: namespaceSelector + namedType: com.github.openshift.api.config.v1.OpenStackPlatformStatus + - name: ovirt type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector - - name: preloadPolicy + namedType: com.github.openshift.api.config.v1.OvirtPlatformStatus + - name: powervs + type: + namedType: com.github.openshift.api.config.v1.PowerVSPlatformStatus + - name: type type: scalar: string -- name: com.github.openshift.api.config.v1.Scheduler + default: "" + - name: vsphere + type: + namedType: com.github.openshift.api.config.v1.VSpherePlatformStatus +- name: com.github.openshift.api.config.v1.PolicyFulcioSubject map: fields: - - name: apiVersion + - name: oidcIssuer type: scalar: string - - name: kind + default: "" + - name: signedEmail type: scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1.SchedulerSpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.config.v1.SchedulerStatus - default: {} -- name: com.github.openshift.api.config.v1.SchedulerSpec + default: "" +- name: com.github.openshift.api.config.v1.PolicyIdentity map: fields: - - name: defaultNodeSelector - type: - scalar: string - - name: mastersSchedulable - type: - scalar: boolean - default: false - - name: policy + - name: exactRepository type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: profile + namedType: com.github.openshift.api.config.v1.PolicyMatchExactRepository + - name: matchPolicy type: scalar: string - - name: profileCustomizations + default: "" + - name: remapIdentity type: - namedType: com.github.openshift.api.config.v1.ProfileCustomizations - default: {} -- name: com.github.openshift.api.config.v1.SchedulerStatus - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.SecretNameReference + namedType: com.github.openshift.api.config.v1.PolicyMatchRemapIdentity + unions: + - discriminator: matchPolicy + fields: + - fieldName: exactRepository + discriminatorValue: PolicyMatchExactRepository + - fieldName: remapIdentity + discriminatorValue: PolicyMatchRemapIdentity +- name: com.github.openshift.api.config.v1.PolicyMatchExactRepository map: fields: - - name: name + - name: repository type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.SignatureStore +- name: com.github.openshift.api.config.v1.PolicyMatchRemapIdentity map: fields: - - name: ca + - name: prefix type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference - default: {} - - name: url + scalar: string + default: "" + - name: signedPrefix type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.Storage +- name: com.github.openshift.api.config.v1.PolicyRootOfTrust map: fields: - - name: persistentVolume + - name: fulcioCAWithRekor type: - namedType: com.github.openshift.api.config.v1.PersistentVolumeConfig - default: {} - - name: type + namedType: com.github.openshift.api.config.v1.ImagePolicyFulcioCAWithRekorRootOfTrust + - name: pki + type: + namedType: com.github.openshift.api.config.v1.ImagePolicyPKIRootOfTrust + - name: policyType type: scalar: string + default: "" + - name: publicKey + type: + namedType: com.github.openshift.api.config.v1.ImagePolicyPublicKeyRootOfTrust unions: - - discriminator: type + - discriminator: policyType fields: - - fieldName: persistentVolume - discriminatorValue: PersistentVolume -- name: com.github.openshift.api.config.v1.TLSSecurityProfile + - fieldName: fulcioCAWithRekor + discriminatorValue: FulcioCAWithRekor + - fieldName: pki + discriminatorValue: PKI + - fieldName: publicKey + discriminatorValue: PublicKey +- name: com.github.openshift.api.config.v1.PowerVSPlatformSpec map: fields: - - name: custom - type: - namedType: com.github.openshift.api.config.v1.CustomTLSProfile - - name: intermediate + - name: serviceEndpoints type: - namedType: com.github.openshift.api.config.v1.IntermediateTLSProfile - - name: modern + list: + elementType: + namedType: com.github.openshift.api.config.v1.PowerVSServiceEndpoint + elementRelationship: associative + keys: + - name +- name: com.github.openshift.api.config.v1.PowerVSPlatformStatus + map: + fields: + - name: cisInstanceCRN type: - namedType: com.github.openshift.api.config.v1.ModernTLSProfile - - name: old + scalar: string + - name: dnsInstanceCRN type: - namedType: com.github.openshift.api.config.v1.OldTLSProfile - - name: type + scalar: string + - name: region type: scalar: string default: "" - unions: - - discriminator: type - fields: - - fieldName: custom - discriminatorValue: Custom - - fieldName: intermediate - discriminatorValue: Intermediate - - fieldName: modern - discriminatorValue: Modern - - fieldName: old - discriminatorValue: Old -- name: com.github.openshift.api.config.v1.TemplateReference - map: - fields: - - name: name + - name: resourceGroup type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.TokenClaimMappings - map: - fields: - - name: extra + - name: serviceEndpoints type: list: elementType: - namedType: com.github.openshift.api.config.v1.ExtraMapping + namedType: com.github.openshift.api.config.v1.PowerVSServiceEndpoint elementRelationship: associative keys: - - key - - name: groups - type: - namedType: com.github.openshift.api.config.v1.PrefixedClaimMapping - default: {} - - name: uid - type: - namedType: com.github.openshift.api.config.v1.TokenClaimOrExpressionMapping - - name: username + - name + - name: zone type: - namedType: com.github.openshift.api.config.v1.UsernameClaimMapping - default: {} -- name: com.github.openshift.api.config.v1.TokenClaimOrExpressionMapping + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.PowerVSServiceEndpoint map: fields: - - name: claim + - name: name type: scalar: string - - name: expression + default: "" + - name: url type: scalar: string -- name: com.github.openshift.api.config.v1.TokenClaimValidationCELRule + default: "" +- name: com.github.openshift.api.config.v1.PrefixedClaimMapping map: fields: + - name: claim + type: + scalar: string + default: "" - name: expression type: scalar: string - - name: message + - name: prefix type: scalar: string -- name: com.github.openshift.api.config.v1.TokenClaimValidationRule + default: "" +- name: com.github.openshift.api.config.v1.ProfileCustomizations map: fields: - - name: cel - type: - namedType: com.github.openshift.api.config.v1.TokenClaimValidationCELRule - default: {} - - name: requiredClaim - type: - namedType: com.github.openshift.api.config.v1.TokenRequiredClaim - - name: type + - name: dynamicResourceAllocation type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.TokenConfig +- name: com.github.openshift.api.config.v1.Project map: fields: - - name: accessTokenInactivityTimeout + - name: apiVersion type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration - - name: accessTokenInactivityTimeoutSeconds + scalar: string + - name: kind type: - scalar: numeric - - name: accessTokenMaxAgeSeconds + scalar: string + - name: metadata type: - scalar: numeric -- name: com.github.openshift.api.config.v1.TokenIssuer + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1.ProjectSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.config.v1.ProjectStatus + default: {} +- name: com.github.openshift.api.config.v1.ProjectSpec map: fields: - - name: audiences - type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: discoveryURL + - name: projectRequestMessage type: scalar: string - - name: issuerCertificateAuthority + default: "" + - name: projectRequestTemplate type: - namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + namedType: com.github.openshift.api.config.v1.TemplateReference default: {} - - name: issuerURL - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.TokenRequiredClaim +- name: com.github.openshift.api.config.v1.ProjectStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.PromQLClusterCondition map: fields: - - name: claim - type: - scalar: string - default: "" - - name: requiredValue + - name: promql type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.TokenUserValidationRule +- name: com.github.openshift.api.config.v1.Proxy map: fields: - - name: expression - type: - scalar: string - - name: message + - name: apiVersion type: scalar: string -- name: com.github.openshift.api.config.v1.Update - map: - fields: - - name: acceptRisks - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.AcceptRisk - elementRelationship: associative - keys: - - name - - name: architecture + - name: kind type: scalar: string - default: "" - - name: force + - name: metadata type: - scalar: boolean - default: false - - name: image + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - scalar: string - default: "" - - name: version + namedType: com.github.openshift.api.config.v1.ProxySpec + default: {} + - name: status type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.UpdateHistory + namedType: com.github.openshift.api.config.v1.ProxyStatus + default: {} +- name: com.github.openshift.api.config.v1.ProxySpec map: fields: - - name: acceptedRisks + - name: httpProxy type: scalar: string - - name: completionTime - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: image + - name: httpsProxy type: scalar: string - default: "" - - name: startedTime - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: state + - name: noProxy type: scalar: string - default: "" - - name: verified + - name: readinessEndpoints type: - scalar: boolean - default: false - - name: version + list: + elementType: + scalar: string + elementRelationship: atomic + - name: trustedCA type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.UsernameClaimMapping + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference + default: {} +- name: com.github.openshift.api.config.v1.ProxyStatus map: fields: - - name: claim + - name: httpProxy type: scalar: string - - name: expression + - name: httpsProxy type: scalar: string - - name: prefix - type: - namedType: com.github.openshift.api.config.v1.UsernamePrefix - - name: prefixPolicy + - name: noProxy type: scalar: string - default: "" - unions: - - discriminator: prefixPolicy - fields: - - fieldName: claim - discriminatorValue: Claim - - fieldName: expression - discriminatorValue: Expression - - fieldName: prefix - discriminatorValue: Prefix -- name: com.github.openshift.api.config.v1.UsernamePrefix +- name: com.github.openshift.api.config.v1.RegistryLocation map: fields: - - name: prefixString + - name: domainName type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.VSphereFailureDomainHostGroup + - name: insecure + type: + scalar: boolean +- name: com.github.openshift.api.config.v1.RegistrySources map: fields: - - name: hostGroup + - name: allowedRegistries type: - scalar: string - default: "" - - name: vmGroup + list: + elementType: + scalar: string + elementRelationship: atomic + - name: blockedRegistries type: - scalar: string - default: "" - - name: vmHostRule + list: + elementType: + scalar: string + elementRelationship: atomic + - name: containerRuntimeSearchRegistries type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.VSphereFailureDomainRegionAffinity - map: - fields: - - name: type + list: + elementType: + scalar: string + elementRelationship: associative + - name: insecureRegistries type: - scalar: string - default: "" - unions: - - discriminator: type -- name: com.github.openshift.api.config.v1.VSphereFailureDomainZoneAffinity + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.Release map: fields: - - name: hostGroup - type: - namedType: com.github.openshift.api.config.v1.VSphereFailureDomainHostGroup - - name: type + - name: architecture type: scalar: string - default: "" - unions: - - discriminator: type - fields: - - fieldName: hostGroup - discriminatorValue: HostGroup -- name: com.github.openshift.api.config.v1.VSpherePlatformFailureDomainSpec - map: - fields: - - name: name + - name: channels type: - scalar: string - default: "" - - name: region + list: + elementType: + scalar: string + elementRelationship: associative + - name: image type: scalar: string default: "" - - name: regionAffinity - type: - namedType: com.github.openshift.api.config.v1.VSphereFailureDomainRegionAffinity - - name: server + - name: url type: scalar: string - default: "" - - name: topology - type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformTopology - default: {} - - name: zone + - name: version type: scalar: string default: "" - - name: zoneAffinity - type: - namedType: com.github.openshift.api.config.v1.VSphereFailureDomainZoneAffinity -- name: com.github.openshift.api.config.v1.VSpherePlatformLoadBalancer +- name: com.github.openshift.api.config.v1.RepositoryDigestMirrors map: fields: - - name: type + - name: allowMirrorByTags + type: + scalar: boolean + - name: mirrors + type: + list: + elementType: + scalar: string + elementRelationship: associative + - name: source type: scalar: string - default: OpenShiftManagedDefault - unions: - - discriminator: type -- name: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworking + default: "" +- name: com.github.openshift.api.config.v1.RequestHeaderIdentityProvider map: fields: - - name: external + - name: ca type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworkingSpec + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} - - name: internal + - name: challengeURL type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworkingSpec - default: {} -- name: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworkingSpec - map: - fields: - - name: excludeNetworkSubnetCidr + scalar: string + default: "" + - name: clientCommonNames type: list: elementType: scalar: string elementRelationship: atomic - - name: network - type: - scalar: string - - name: networkSubnetCidr + - name: emailHeaders type: list: elementType: scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1.VSpherePlatformSpec - map: - fields: - - name: apiServerInternalIPs + elementRelationship: atomic + - name: headers type: list: elementType: scalar: string elementRelationship: atomic - - name: failureDomains - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.VSpherePlatformFailureDomainSpec - elementRelationship: associative - keys: - - name - - name: ingressIPs - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: machineNetworks - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: nodeNetworking - type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworking - default: {} - - name: vcenters - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1.VSpherePlatformVCenterSpec - elementRelationship: atomic -- name: com.github.openshift.api.config.v1.VSpherePlatformStatus - map: - fields: - - name: apiServerInternalIP - type: - scalar: string - - name: apiServerInternalIPs - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: dnsRecordsType - type: - scalar: string - - name: ingressIP + - name: loginURL type: scalar: string - - name: ingressIPs + default: "" + - name: nameHeaders type: list: elementType: scalar: string elementRelationship: atomic - - name: loadBalancer - type: - namedType: com.github.openshift.api.config.v1.VSpherePlatformLoadBalancer - default: - type: OpenShiftManagedDefault - - name: machineNetworks + - name: preferredUsernameHeaders type: list: elementType: scalar: string elementRelationship: atomic - - name: nodeDNSIP - type: - scalar: string -- name: com.github.openshift.api.config.v1.VSpherePlatformTopology +- name: com.github.openshift.api.config.v1.RequiredHSTSPolicy map: fields: - - name: computeCluster - type: - scalar: string - default: "" - - name: datacenter - type: - scalar: string - default: "" - - name: datastore - type: - scalar: string - default: "" - - name: folder - type: - scalar: string - - name: networks + - name: domainPatterns type: list: elementType: scalar: string elementRelationship: atomic - - name: resourcePool - type: - scalar: string - - name: template - type: - scalar: string -- name: com.github.openshift.api.config.v1.VSpherePlatformVCenterSpec - map: - fields: - - name: datacenters - type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: port - type: - scalar: numeric - - name: server + - name: includeSubDomainsPolicy type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1.WebhookTokenAuthenticator - map: - fields: - - name: kubeConfig - type: - namedType: com.github.openshift.api.config.v1.SecretNameReference - default: {} -- name: com.github.openshift.api.config.v1alpha1.AlertmanagerConfig - map: - fields: - - name: customConfig + - name: maxAge type: - namedType: com.github.openshift.api.config.v1alpha1.AlertmanagerCustomConfig + namedType: com.github.openshift.api.config.v1.MaxAgePolicy default: {} - - name: deploymentMode - type: - scalar: string -- name: com.github.openshift.api.config.v1alpha1.AlertmanagerCustomConfig - map: - fields: - - name: logLevel - type: - scalar: string - - name: nodeSelector - type: - map: - elementType: - scalar: string - - name: resources - type: - list: - elementType: - namedType: com.github.openshift.api.config.v1alpha1.ContainerResource - elementRelationship: associative - keys: - - name - - name: secrets - type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: tolerations - type: - list: - elementType: - namedType: io.k8s.api.core.v1.Toleration - elementRelationship: atomic - - name: topologySpreadConstraints - type: - list: - elementType: - namedType: io.k8s.api.core.v1.TopologySpreadConstraint - elementRelationship: associative - keys: - - topologyKey - - whenUnsatisfiable - - name: volumeClaimTemplate + - name: namespaceSelector type: - namedType: io.k8s.api.core.v1.PersistentVolumeClaim -- name: com.github.openshift.api.config.v1alpha1.Audit - map: - fields: - - name: profile + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io + - name: preloadPolicy type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.Backup +- name: com.github.openshift.api.config.v1.Scheduler map: fields: - name: apiVersion @@ -4196,24 +4150,38 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1alpha1.BackupSpec + namedType: com.github.openshift.api.config.v1.SchedulerSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1alpha1.BackupStatus + namedType: com.github.openshift.api.config.v1.SchedulerStatus default: {} -- name: com.github.openshift.api.config.v1alpha1.BackupSpec +- name: com.github.openshift.api.config.v1.SchedulerSpec map: fields: - - name: etcd + - name: defaultNodeSelector type: - namedType: com.github.openshift.api.config.v1alpha1.EtcdBackupSpec + scalar: string + - name: mastersSchedulable + type: + scalar: boolean + default: false + - name: policy + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} -- name: com.github.openshift.api.config.v1alpha1.BackupStatus + - name: profile + type: + scalar: string + - name: profileCustomizations + type: + namedType: com.github.openshift.api.config.v1.ProfileCustomizations + default: {} +- name: com.github.openshift.api.config.v1.SchedulerStatus map: elementType: scalar: untyped @@ -4225,69 +4193,30 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfig +- name: com.github.openshift.api.config.v1.SecretNameReference map: fields: - - name: apiVersion - type: - scalar: string - - name: kind + - name: name type: scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec - - name: status - type: - namedType: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus - default: {} -- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec - map: - fields: - - name: matchImages - type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus - map: - fields: - - name: conditions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type -- name: com.github.openshift.api.config.v1alpha1.CategoryOverride + default: "" +- name: com.github.openshift.api.config.v1.SignatureStore map: fields: - - name: certificate + - name: ca type: - namedType: com.github.openshift.api.config.v1alpha1.CertificateConfig + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} - - name: name + - name: url type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.CertificateConfig - map: - fields: - - name: key - type: - namedType: com.github.openshift.api.config.v1alpha1.KeyConfig - default: {} -- name: com.github.openshift.api.config.v1alpha1.CertificateOverride + default: "" +- name: com.github.openshift.api.config.v1.Storage map: fields: - - name: category + - name: persistentVolume type: - namedType: com.github.openshift.api.config.v1alpha1.CategoryOverride + namedType: com.github.openshift.api.config.v1.PersistentVolumeConfig default: {} - name: type type: @@ -4295,507 +4224,517 @@ var schemaYAML = typed.YAMLObject(`types: unions: - discriminator: type fields: - - fieldName: category - discriminatorValue: Category -- name: com.github.openshift.api.config.v1alpha1.ClusterImagePolicy + - fieldName: persistentVolume + discriminatorValue: PersistentVolume +- name: com.github.openshift.api.config.v1.TLSSecurityProfile map: fields: - - name: apiVersion - type: - scalar: string - - name: kind + - name: custom type: - scalar: string - - name: metadata + namedType: com.github.openshift.api.config.v1.CustomTLSProfile + - name: intermediate type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + namedType: com.github.openshift.api.config.v1.IntermediateTLSProfile + - name: modern type: - namedType: com.github.openshift.api.config.v1alpha1.ClusterImagePolicySpec - default: {} - - name: status + namedType: com.github.openshift.api.config.v1.ModernTLSProfile + - name: old type: - namedType: com.github.openshift.api.config.v1alpha1.ClusterImagePolicyStatus - default: {} -- name: com.github.openshift.api.config.v1alpha1.ClusterImagePolicySpec + namedType: com.github.openshift.api.config.v1.OldTLSProfile + - name: type + type: + scalar: string + default: "" + unions: + - discriminator: type + fields: + - fieldName: custom + discriminatorValue: Custom + - fieldName: intermediate + discriminatorValue: Intermediate + - fieldName: modern + discriminatorValue: Modern + - fieldName: old + discriminatorValue: Old +- name: com.github.openshift.api.config.v1.TemplateReference map: fields: - - name: policy - type: - namedType: com.github.openshift.api.config.v1alpha1.ImageSigstoreVerificationPolicy - default: {} - - name: scopes + - name: name type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1alpha1.ClusterImagePolicyStatus + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.TokenClaimMappings map: fields: - - name: conditions + - name: extra type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + namedType: com.github.openshift.api.config.v1.ExtraMapping elementRelationship: associative keys: - - type -- name: com.github.openshift.api.config.v1alpha1.ClusterMonitoring + - key + - name: groups + type: + namedType: com.github.openshift.api.config.v1.PrefixedClaimMapping + default: {} + - name: uid + type: + namedType: com.github.openshift.api.config.v1.TokenClaimOrExpressionMapping + - name: username + type: + namedType: com.github.openshift.api.config.v1.UsernameClaimMapping + default: {} +- name: com.github.openshift.api.config.v1.TokenClaimOrExpressionMapping map: fields: - - name: apiVersion + - name: claim type: scalar: string - - name: kind + - name: expression type: scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec +- name: com.github.openshift.api.config.v1.TokenClaimValidationCELRule + map: + fields: + - name: expression type: - namedType: com.github.openshift.api.config.v1alpha1.ClusterMonitoringSpec - default: {} - - name: status + scalar: string + - name: message type: - namedType: com.github.openshift.api.config.v1alpha1.ClusterMonitoringStatus - default: {} -- name: com.github.openshift.api.config.v1alpha1.ClusterMonitoringSpec + scalar: string +- name: com.github.openshift.api.config.v1.TokenClaimValidationRule map: fields: - - name: alertmanagerConfig - type: - namedType: com.github.openshift.api.config.v1alpha1.AlertmanagerConfig - default: {} - - name: metricsServerConfig + - name: cel type: - namedType: com.github.openshift.api.config.v1alpha1.MetricsServerConfig + namedType: com.github.openshift.api.config.v1.TokenClaimValidationCELRule default: {} - - name: prometheusOperatorConfig + - name: requiredClaim type: - namedType: com.github.openshift.api.config.v1alpha1.PrometheusOperatorConfig - default: {} - - name: userDefined + namedType: com.github.openshift.api.config.v1.TokenRequiredClaim + - name: type type: - namedType: com.github.openshift.api.config.v1alpha1.UserDefinedMonitoring - default: {} -- name: com.github.openshift.api.config.v1alpha1.ClusterMonitoringStatus - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1alpha1.ContainerResource + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.TokenConfig map: fields: - - name: limit + - name: accessTokenInactivityTimeout type: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity - - name: name + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io + - name: accessTokenInactivityTimeoutSeconds type: - scalar: string - - name: request + scalar: numeric + - name: accessTokenMaxAgeSeconds type: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity -- name: com.github.openshift.api.config.v1alpha1.CustomPKIPolicy + scalar: numeric +- name: com.github.openshift.api.config.v1.TokenIssuer map: fields: - - name: defaults - type: - namedType: com.github.openshift.api.config.v1alpha1.DefaultCertificateConfig - default: {} - - name: overrides + - name: audiences type: list: elementType: - namedType: com.github.openshift.api.config.v1alpha1.CertificateOverride - elementRelationship: atomic -- name: com.github.openshift.api.config.v1alpha1.DefaultCertificateConfig - map: - fields: - - name: key + scalar: string + elementRelationship: associative + - name: discoveryURL type: - namedType: com.github.openshift.api.config.v1alpha1.KeyConfig + scalar: string + - name: issuerCertificateAuthority + type: + namedType: com.github.openshift.api.config.v1.ConfigMapNameReference default: {} -- name: com.github.openshift.api.config.v1alpha1.ECDSAKeyConfig - map: - fields: - - name: curve + - name: issuerURL type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.EtcdBackupSpec + default: "" +- name: com.github.openshift.api.config.v1.TokenRequiredClaim map: fields: - - name: pvcName - type: - scalar: string - default: "" - - name: retentionPolicy - type: - namedType: com.github.openshift.api.config.v1alpha1.RetentionPolicy - default: {} - - name: schedule + - name: claim type: scalar: string default: "" - - name: timeZone + - name: requiredValue type: scalar: string default: "" -- name: com.github.openshift.api.config.v1alpha1.GatherConfig +- name: com.github.openshift.api.config.v1.TokenUserValidationRule map: fields: - - name: dataPolicy + - name: expression type: scalar: string - - name: disabledGatherers - type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: storage + - name: message type: - namedType: com.github.openshift.api.config.v1alpha1.Storage -- name: com.github.openshift.api.config.v1alpha1.ImagePolicy + scalar: string +- name: com.github.openshift.api.config.v1.Update map: fields: - - name: apiVersion + - name: acceptRisks type: - scalar: string - - name: kind + list: + elementType: + namedType: com.github.openshift.api.config.v1.AcceptRisk + elementRelationship: associative + keys: + - name + - name: architecture type: scalar: string - - name: metadata + default: "" + - name: force type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + scalar: boolean + default: false + - name: image type: - namedType: com.github.openshift.api.config.v1alpha1.ImagePolicySpec - default: {} - - name: status + scalar: string + default: "" + - name: mode type: - namedType: com.github.openshift.api.config.v1alpha1.ImagePolicyStatus - default: {} -- name: com.github.openshift.api.config.v1alpha1.ImagePolicyFulcioCAWithRekorRootOfTrust + scalar: string + - name: version + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.UpdateHistory map: fields: - - name: fulcioCAData + - name: acceptedRisks type: scalar: string - - name: fulcioSubject + - name: completionTime type: - namedType: com.github.openshift.api.config.v1alpha1.PolicyFulcioSubject - default: {} - - name: rekorKeyData + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: image type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.ImagePolicyPKIRootOfTrust - map: - fields: - - name: caIntermediatesData + default: "" + - name: startedTime type: - scalar: string - - name: caRootsData + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: state type: scalar: string - - name: pkiCertificateSubject + default: "" + - name: verified type: - namedType: com.github.openshift.api.config.v1alpha1.PKICertificateSubject - default: {} -- name: com.github.openshift.api.config.v1alpha1.ImagePolicyPublicKeyRootOfTrust + scalar: boolean + default: false + - name: version + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.UsernameClaimMapping map: fields: - - name: keyData + - name: claim type: scalar: string - - name: rekorKeyData + - name: expression + type: + scalar: string + - name: prefix + type: + namedType: com.github.openshift.api.config.v1.UsernamePrefix + - name: prefixPolicy type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.ImagePolicySpec + default: "" + unions: + - discriminator: prefixPolicy + fields: + - fieldName: claim + discriminatorValue: Claim + - fieldName: expression + discriminatorValue: Expression + - fieldName: prefix + discriminatorValue: Prefix +- name: com.github.openshift.api.config.v1.UsernamePrefix map: fields: - - name: policy + - name: prefixString type: - namedType: com.github.openshift.api.config.v1alpha1.ImageSigstoreVerificationPolicy - default: {} - - name: scopes + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.VSphereFailureDomainHostGroup + map: + fields: + - name: hostGroup type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1alpha1.ImagePolicyStatus + scalar: string + default: "" + - name: vmGroup + type: + scalar: string + default: "" + - name: vmHostRule + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.VSphereFailureDomainRegionAffinity map: fields: - - name: conditions + - name: type type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type -- name: com.github.openshift.api.config.v1alpha1.ImageSigstoreVerificationPolicy + scalar: string + default: "" + unions: + - discriminator: type +- name: com.github.openshift.api.config.v1.VSphereFailureDomainZoneAffinity map: fields: - - name: rootOfTrust + - name: hostGroup type: - namedType: com.github.openshift.api.config.v1alpha1.PolicyRootOfTrust - default: {} - - name: signedIdentity + namedType: com.github.openshift.api.config.v1.VSphereFailureDomainHostGroup + - name: type type: - namedType: com.github.openshift.api.config.v1alpha1.PolicyIdentity - default: {} -- name: com.github.openshift.api.config.v1alpha1.InsightsDataGather + scalar: string + default: "" + unions: + - discriminator: type + fields: + - fieldName: hostGroup + discriminatorValue: HostGroup +- name: com.github.openshift.api.config.v1.VSpherePlatformFailureDomainSpec map: fields: - - name: apiVersion + - name: name type: scalar: string - - name: kind + default: "" + - name: region type: scalar: string - - name: metadata + default: "" + - name: regionAffinity type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec + namedType: com.github.openshift.api.config.v1.VSphereFailureDomainRegionAffinity + - name: server type: - namedType: com.github.openshift.api.config.v1alpha1.InsightsDataGatherSpec - default: {} - - name: status + scalar: string + default: "" + - name: topology type: - namedType: com.github.openshift.api.config.v1alpha1.InsightsDataGatherStatus + namedType: com.github.openshift.api.config.v1.VSpherePlatformTopology default: {} -- name: com.github.openshift.api.config.v1alpha1.InsightsDataGatherSpec - map: - fields: - - name: gatherConfig + - name: zone type: - namedType: com.github.openshift.api.config.v1alpha1.GatherConfig - default: {} -- name: com.github.openshift.api.config.v1alpha1.InsightsDataGatherStatus - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1alpha1.KeyConfig + scalar: string + default: "" + - name: zoneAffinity + type: + namedType: com.github.openshift.api.config.v1.VSphereFailureDomainZoneAffinity +- name: com.github.openshift.api.config.v1.VSpherePlatformLoadBalancer map: fields: - - name: algorithm + - name: type type: scalar: string - - name: ecdsa + default: OpenShiftManagedDefault + unions: + - discriminator: type +- name: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworking + map: + fields: + - name: external type: - namedType: com.github.openshift.api.config.v1alpha1.ECDSAKeyConfig + namedType: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworkingSpec default: {} - - name: rsa + - name: internal type: - namedType: com.github.openshift.api.config.v1alpha1.RSAKeyConfig + namedType: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworkingSpec default: {} - unions: - - discriminator: algorithm - fields: - - fieldName: ecdsa - discriminatorValue: ECDSA - - fieldName: rsa - discriminatorValue: RSA -- name: com.github.openshift.api.config.v1alpha1.MetricsServerConfig +- name: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworkingSpec map: fields: - - name: audit - type: - namedType: com.github.openshift.api.config.v1alpha1.Audit - default: {} - - name: nodeSelector + - name: excludeNetworkSubnetCidr type: - map: + list: elementType: scalar: string - - name: resources + elementRelationship: atomic + - name: network + type: + scalar: string + - name: networkSubnetCidr type: list: elementType: - namedType: com.github.openshift.api.config.v1alpha1.ContainerResource + scalar: string elementRelationship: associative - keys: - - name - - name: tolerations +- name: com.github.openshift.api.config.v1.VSpherePlatformSpec + map: + fields: + - name: apiServerInternalIPs type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + scalar: string elementRelationship: atomic - - name: topologySpreadConstraints + - name: failureDomains type: list: elementType: - namedType: io.k8s.api.core.v1.TopologySpreadConstraint + namedType: com.github.openshift.api.config.v1.VSpherePlatformFailureDomainSpec elementRelationship: associative keys: - - topologyKey - - whenUnsatisfiable - - name: verbosity - type: - scalar: string -- name: com.github.openshift.api.config.v1alpha1.PKI - map: - fields: - - name: apiVersion + - name + - name: ingressIPs type: - scalar: string - - name: kind + list: + elementType: + scalar: string + elementRelationship: atomic + - name: machineNetworks type: - scalar: string - - name: metadata + list: + elementType: + scalar: string + elementRelationship: atomic + - name: nodeNetworking type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: com.github.openshift.api.config.v1.VSpherePlatformNodeNetworking default: {} - - name: spec + - name: vcenters type: - namedType: com.github.openshift.api.config.v1alpha1.PKISpec - default: {} -- name: com.github.openshift.api.config.v1alpha1.PKICertificateManagement + list: + elementType: + namedType: com.github.openshift.api.config.v1.VSpherePlatformVCenterSpec + elementRelationship: atomic +- name: com.github.openshift.api.config.v1.VSpherePlatformStatus map: fields: - - name: custom - type: - namedType: com.github.openshift.api.config.v1alpha1.CustomPKIPolicy - default: {} - - name: mode + - name: apiServerInternalIP type: scalar: string - unions: - - discriminator: mode - fields: - - fieldName: custom - discriminatorValue: Custom -- name: com.github.openshift.api.config.v1alpha1.PKICertificateSubject - map: - fields: - - name: email + - name: apiServerInternalIPs + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: dnsRecordsType type: scalar: string - - name: hostname + - name: ingressIP type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.PKISpec - map: - fields: - - name: certificateManagement + - name: ingressIPs type: - namedType: com.github.openshift.api.config.v1alpha1.PKICertificateManagement - default: {} -- name: com.github.openshift.api.config.v1alpha1.PersistentVolumeClaimReference - map: - fields: - - name: name + list: + elementType: + scalar: string + elementRelationship: atomic + - name: loadBalancer type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1alpha1.PersistentVolumeConfig - map: - fields: - - name: claim + namedType: com.github.openshift.api.config.v1.VSpherePlatformLoadBalancer + default: + type: OpenShiftManagedDefault + - name: machineNetworks type: - namedType: com.github.openshift.api.config.v1alpha1.PersistentVolumeClaimReference - default: {} - - name: mountPath + list: + elementType: + scalar: string + elementRelationship: atomic + - name: nodeDNSIP type: scalar: string -- name: com.github.openshift.api.config.v1alpha1.PolicyFulcioSubject +- name: com.github.openshift.api.config.v1.VSpherePlatformTopology map: fields: - - name: oidcIssuer + - name: computeCluster type: scalar: string default: "" - - name: signedEmail + - name: datacenter type: scalar: string default: "" -- name: com.github.openshift.api.config.v1alpha1.PolicyIdentity - map: - fields: - - name: exactRepository - type: - namedType: com.github.openshift.api.config.v1alpha1.PolicyMatchExactRepository - - name: matchPolicy + - name: datastore type: scalar: string default: "" - - name: remapIdentity + - name: folder type: - namedType: com.github.openshift.api.config.v1alpha1.PolicyMatchRemapIdentity - unions: - - discriminator: matchPolicy - fields: - - fieldName: exactRepository - discriminatorValue: PolicyMatchExactRepository - - fieldName: remapIdentity - discriminatorValue: PolicyMatchRemapIdentity -- name: com.github.openshift.api.config.v1alpha1.PolicyMatchExactRepository + scalar: string + - name: networks + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: resourcePool + type: + scalar: string + - name: template + type: + scalar: string +- name: com.github.openshift.api.config.v1.VSpherePlatformVCenterSpec map: fields: - - name: repository + - name: datacenters + type: + list: + elementType: + scalar: string + elementRelationship: associative + - name: port + type: + scalar: numeric + - name: server type: scalar: string default: "" -- name: com.github.openshift.api.config.v1alpha1.PolicyMatchRemapIdentity +- name: com.github.openshift.api.config.v1.WebhookTokenAuthenticator map: fields: - - name: prefix + - name: kubeConfig + type: + namedType: com.github.openshift.api.config.v1.SecretNameReference + default: {} +- name: com.github.openshift.api.config.v1alpha1.AdditionalAlertmanagerConfig + map: + fields: + - name: authorization + type: + namedType: com.github.openshift.api.config.v1alpha1.AuthorizationConfig + default: {} + - name: name type: scalar: string - default: "" - - name: signedPrefix + - name: pathPrefix type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1alpha1.PolicyRootOfTrust + - name: scheme + type: + scalar: string + - name: staticConfigs + type: + list: + elementType: + scalar: string + elementRelationship: associative + - name: timeoutSeconds + type: + scalar: numeric + - name: tlsConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.TLSConfig + default: {} +- name: com.github.openshift.api.config.v1alpha1.AlertmanagerConfig map: fields: - - name: fulcioCAWithRekor - type: - namedType: com.github.openshift.api.config.v1alpha1.ImagePolicyFulcioCAWithRekorRootOfTrust - - name: pki + - name: customConfig type: - namedType: com.github.openshift.api.config.v1alpha1.ImagePolicyPKIRootOfTrust - - name: policyType + namedType: com.github.openshift.api.config.v1alpha1.AlertmanagerCustomConfig + default: {} + - name: deploymentMode type: scalar: string - default: "" - - name: publicKey - type: - namedType: com.github.openshift.api.config.v1alpha1.ImagePolicyPublicKeyRootOfTrust - unions: - - discriminator: policyType - fields: - - fieldName: fulcioCAWithRekor - discriminatorValue: FulcioCAWithRekor - - fieldName: pki - discriminatorValue: PKI - - fieldName: publicKey - discriminatorValue: PublicKey -- name: com.github.openshift.api.config.v1alpha1.PrometheusOperatorConfig +- name: com.github.openshift.api.config.v1alpha1.AlertmanagerCustomConfig map: fields: - name: logLevel @@ -4814,127 +4753,311 @@ var schemaYAML = typed.YAMLObject(`types: elementRelationship: associative keys: - name + - name: secrets + type: + list: + elementType: + scalar: string + elementRelationship: associative - name: tolerations type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + namedType: Toleration.v1.core.api.k8s.io elementRelationship: atomic - name: topologySpreadConstraints type: list: elementType: - namedType: io.k8s.api.core.v1.TopologySpreadConstraint + namedType: TopologySpreadConstraint.v1.core.api.k8s.io elementRelationship: associative keys: - topologyKey - whenUnsatisfiable -- name: com.github.openshift.api.config.v1alpha1.RSAKeyConfig + - name: volumeClaimTemplate + type: + namedType: PersistentVolumeClaim.v1.core.api.k8s.io +- name: com.github.openshift.api.config.v1alpha1.Audit map: fields: - - name: keySize + - name: profile type: - scalar: numeric -- name: com.github.openshift.api.config.v1alpha1.RetentionNumberConfig + scalar: string +- name: com.github.openshift.api.config.v1alpha1.AuthorizationConfig map: fields: - - name: maxNumberOfBackups + - name: bearerToken type: - scalar: numeric - default: 0 -- name: com.github.openshift.api.config.v1alpha1.RetentionPolicy + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: type + type: + scalar: string + unions: + - discriminator: type + fields: + - fieldName: bearerToken + discriminatorValue: BearerToken +- name: com.github.openshift.api.config.v1alpha1.Backup map: fields: - - name: retentionNumber + - name: apiVersion type: - namedType: com.github.openshift.api.config.v1alpha1.RetentionNumberConfig - - name: retentionSize + scalar: string + - name: kind type: - namedType: com.github.openshift.api.config.v1alpha1.RetentionSizeConfig - - name: retentionType + scalar: string + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1alpha1.BackupSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.config.v1alpha1.BackupStatus + default: {} +- name: com.github.openshift.api.config.v1alpha1.BackupSpec + map: + fields: + - name: etcd + type: + namedType: com.github.openshift.api.config.v1alpha1.EtcdBackupSpec + default: {} +- name: com.github.openshift.api.config.v1alpha1.BackupStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1alpha1.BasicAuth + map: + fields: + - name: password + type: + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: username + type: + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} +- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfig + map: + fields: + - name: apiVersion type: scalar: string - default: "" - unions: - - discriminator: retentionType - fields: - - fieldName: retentionNumber - discriminatorValue: RetentionNumber - - fieldName: retentionSize - discriminatorValue: RetentionSize -- name: com.github.openshift.api.config.v1alpha1.RetentionSizeConfig + - name: kind + type: + scalar: string + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec + - name: status + type: + namedType: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus + default: {} +- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec + map: + fields: + - name: matchImages + type: + list: + elementType: + scalar: string + elementRelationship: associative +- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus + map: + fields: + - name: conditions + type: + list: + elementType: + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type +- name: com.github.openshift.api.config.v1alpha1.CertificateConfig + map: + fields: + - name: key + type: + namedType: com.github.openshift.api.config.v1alpha1.KeyConfig + default: {} +- name: com.github.openshift.api.config.v1alpha1.ClusterMonitoring + map: + fields: + - name: apiVersion + type: + scalar: string + - name: kind + type: + scalar: string + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1alpha1.ClusterMonitoringSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.config.v1alpha1.ClusterMonitoringStatus + default: {} +- name: com.github.openshift.api.config.v1alpha1.ClusterMonitoringSpec + map: + fields: + - name: alertmanagerConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.AlertmanagerConfig + default: {} + - name: metricsServerConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.MetricsServerConfig + default: {} + - name: openShiftStateMetricsConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.OpenShiftStateMetricsConfig + default: {} + - name: prometheusConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.PrometheusConfig + default: {} + - name: prometheusOperatorAdmissionWebhookConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.PrometheusOperatorAdmissionWebhookConfig + default: {} + - name: prometheusOperatorConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.PrometheusOperatorConfig + default: {} + - name: telemeterClientConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.TelemeterClientConfig + default: {} + - name: userDefined + type: + namedType: com.github.openshift.api.config.v1alpha1.UserDefinedMonitoring + default: {} +- name: com.github.openshift.api.config.v1alpha1.ClusterMonitoringStatus + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1alpha1.ContainerResource + map: + fields: + - name: limit + type: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io + - name: name + type: + scalar: string + - name: request + type: + namedType: Quantity.resource.api.pkg.apimachinery.k8s.io +- name: com.github.openshift.api.config.v1alpha1.CustomPKIPolicy + map: + fields: + - name: clientCertificates + type: + namedType: com.github.openshift.api.config.v1alpha1.CertificateConfig + default: {} + - name: defaults + type: + namedType: com.github.openshift.api.config.v1alpha1.DefaultCertificateConfig + default: {} + - name: servingCertificates + type: + namedType: com.github.openshift.api.config.v1alpha1.CertificateConfig + default: {} + - name: signerCertificates + type: + namedType: com.github.openshift.api.config.v1alpha1.CertificateConfig + default: {} +- name: com.github.openshift.api.config.v1alpha1.DefaultCertificateConfig + map: + fields: + - name: key + type: + namedType: com.github.openshift.api.config.v1alpha1.KeyConfig + default: {} +- name: com.github.openshift.api.config.v1alpha1.DropEqualActionConfig map: fields: - - name: maxSizeOfBackupsGb + - name: targetLabel type: - scalar: numeric - default: 0 -- name: com.github.openshift.api.config.v1alpha1.Storage + scalar: string +- name: com.github.openshift.api.config.v1alpha1.ECDSAKeyConfig map: fields: - - name: persistentVolume - type: - namedType: com.github.openshift.api.config.v1alpha1.PersistentVolumeConfig - - name: type + - name: curve type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1alpha1.UserDefinedMonitoring +- name: com.github.openshift.api.config.v1alpha1.EtcdBackupSpec map: fields: - - name: mode + - name: pvcName type: scalar: string default: "" -- name: com.github.openshift.api.config.v1alpha2.Custom - map: - fields: - - name: configs + - name: retentionPolicy type: - list: - elementType: - namedType: com.github.openshift.api.config.v1alpha2.GathererConfig - elementRelationship: associative - keys: - - name -- name: com.github.openshift.api.config.v1alpha2.GatherConfig + namedType: com.github.openshift.api.config.v1alpha1.RetentionPolicy + default: {} + - name: schedule + type: + scalar: string + default: "" + - name: timeZone + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1alpha1.GatherConfig map: fields: - name: dataPolicy + type: + scalar: string + - name: disabledGatherers type: list: elementType: scalar: string elementRelationship: atomic - - name: gatherers - type: - namedType: com.github.openshift.api.config.v1alpha2.Gatherers - default: {} - name: storage type: - namedType: com.github.openshift.api.config.v1alpha2.Storage -- name: com.github.openshift.api.config.v1alpha2.GathererConfig - map: - fields: - - name: name - type: - scalar: string - default: "" - - name: state - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1alpha2.Gatherers + namedType: com.github.openshift.api.config.v1alpha1.Storage +- name: com.github.openshift.api.config.v1alpha1.HashModActionConfig map: fields: - - name: custom + - name: modulus type: - namedType: com.github.openshift.api.config.v1alpha2.Custom - - name: mode + scalar: numeric + - name: targetLabel type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1alpha2.InsightsDataGather +- name: com.github.openshift.api.config.v1alpha1.InsightsDataGather map: fields: - name: apiVersion @@ -4945,24 +5068,24 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: com.github.openshift.api.config.v1alpha2.InsightsDataGatherSpec + namedType: com.github.openshift.api.config.v1alpha1.InsightsDataGatherSpec default: {} - name: status type: - namedType: com.github.openshift.api.config.v1alpha2.InsightsDataGatherStatus + namedType: com.github.openshift.api.config.v1alpha1.InsightsDataGatherStatus default: {} -- name: com.github.openshift.api.config.v1alpha2.InsightsDataGatherSpec +- name: com.github.openshift.api.config.v1alpha1.InsightsDataGatherSpec map: fields: - name: gatherConfig type: - namedType: com.github.openshift.api.config.v1alpha2.GatherConfig + namedType: com.github.openshift.api.config.v1alpha1.GatherConfig default: {} -- name: com.github.openshift.api.config.v1alpha2.InsightsDataGatherStatus +- name: com.github.openshift.api.config.v1alpha1.InsightsDataGatherStatus map: elementType: scalar: untyped @@ -4974,121 +5097,177 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1alpha2.PersistentVolumeClaimReference +- name: com.github.openshift.api.config.v1alpha1.KeepEqualActionConfig map: fields: - - name: name + - name: targetLabel type: scalar: string - default: "" -- name: com.github.openshift.api.config.v1alpha2.PersistentVolumeConfig +- name: com.github.openshift.api.config.v1alpha1.KeyConfig map: fields: - - name: claim + - name: algorithm type: - namedType: com.github.openshift.api.config.v1alpha2.PersistentVolumeClaimReference + scalar: string + - name: ecdsa + type: + namedType: com.github.openshift.api.config.v1alpha1.ECDSAKeyConfig default: {} - - name: mountPath + - name: rsa type: - scalar: string -- name: com.github.openshift.api.config.v1alpha2.Storage + namedType: com.github.openshift.api.config.v1alpha1.RSAKeyConfig + default: {} + unions: + - discriminator: algorithm + fields: + - fieldName: ecdsa + discriminatorValue: ECDSA + - fieldName: rsa + discriminatorValue: RSA +- name: com.github.openshift.api.config.v1alpha1.Label map: fields: - - name: persistentVolume + - name: key type: - namedType: com.github.openshift.api.config.v1alpha2.PersistentVolumeConfig - - name: type + scalar: string + - name: value type: scalar: string - default: "" -- name: io.k8s.api.core.v1.ConfigMapKeySelector +- name: com.github.openshift.api.config.v1alpha1.LabelMapActionConfig map: fields: - - name: key + - name: replacement type: scalar: string - default: "" - - name: name +- name: com.github.openshift.api.config.v1alpha1.LowercaseActionConfig + map: + fields: + - name: targetLabel type: scalar: string - default: "" - - name: optional - type: - scalar: boolean - elementRelationship: atomic -- name: io.k8s.api.core.v1.EnvVar +- name: com.github.openshift.api.config.v1alpha1.MetadataConfig map: fields: - - name: name + - name: custom type: - scalar: string - default: "" - - name: value + namedType: com.github.openshift.api.config.v1alpha1.MetadataConfigCustom + default: {} + - name: sendPolicy type: scalar: string - - name: valueFrom +- name: com.github.openshift.api.config.v1alpha1.MetadataConfigCustom + map: + fields: + - name: sendIntervalSeconds type: - namedType: io.k8s.api.core.v1.EnvVarSource -- name: io.k8s.api.core.v1.EnvVarSource + scalar: numeric +- name: com.github.openshift.api.config.v1alpha1.MetricsServerConfig map: fields: - - name: configMapKeyRef + - name: audit type: - namedType: io.k8s.api.core.v1.ConfigMapKeySelector - - name: fieldRef + namedType: com.github.openshift.api.config.v1alpha1.Audit + default: {} + - name: nodeSelector type: - namedType: io.k8s.api.core.v1.ObjectFieldSelector - - name: fileKeyRef + map: + elementType: + scalar: string + - name: resources type: - namedType: io.k8s.api.core.v1.FileKeySelector - - name: resourceFieldRef + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.ContainerResource + elementRelationship: associative + keys: + - name + - name: tolerations type: - namedType: io.k8s.api.core.v1.ResourceFieldSelector - - name: secretKeyRef + list: + elementType: + namedType: Toleration.v1.core.api.k8s.io + elementRelationship: atomic + - name: topologySpreadConstraints + type: + list: + elementType: + namedType: TopologySpreadConstraint.v1.core.api.k8s.io + elementRelationship: associative + keys: + - topologyKey + - whenUnsatisfiable + - name: verbosity type: - namedType: io.k8s.api.core.v1.SecretKeySelector -- name: io.k8s.api.core.v1.FileKeySelector + scalar: string +- name: com.github.openshift.api.config.v1alpha1.OAuth2 map: fields: - - name: key + - name: clientId type: - scalar: string - default: "" - - name: optional + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: clientSecret type: - scalar: boolean - default: false - - name: path + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: endpointParams type: - scalar: string - default: "" - - name: volumeName + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.OAuth2EndpointParam + elementRelationship: associative + keys: + - name + - name: scopes + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: tokenUrl type: scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.api.core.v1.ModifyVolumeStatus +- name: com.github.openshift.api.config.v1alpha1.OAuth2EndpointParam map: fields: - - name: status + - name: name type: scalar: string - default: "" - - name: targetVolumeAttributesClassName + - name: value type: scalar: string -- name: io.k8s.api.core.v1.ObjectFieldSelector +- name: com.github.openshift.api.config.v1alpha1.OpenShiftStateMetricsConfig map: fields: - - name: apiVersion + - name: nodeSelector type: - scalar: string - - name: fieldPath + map: + elementType: + scalar: string + - name: resources type: - scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.api.core.v1.PersistentVolumeClaim + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.ContainerResource + elementRelationship: associative + keys: + - name + - name: tolerations + type: + list: + elementType: + namedType: Toleration.v1.core.api.k8s.io + elementRelationship: atomic + - name: topologySpreadConstraints + type: + list: + elementType: + namedType: TopologySpreadConstraint.v1.core.api.k8s.io + elementRelationship: associative + keys: + - topologyKey + - whenUnsatisfiable +- name: com.github.openshift.api.config.v1alpha1.PKI map: fields: - name: apiVersion @@ -5099,460 +5278,616 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: - namedType: io.k8s.api.core.v1.PersistentVolumeClaimSpec - default: {} - - name: status - type: - namedType: io.k8s.api.core.v1.PersistentVolumeClaimStatus + namedType: com.github.openshift.api.config.v1alpha1.PKISpec default: {} -- name: io.k8s.api.core.v1.PersistentVolumeClaimCondition +- name: com.github.openshift.api.config.v1alpha1.PKICertificateManagement map: fields: - - name: lastProbeTime - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: lastTransitionTime + - name: custom type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: message + namedType: com.github.openshift.api.config.v1alpha1.CustomPKIPolicy + default: {} + - name: mode type: scalar: string - - name: reason + unions: + - discriminator: mode + fields: + - fieldName: custom + discriminatorValue: Custom +- name: com.github.openshift.api.config.v1alpha1.PKISpec + map: + fields: + - name: certificateManagement type: - scalar: string - - name: status + namedType: com.github.openshift.api.config.v1alpha1.PKICertificateManagement + default: {} +- name: com.github.openshift.api.config.v1alpha1.PersistentVolumeClaimReference + map: + fields: + - name: name type: scalar: string default: "" - - name: type +- name: com.github.openshift.api.config.v1alpha1.PersistentVolumeConfig + map: + fields: + - name: claim + type: + namedType: com.github.openshift.api.config.v1alpha1.PersistentVolumeClaimReference + default: {} + - name: mountPath type: scalar: string - default: "" -- name: io.k8s.api.core.v1.PersistentVolumeClaimSpec +- name: com.github.openshift.api.config.v1alpha1.PrometheusConfig map: fields: - - name: accessModes + - name: additionalAlertmanagerConfigs type: list: elementType: - scalar: string - elementRelationship: atomic - - name: dataSource - type: - namedType: io.k8s.api.core.v1.TypedLocalObjectReference - - name: dataSourceRef - type: - namedType: io.k8s.api.core.v1.TypedObjectReference - - name: resources + namedType: com.github.openshift.api.config.v1alpha1.AdditionalAlertmanagerConfig + elementRelationship: associative + keys: + - name + - name: collectionProfile type: - namedType: io.k8s.api.core.v1.VolumeResourceRequirements - default: {} - - name: selector + scalar: string + - name: enforcedBodySizeLimitBytes type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector - - name: storageClassName + scalar: numeric + - name: externalLabels type: - scalar: string - - name: volumeAttributesClassName + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.Label + elementRelationship: associative + keys: + - key + - name: logLevel type: scalar: string - - name: volumeMode + - name: nodeSelector type: - scalar: string - - name: volumeName + map: + elementType: + scalar: string + - name: queryLogFile type: scalar: string -- name: io.k8s.api.core.v1.PersistentVolumeClaimStatus - map: - fields: - - name: accessModes + - name: remoteWrite type: list: elementType: - scalar: string - elementRelationship: atomic - - name: allocatedResourceStatuses + namedType: com.github.openshift.api.config.v1alpha1.RemoteWriteSpec + elementRelationship: associative + keys: + - name + - name: resources type: - map: + list: elementType: - scalar: string - elementRelationship: separable - - name: allocatedResources + namedType: com.github.openshift.api.config.v1alpha1.ContainerResource + elementRelationship: associative + keys: + - name + - name: retention type: - map: - elementType: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity - - name: capacity + namedType: com.github.openshift.api.config.v1alpha1.Retention + default: {} + - name: tolerations type: - map: + list: elementType: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity - - name: conditions + namedType: Toleration.v1.core.api.k8s.io + elementRelationship: atomic + - name: topologySpreadConstraints type: list: elementType: - namedType: io.k8s.api.core.v1.PersistentVolumeClaimCondition + namedType: TopologySpreadConstraint.v1.core.api.k8s.io elementRelationship: associative keys: - - type - - name: currentVolumeAttributesClassName - type: - scalar: string - - name: modifyVolumeStatus - type: - namedType: io.k8s.api.core.v1.ModifyVolumeStatus - - name: phase + - topologyKey + - whenUnsatisfiable + - name: volumeClaimTemplate type: - scalar: string -- name: io.k8s.api.core.v1.ResourceClaim + namedType: PersistentVolumeClaim.v1.core.api.k8s.io +- name: com.github.openshift.api.config.v1alpha1.PrometheusOperatorAdmissionWebhookConfig map: fields: - - name: name + - name: resources type: - scalar: string - default: "" - - name: request + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.ContainerResource + elementRelationship: associative + keys: + - name + - name: topologySpreadConstraints type: - scalar: string -- name: io.k8s.api.core.v1.ResourceFieldSelector + list: + elementType: + namedType: TopologySpreadConstraint.v1.core.api.k8s.io + elementRelationship: associative + keys: + - topologyKey + - whenUnsatisfiable +- name: com.github.openshift.api.config.v1alpha1.PrometheusOperatorConfig map: fields: - - name: containerName + - name: logLevel type: scalar: string - - name: divisor - type: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity - - name: resource + - name: nodeSelector type: - scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.api.core.v1.ResourceRequirements - map: - fields: - - name: claims + map: + elementType: + scalar: string + - name: resources type: list: elementType: - namedType: io.k8s.api.core.v1.ResourceClaim + namedType: com.github.openshift.api.config.v1alpha1.ContainerResource elementRelationship: associative keys: - name - - name: limits + - name: tolerations type: - map: + list: elementType: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity - - name: requests + namedType: Toleration.v1.core.api.k8s.io + elementRelationship: atomic + - name: topologySpreadConstraints type: - map: + list: elementType: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity -- name: io.k8s.api.core.v1.SecretKeySelector + namedType: TopologySpreadConstraint.v1.core.api.k8s.io + elementRelationship: associative + keys: + - topologyKey + - whenUnsatisfiable +- name: com.github.openshift.api.config.v1alpha1.PrometheusRemoteWriteHeader map: fields: - - name: key - type: - scalar: string - default: "" - name: name type: scalar: string - default: "" - - name: optional + - name: value type: - scalar: boolean - elementRelationship: atomic -- name: io.k8s.api.core.v1.Toleration + scalar: string +- name: com.github.openshift.api.config.v1alpha1.QueueConfig map: fields: - - name: effect + - name: batchSendDeadlineSeconds type: - scalar: string - - name: key + scalar: numeric + - name: capacity type: - scalar: string - - name: operator + scalar: numeric + - name: maxBackoffMilliseconds type: - scalar: string - - name: tolerationSeconds + scalar: numeric + - name: maxSamplesPerSend type: scalar: numeric - - name: value + - name: maxShards + type: + scalar: numeric + - name: minBackoffMilliseconds + type: + scalar: numeric + - name: minShards + type: + scalar: numeric + - name: rateLimitedAction type: scalar: string -- name: io.k8s.api.core.v1.TopologySpreadConstraint +- name: com.github.openshift.api.config.v1alpha1.RSAKeyConfig map: fields: - - name: labelSelector + - name: keySize type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector - - name: matchLabelKeys + scalar: numeric +- name: com.github.openshift.api.config.v1alpha1.RelabelActionConfig + map: + fields: + - name: dropEqual type: - list: - elementType: - scalar: string - elementRelationship: atomic - - name: maxSkew + namedType: com.github.openshift.api.config.v1alpha1.DropEqualActionConfig + default: {} + - name: hashMod type: - scalar: numeric - default: 0 - - name: minDomains + namedType: com.github.openshift.api.config.v1alpha1.HashModActionConfig + default: {} + - name: keepEqual type: - scalar: numeric - - name: nodeAffinityPolicy + namedType: com.github.openshift.api.config.v1alpha1.KeepEqualActionConfig + default: {} + - name: labelMap + type: + namedType: com.github.openshift.api.config.v1alpha1.LabelMapActionConfig + default: {} + - name: lowercase + type: + namedType: com.github.openshift.api.config.v1alpha1.LowercaseActionConfig + default: {} + - name: replace + type: + namedType: com.github.openshift.api.config.v1alpha1.ReplaceActionConfig + default: {} + - name: type type: scalar: string - - name: nodeTaintsPolicy + - name: uppercase + type: + namedType: com.github.openshift.api.config.v1alpha1.UppercaseActionConfig + default: {} + unions: + - discriminator: type + fields: + - fieldName: dropEqual + discriminatorValue: DropEqual + - fieldName: hashMod + discriminatorValue: HashMod + - fieldName: keepEqual + discriminatorValue: KeepEqual + - fieldName: labelMap + discriminatorValue: LabelMap + - fieldName: lowercase + discriminatorValue: Lowercase + - fieldName: replace + discriminatorValue: Replace + - fieldName: uppercase + discriminatorValue: Uppercase +- name: com.github.openshift.api.config.v1alpha1.RelabelConfig + map: + fields: + - name: action + type: + namedType: com.github.openshift.api.config.v1alpha1.RelabelActionConfig + default: {} + - name: name type: scalar: string - - name: topologyKey + - name: regex type: scalar: string - default: "" - - name: whenUnsatisfiable + - name: separator type: scalar: string - default: "" -- name: io.k8s.api.core.v1.TypedLocalObjectReference + - name: sourceLabels + type: + list: + elementType: + scalar: string + elementRelationship: associative +- name: com.github.openshift.api.config.v1alpha1.RemoteWriteAuthorization map: fields: - - name: apiGroup + - name: basicAuth + type: + namedType: com.github.openshift.api.config.v1alpha1.BasicAuth + default: {} + - name: bearerToken + type: + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: oauth2 + type: + namedType: com.github.openshift.api.config.v1alpha1.OAuth2 + default: {} + - name: safeAuthorization + type: + namedType: SecretKeySelector.v1.core.api.k8s.io + - name: sigv4 + type: + namedType: com.github.openshift.api.config.v1alpha1.Sigv4 + default: {} + - name: type type: scalar: string - - name: kind + unions: + - discriminator: type + fields: + - fieldName: basicAuth + discriminatorValue: BasicAuth + - fieldName: bearerToken + discriminatorValue: BearerToken + - fieldName: oauth2 + discriminatorValue: OAuth2 + - fieldName: safeAuthorization + discriminatorValue: SafeAuthorization + - fieldName: sigv4 + discriminatorValue: Sigv4 +- name: com.github.openshift.api.config.v1alpha1.RemoteWriteSpec + map: + fields: + - name: authorization + type: + namedType: com.github.openshift.api.config.v1alpha1.RemoteWriteAuthorization + default: {} + - name: exemplarsMode type: scalar: string - default: "" + - name: headers + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.PrometheusRemoteWriteHeader + elementRelationship: associative + keys: + - name + - name: metadataConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.MetadataConfig + default: {} - name: name type: scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.api.core.v1.TypedObjectReference - map: - fields: - - name: apiGroup + - name: proxyUrl type: scalar: string - - name: kind + - name: queueConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.QueueConfig + default: {} + - name: remoteTimeoutSeconds + type: + scalar: numeric + - name: tlsConfig + type: + namedType: com.github.openshift.api.config.v1alpha1.TLSConfig + default: {} + - name: url type: scalar: string - default: "" - - name: name + - name: writeRelabelConfigs + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1alpha1.RelabelConfig + elementRelationship: associative + keys: + - name +- name: com.github.openshift.api.config.v1alpha1.ReplaceActionConfig + map: + fields: + - name: replacement type: scalar: string - default: "" - - name: namespace + - name: targetLabel type: scalar: string -- name: io.k8s.api.core.v1.VolumeResourceRequirements +- name: com.github.openshift.api.config.v1alpha1.Retention map: fields: - - name: limits + - name: durationInDays type: - map: - elementType: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity - - name: requests + scalar: numeric + - name: sizeInGiB type: - map: - elementType: - namedType: io.k8s.apimachinery.pkg.api.resource.Quantity -- name: io.k8s.apimachinery.pkg.api.resource.Quantity - scalar: untyped -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + scalar: numeric +- name: com.github.openshift.api.config.v1alpha1.RetentionNumberConfig map: fields: - - name: lastTransitionTime - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: message - type: - scalar: string - default: "" - - name: observedGeneration + - name: maxNumberOfBackups type: scalar: numeric - - name: reason + default: 0 +- name: com.github.openshift.api.config.v1alpha1.RetentionPolicy + map: + fields: + - name: retentionNumber type: - scalar: string - default: "" - - name: status + namedType: com.github.openshift.api.config.v1alpha1.RetentionNumberConfig + - name: retentionSize type: - scalar: string - default: "" - - name: type + namedType: com.github.openshift.api.config.v1alpha1.RetentionSizeConfig + - name: retentionType type: scalar: string default: "" -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Duration - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 + unions: + - discriminator: retentionType + fields: + - fieldName: retentionNumber + discriminatorValue: RetentionNumber + - fieldName: retentionSize + discriminatorValue: RetentionSize +- name: com.github.openshift.api.config.v1alpha1.RetentionSizeConfig map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + fields: + - name: maxSizeOfBackupsGb + type: + scalar: numeric + default: 0 +- name: com.github.openshift.api.config.v1alpha1.SecretKeySelector map: fields: - - name: matchExpressions + - name: key type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement - elementRelationship: atomic - - name: matchLabels + scalar: string + - name: name type: - map: - elementType: - scalar: string + scalar: string elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement +- name: com.github.openshift.api.config.v1alpha1.Sigv4 map: fields: - - name: key + - name: accessKey + type: + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: profile type: scalar: string - default: "" - - name: operator + - name: region type: scalar: string - default: "" - - name: values + - name: roleArn type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry + scalar: string + - name: secretKey + type: + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} +- name: com.github.openshift.api.config.v1alpha1.Storage map: fields: - - name: apiVersion + - name: persistentVolume type: - scalar: string - - name: fieldsType + namedType: com.github.openshift.api.config.v1alpha1.PersistentVolumeConfig + - name: type type: scalar: string - - name: fieldsV1 + default: "" +- name: com.github.openshift.api.config.v1alpha1.TLSConfig + map: + fields: + - name: ca type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 - - name: manager + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: cert type: - scalar: string - - name: operation + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: certificateVerification type: scalar: string - - name: subresource + - name: key type: - scalar: string - - name: time + namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector + default: {} + - name: serverName type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + scalar: string +- name: com.github.openshift.api.config.v1alpha1.TelemeterClientConfig map: fields: - - name: annotations + - name: nodeSelector type: map: elementType: scalar: string - - name: creationTimestamp - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: deletionGracePeriodSeconds - type: - scalar: numeric - - name: deletionTimestamp - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: finalizers + - name: resources type: list: elementType: - scalar: string + namedType: com.github.openshift.api.config.v1alpha1.ContainerResource elementRelationship: associative - - name: generateName - type: - scalar: string - - name: generation - type: - scalar: numeric - - name: labels + keys: + - name + - name: tolerations type: - map: + list: elementType: - scalar: string - - name: managedFields + namedType: Toleration.v1.core.api.k8s.io + elementRelationship: atomic + - name: topologySpreadConstraints type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry - elementRelationship: atomic - - name: name + namedType: TopologySpreadConstraint.v1.core.api.k8s.io + elementRelationship: associative + keys: + - topologyKey + - whenUnsatisfiable +- name: com.github.openshift.api.config.v1alpha1.UppercaseActionConfig + map: + fields: + - name: targetLabel type: scalar: string - - name: namespace +- name: com.github.openshift.api.config.v1alpha1.UserDefinedMonitoring + map: + fields: + - name: mode type: scalar: string - - name: ownerReferences + default: "" +- name: com.github.openshift.api.config.v1alpha2.Custom + map: + fields: + - name: configs type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference + namedType: com.github.openshift.api.config.v1alpha2.GathererConfig elementRelationship: associative keys: - - uid - - name: resourceVersion + - name +- name: com.github.openshift.api.config.v1alpha2.GatherConfig + map: + fields: + - name: dataPolicy type: - scalar: string - - name: selfLink + list: + elementType: + scalar: string + elementRelationship: atomic + - name: gatherers type: - scalar: string - - name: uid + namedType: com.github.openshift.api.config.v1alpha2.Gatherers + default: {} + - name: storage type: - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference + namedType: com.github.openshift.api.config.v1alpha2.Storage +- name: com.github.openshift.api.config.v1alpha2.GathererConfig map: fields: - - name: apiVersion + - name: name type: scalar: string default: "" - - name: blockOwnerDeletion + - name: state type: - scalar: boolean - - name: controller + scalar: string + default: "" +- name: com.github.openshift.api.config.v1alpha2.Gatherers + map: + fields: + - name: custom type: - scalar: boolean - - name: kind + namedType: com.github.openshift.api.config.v1alpha2.Custom + - name: mode type: scalar: string default: "" - - name: name +- name: com.github.openshift.api.config.v1alpha2.InsightsDataGather + map: + fields: + - name: apiVersion type: scalar: string - default: "" - - name: uid + - name: kind type: scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Time - scalar: untyped -- name: io.k8s.apimachinery.pkg.runtime.RawExtension + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1alpha2.InsightsDataGatherSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.config.v1alpha2.InsightsDataGatherStatus + default: {} +- name: com.github.openshift.api.config.v1alpha2.InsightsDataGatherSpec + map: + fields: + - name: gatherConfig + type: + namedType: com.github.openshift.api.config.v1alpha2.GatherConfig + default: {} +- name: com.github.openshift.api.config.v1alpha2.InsightsDataGatherStatus map: elementType: scalar: untyped @@ -5564,6 +5899,33 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable +- name: com.github.openshift.api.config.v1alpha2.PersistentVolumeClaimReference + map: + fields: + - name: name + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1alpha2.PersistentVolumeConfig + map: + fields: + - name: claim + type: + namedType: com.github.openshift.api.config.v1alpha2.PersistentVolumeClaimReference + default: {} + - name: mountPath + type: + scalar: string +- name: com.github.openshift.api.config.v1alpha2.Storage + map: + fields: + - name: persistentVolume + type: + namedType: com.github.openshift.api.config.v1alpha2.PersistentVolumeConfig + - name: type + type: + scalar: string + default: "" - name: __untyped_atomic_ scalar: untyped list: diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/clusterimagepolicy.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/clusterimagepolicy.go deleted file mode 100644 index 8391f7b40e..0000000000 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/clusterimagepolicy.go +++ /dev/null @@ -1,58 +0,0 @@ -// Code generated by client-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - context "context" - - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - applyconfigurationsconfigv1alpha1 "github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1" - scheme "github.com/openshift/client-go/config/clientset/versioned/scheme" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - watch "k8s.io/apimachinery/pkg/watch" - gentype "k8s.io/client-go/gentype" -) - -// ClusterImagePoliciesGetter has a method to return a ClusterImagePolicyInterface. -// A group's client should implement this interface. -type ClusterImagePoliciesGetter interface { - ClusterImagePolicies() ClusterImagePolicyInterface -} - -// ClusterImagePolicyInterface has methods to work with ClusterImagePolicy resources. -type ClusterImagePolicyInterface interface { - Create(ctx context.Context, clusterImagePolicy *configv1alpha1.ClusterImagePolicy, opts v1.CreateOptions) (*configv1alpha1.ClusterImagePolicy, error) - Update(ctx context.Context, clusterImagePolicy *configv1alpha1.ClusterImagePolicy, opts v1.UpdateOptions) (*configv1alpha1.ClusterImagePolicy, error) - // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). - UpdateStatus(ctx context.Context, clusterImagePolicy *configv1alpha1.ClusterImagePolicy, opts v1.UpdateOptions) (*configv1alpha1.ClusterImagePolicy, error) - Delete(ctx context.Context, name string, opts v1.DeleteOptions) error - DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error - Get(ctx context.Context, name string, opts v1.GetOptions) (*configv1alpha1.ClusterImagePolicy, error) - List(ctx context.Context, opts v1.ListOptions) (*configv1alpha1.ClusterImagePolicyList, error) - Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) - Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *configv1alpha1.ClusterImagePolicy, err error) - Apply(ctx context.Context, clusterImagePolicy *applyconfigurationsconfigv1alpha1.ClusterImagePolicyApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.ClusterImagePolicy, err error) - // Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus(). - ApplyStatus(ctx context.Context, clusterImagePolicy *applyconfigurationsconfigv1alpha1.ClusterImagePolicyApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.ClusterImagePolicy, err error) - ClusterImagePolicyExpansion -} - -// clusterImagePolicies implements ClusterImagePolicyInterface -type clusterImagePolicies struct { - *gentype.ClientWithListAndApply[*configv1alpha1.ClusterImagePolicy, *configv1alpha1.ClusterImagePolicyList, *applyconfigurationsconfigv1alpha1.ClusterImagePolicyApplyConfiguration] -} - -// newClusterImagePolicies returns a ClusterImagePolicies -func newClusterImagePolicies(c *ConfigV1alpha1Client) *clusterImagePolicies { - return &clusterImagePolicies{ - gentype.NewClientWithListAndApply[*configv1alpha1.ClusterImagePolicy, *configv1alpha1.ClusterImagePolicyList, *applyconfigurationsconfigv1alpha1.ClusterImagePolicyApplyConfiguration]( - "clusterimagepolicies", - c.RESTClient(), - scheme.ParameterCodec, - "", - func() *configv1alpha1.ClusterImagePolicy { return &configv1alpha1.ClusterImagePolicy{} }, - func() *configv1alpha1.ClusterImagePolicyList { return &configv1alpha1.ClusterImagePolicyList{} }, - ), - } -} diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go index ce3b84174d..23ba9a19c0 100644 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go +++ b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go @@ -14,9 +14,7 @@ type ConfigV1alpha1Interface interface { RESTClient() rest.Interface BackupsGetter CRIOCredentialProviderConfigsGetter - ClusterImagePoliciesGetter ClusterMonitoringsGetter - ImagePoliciesGetter InsightsDataGathersGetter PKIsGetter } @@ -34,18 +32,10 @@ func (c *ConfigV1alpha1Client) CRIOCredentialProviderConfigs() CRIOCredentialPro return newCRIOCredentialProviderConfigs(c) } -func (c *ConfigV1alpha1Client) ClusterImagePolicies() ClusterImagePolicyInterface { - return newClusterImagePolicies(c) -} - func (c *ConfigV1alpha1Client) ClusterMonitorings() ClusterMonitoringInterface { return newClusterMonitorings(c) } -func (c *ConfigV1alpha1Client) ImagePolicies(namespace string) ImagePolicyInterface { - return newImagePolicies(c, namespace) -} - func (c *ConfigV1alpha1Client) InsightsDataGathers() InsightsDataGatherInterface { return newInsightsDataGathers(c) } diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go index 3908fe8d17..bc1f603194 100644 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go +++ b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go @@ -6,12 +6,8 @@ type BackupExpansion interface{} type CRIOCredentialProviderConfigExpansion interface{} -type ClusterImagePolicyExpansion interface{} - type ClusterMonitoringExpansion interface{} -type ImagePolicyExpansion interface{} - type InsightsDataGatherExpansion interface{} type PKIExpansion interface{} diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/imagepolicy.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/imagepolicy.go deleted file mode 100644 index a893efeea7..0000000000 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/imagepolicy.go +++ /dev/null @@ -1,58 +0,0 @@ -// Code generated by client-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - context "context" - - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - applyconfigurationsconfigv1alpha1 "github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1" - scheme "github.com/openshift/client-go/config/clientset/versioned/scheme" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - watch "k8s.io/apimachinery/pkg/watch" - gentype "k8s.io/client-go/gentype" -) - -// ImagePoliciesGetter has a method to return a ImagePolicyInterface. -// A group's client should implement this interface. -type ImagePoliciesGetter interface { - ImagePolicies(namespace string) ImagePolicyInterface -} - -// ImagePolicyInterface has methods to work with ImagePolicy resources. -type ImagePolicyInterface interface { - Create(ctx context.Context, imagePolicy *configv1alpha1.ImagePolicy, opts v1.CreateOptions) (*configv1alpha1.ImagePolicy, error) - Update(ctx context.Context, imagePolicy *configv1alpha1.ImagePolicy, opts v1.UpdateOptions) (*configv1alpha1.ImagePolicy, error) - // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). - UpdateStatus(ctx context.Context, imagePolicy *configv1alpha1.ImagePolicy, opts v1.UpdateOptions) (*configv1alpha1.ImagePolicy, error) - Delete(ctx context.Context, name string, opts v1.DeleteOptions) error - DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error - Get(ctx context.Context, name string, opts v1.GetOptions) (*configv1alpha1.ImagePolicy, error) - List(ctx context.Context, opts v1.ListOptions) (*configv1alpha1.ImagePolicyList, error) - Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) - Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *configv1alpha1.ImagePolicy, err error) - Apply(ctx context.Context, imagePolicy *applyconfigurationsconfigv1alpha1.ImagePolicyApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.ImagePolicy, err error) - // Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus(). - ApplyStatus(ctx context.Context, imagePolicy *applyconfigurationsconfigv1alpha1.ImagePolicyApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.ImagePolicy, err error) - ImagePolicyExpansion -} - -// imagePolicies implements ImagePolicyInterface -type imagePolicies struct { - *gentype.ClientWithListAndApply[*configv1alpha1.ImagePolicy, *configv1alpha1.ImagePolicyList, *applyconfigurationsconfigv1alpha1.ImagePolicyApplyConfiguration] -} - -// newImagePolicies returns a ImagePolicies -func newImagePolicies(c *ConfigV1alpha1Client, namespace string) *imagePolicies { - return &imagePolicies{ - gentype.NewClientWithListAndApply[*configv1alpha1.ImagePolicy, *configv1alpha1.ImagePolicyList, *applyconfigurationsconfigv1alpha1.ImagePolicyApplyConfiguration]( - "imagepolicies", - c.RESTClient(), - scheme.ParameterCodec, - namespace, - func() *configv1alpha1.ImagePolicy { return &configv1alpha1.ImagePolicy{} }, - func() *configv1alpha1.ImagePolicyList { return &configv1alpha1.ImagePolicyList{} }, - ), - } -} diff --git a/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clusterimagepolicy.go b/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clusterimagepolicy.go deleted file mode 100644 index af5c3e27f1..0000000000 --- a/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/clusterimagepolicy.go +++ /dev/null @@ -1,85 +0,0 @@ -// Code generated by informer-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - context "context" - time "time" - - apiconfigv1alpha1 "github.com/openshift/api/config/v1alpha1" - versioned "github.com/openshift/client-go/config/clientset/versioned" - internalinterfaces "github.com/openshift/client-go/config/informers/externalversions/internalinterfaces" - configv1alpha1 "github.com/openshift/client-go/config/listers/config/v1alpha1" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - runtime "k8s.io/apimachinery/pkg/runtime" - watch "k8s.io/apimachinery/pkg/watch" - cache "k8s.io/client-go/tools/cache" -) - -// ClusterImagePolicyInformer provides access to a shared informer and lister for -// ClusterImagePolicies. -type ClusterImagePolicyInformer interface { - Informer() cache.SharedIndexInformer - Lister() configv1alpha1.ClusterImagePolicyLister -} - -type clusterImagePolicyInformer struct { - factory internalinterfaces.SharedInformerFactory - tweakListOptions internalinterfaces.TweakListOptionsFunc -} - -// NewClusterImagePolicyInformer constructs a new informer for ClusterImagePolicy type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewClusterImagePolicyInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { - return NewFilteredClusterImagePolicyInformer(client, resyncPeriod, indexers, nil) -} - -// NewFilteredClusterImagePolicyInformer constructs a new informer for ClusterImagePolicy type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewFilteredClusterImagePolicyInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { - return cache.NewSharedIndexInformer( - cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{ - ListFunc: func(options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ClusterImagePolicies().List(context.Background(), options) - }, - WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ClusterImagePolicies().Watch(context.Background(), options) - }, - ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ClusterImagePolicies().List(ctx, options) - }, - WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ClusterImagePolicies().Watch(ctx, options) - }, - }, client), - &apiconfigv1alpha1.ClusterImagePolicy{}, - resyncPeriod, - indexers, - ) -} - -func (f *clusterImagePolicyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { - return NewFilteredClusterImagePolicyInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) -} - -func (f *clusterImagePolicyInformer) Informer() cache.SharedIndexInformer { - return f.factory.InformerFor(&apiconfigv1alpha1.ClusterImagePolicy{}, f.defaultInformer) -} - -func (f *clusterImagePolicyInformer) Lister() configv1alpha1.ClusterImagePolicyLister { - return configv1alpha1.NewClusterImagePolicyLister(f.Informer().GetIndexer()) -} diff --git a/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/imagepolicy.go b/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/imagepolicy.go deleted file mode 100644 index d56c1e834f..0000000000 --- a/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/imagepolicy.go +++ /dev/null @@ -1,86 +0,0 @@ -// Code generated by informer-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - context "context" - time "time" - - apiconfigv1alpha1 "github.com/openshift/api/config/v1alpha1" - versioned "github.com/openshift/client-go/config/clientset/versioned" - internalinterfaces "github.com/openshift/client-go/config/informers/externalversions/internalinterfaces" - configv1alpha1 "github.com/openshift/client-go/config/listers/config/v1alpha1" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - runtime "k8s.io/apimachinery/pkg/runtime" - watch "k8s.io/apimachinery/pkg/watch" - cache "k8s.io/client-go/tools/cache" -) - -// ImagePolicyInformer provides access to a shared informer and lister for -// ImagePolicies. -type ImagePolicyInformer interface { - Informer() cache.SharedIndexInformer - Lister() configv1alpha1.ImagePolicyLister -} - -type imagePolicyInformer struct { - factory internalinterfaces.SharedInformerFactory - tweakListOptions internalinterfaces.TweakListOptionsFunc - namespace string -} - -// NewImagePolicyInformer constructs a new informer for ImagePolicy type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewImagePolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer { - return NewFilteredImagePolicyInformer(client, namespace, resyncPeriod, indexers, nil) -} - -// NewFilteredImagePolicyInformer constructs a new informer for ImagePolicy type. -// Always prefer using an informer factory to get a shared informer instead of getting an independent -// one. This reduces memory footprint and number of connections to the server. -func NewFilteredImagePolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer { - return cache.NewSharedIndexInformer( - cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{ - ListFunc: func(options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ImagePolicies(namespace).List(context.Background(), options) - }, - WatchFunc: func(options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ImagePolicies(namespace).Watch(context.Background(), options) - }, - ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ImagePolicies(namespace).List(ctx, options) - }, - WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) { - if tweakListOptions != nil { - tweakListOptions(&options) - } - return client.ConfigV1alpha1().ImagePolicies(namespace).Watch(ctx, options) - }, - }, client), - &apiconfigv1alpha1.ImagePolicy{}, - resyncPeriod, - indexers, - ) -} - -func (f *imagePolicyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer { - return NewFilteredImagePolicyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions) -} - -func (f *imagePolicyInformer) Informer() cache.SharedIndexInformer { - return f.factory.InformerFor(&apiconfigv1alpha1.ImagePolicy{}, f.defaultInformer) -} - -func (f *imagePolicyInformer) Lister() configv1alpha1.ImagePolicyLister { - return configv1alpha1.NewImagePolicyLister(f.Informer().GetIndexer()) -} diff --git a/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/interface.go b/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/interface.go index 5d0818a188..17b0ebcc0b 100644 --- a/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/interface.go +++ b/vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1alpha1/interface.go @@ -12,12 +12,8 @@ type Interface interface { Backups() BackupInformer // CRIOCredentialProviderConfigs returns a CRIOCredentialProviderConfigInformer. CRIOCredentialProviderConfigs() CRIOCredentialProviderConfigInformer - // ClusterImagePolicies returns a ClusterImagePolicyInformer. - ClusterImagePolicies() ClusterImagePolicyInformer // ClusterMonitorings returns a ClusterMonitoringInformer. ClusterMonitorings() ClusterMonitoringInformer - // ImagePolicies returns a ImagePolicyInformer. - ImagePolicies() ImagePolicyInformer // InsightsDataGathers returns a InsightsDataGatherInformer. InsightsDataGathers() InsightsDataGatherInformer // PKIs returns a PKIInformer. @@ -45,21 +41,11 @@ func (v *version) CRIOCredentialProviderConfigs() CRIOCredentialProviderConfigIn return &cRIOCredentialProviderConfigInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} } -// ClusterImagePolicies returns a ClusterImagePolicyInformer. -func (v *version) ClusterImagePolicies() ClusterImagePolicyInformer { - return &clusterImagePolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} -} - // ClusterMonitorings returns a ClusterMonitoringInformer. func (v *version) ClusterMonitorings() ClusterMonitoringInformer { return &clusterMonitoringInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} } -// ImagePolicies returns a ImagePolicyInformer. -func (v *version) ImagePolicies() ImagePolicyInformer { - return &imagePolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions} -} - // InsightsDataGathers returns a InsightsDataGatherInformer. func (v *version) InsightsDataGathers() InsightsDataGatherInformer { return &insightsDataGatherInformer{factory: v.factory, tweakListOptions: v.tweakListOptions} diff --git a/vendor/github.com/openshift/client-go/config/informers/externalversions/generic.go b/vendor/github.com/openshift/client-go/config/informers/externalversions/generic.go index 3e7ec33751..4c00a13f17 100644 --- a/vendor/github.com/openshift/client-go/config/informers/externalversions/generic.go +++ b/vendor/github.com/openshift/client-go/config/informers/externalversions/generic.go @@ -93,12 +93,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().Backups().Informer()}, nil case v1alpha1.SchemeGroupVersion.WithResource("criocredentialproviderconfigs"): return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().CRIOCredentialProviderConfigs().Informer()}, nil - case v1alpha1.SchemeGroupVersion.WithResource("clusterimagepolicies"): - return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().ClusterImagePolicies().Informer()}, nil case v1alpha1.SchemeGroupVersion.WithResource("clustermonitorings"): return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().ClusterMonitorings().Informer()}, nil - case v1alpha1.SchemeGroupVersion.WithResource("imagepolicies"): - return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().ImagePolicies().Informer()}, nil case v1alpha1.SchemeGroupVersion.WithResource("insightsdatagathers"): return &genericInformer{resource: resource.GroupResource(), informer: f.Config().V1alpha1().InsightsDataGathers().Informer()}, nil case v1alpha1.SchemeGroupVersion.WithResource("pkis"): diff --git a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/clusterimagepolicy.go b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/clusterimagepolicy.go deleted file mode 100644 index 0512d3682f..0000000000 --- a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/clusterimagepolicy.go +++ /dev/null @@ -1,32 +0,0 @@ -// Code generated by lister-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - labels "k8s.io/apimachinery/pkg/labels" - listers "k8s.io/client-go/listers" - cache "k8s.io/client-go/tools/cache" -) - -// ClusterImagePolicyLister helps list ClusterImagePolicies. -// All objects returned here must be treated as read-only. -type ClusterImagePolicyLister interface { - // List lists all ClusterImagePolicies in the indexer. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*configv1alpha1.ClusterImagePolicy, err error) - // Get retrieves the ClusterImagePolicy from the index for a given name. - // Objects returned here must be treated as read-only. - Get(name string) (*configv1alpha1.ClusterImagePolicy, error) - ClusterImagePolicyListerExpansion -} - -// clusterImagePolicyLister implements the ClusterImagePolicyLister interface. -type clusterImagePolicyLister struct { - listers.ResourceIndexer[*configv1alpha1.ClusterImagePolicy] -} - -// NewClusterImagePolicyLister returns a new ClusterImagePolicyLister. -func NewClusterImagePolicyLister(indexer cache.Indexer) ClusterImagePolicyLister { - return &clusterImagePolicyLister{listers.New[*configv1alpha1.ClusterImagePolicy](indexer, configv1alpha1.Resource("clusterimagepolicy"))} -} diff --git a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go index dbcd1a084c..3baf74bc8b 100644 --- a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go +++ b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go @@ -10,22 +10,10 @@ type BackupListerExpansion interface{} // CRIOCredentialProviderConfigLister. type CRIOCredentialProviderConfigListerExpansion interface{} -// ClusterImagePolicyListerExpansion allows custom methods to be added to -// ClusterImagePolicyLister. -type ClusterImagePolicyListerExpansion interface{} - // ClusterMonitoringListerExpansion allows custom methods to be added to // ClusterMonitoringLister. type ClusterMonitoringListerExpansion interface{} -// ImagePolicyListerExpansion allows custom methods to be added to -// ImagePolicyLister. -type ImagePolicyListerExpansion interface{} - -// ImagePolicyNamespaceListerExpansion allows custom methods to be added to -// ImagePolicyNamespaceLister. -type ImagePolicyNamespaceListerExpansion interface{} - // InsightsDataGatherListerExpansion allows custom methods to be added to // InsightsDataGatherLister. type InsightsDataGatherListerExpansion interface{} diff --git a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/imagepolicy.go b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/imagepolicy.go deleted file mode 100644 index 7050c57718..0000000000 --- a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/imagepolicy.go +++ /dev/null @@ -1,54 +0,0 @@ -// Code generated by lister-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - labels "k8s.io/apimachinery/pkg/labels" - listers "k8s.io/client-go/listers" - cache "k8s.io/client-go/tools/cache" -) - -// ImagePolicyLister helps list ImagePolicies. -// All objects returned here must be treated as read-only. -type ImagePolicyLister interface { - // List lists all ImagePolicies in the indexer. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*configv1alpha1.ImagePolicy, err error) - // ImagePolicies returns an object that can list and get ImagePolicies. - ImagePolicies(namespace string) ImagePolicyNamespaceLister - ImagePolicyListerExpansion -} - -// imagePolicyLister implements the ImagePolicyLister interface. -type imagePolicyLister struct { - listers.ResourceIndexer[*configv1alpha1.ImagePolicy] -} - -// NewImagePolicyLister returns a new ImagePolicyLister. -func NewImagePolicyLister(indexer cache.Indexer) ImagePolicyLister { - return &imagePolicyLister{listers.New[*configv1alpha1.ImagePolicy](indexer, configv1alpha1.Resource("imagepolicy"))} -} - -// ImagePolicies returns an object that can list and get ImagePolicies. -func (s *imagePolicyLister) ImagePolicies(namespace string) ImagePolicyNamespaceLister { - return imagePolicyNamespaceLister{listers.NewNamespaced[*configv1alpha1.ImagePolicy](s.ResourceIndexer, namespace)} -} - -// ImagePolicyNamespaceLister helps list and get ImagePolicies. -// All objects returned here must be treated as read-only. -type ImagePolicyNamespaceLister interface { - // List lists all ImagePolicies in the indexer for a given namespace. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*configv1alpha1.ImagePolicy, err error) - // Get retrieves the ImagePolicy from the indexer for a given namespace and name. - // Objects returned here must be treated as read-only. - Get(name string) (*configv1alpha1.ImagePolicy, error) - ImagePolicyNamespaceListerExpansion -} - -// imagePolicyNamespaceLister implements the ImagePolicyNamespaceLister -// interface. -type imagePolicyNamespaceLister struct { - listers.ResourceIndexer[*configv1alpha1.ImagePolicy] -} diff --git a/vendor/github.com/openshift/client-go/machine/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/machine/applyconfigurations/internal/internal.go index 3dd213be79..03faec6663 100644 --- a/vendor/github.com/openshift/client-go/machine/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/machine/applyconfigurations/internal/internal.go @@ -23,6 +23,259 @@ func Parser() *typed.Parser { var parserOnce sync.Once var parser *typed.Parser var schemaYAML = typed.YAMLObject(`types: +- name: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: lastTransitionTime + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: message + type: + scalar: string + default: "" + - name: observedGeneration + type: + scalar: numeric + - name: reason + type: + scalar: string + default: "" + - name: status + type: + scalar: string + default: "" + - name: type + type: + scalar: string + default: "" +- name: Duration.v1.meta.apis.pkg.apimachinery.k8s.io + scalar: string +- name: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: IntOrString.intstr.util.pkg.apimachinery.k8s.io + scalar: untyped +- name: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: matchExpressions + type: + list: + elementType: + namedType: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: atomic + - name: matchLabels + type: + map: + elementType: + scalar: string + elementRelationship: atomic +- name: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: key + type: + scalar: string + default: "" + - name: operator + type: + scalar: string + default: "" + - name: values + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: apiVersion + type: + scalar: string + - name: fieldsType + type: + scalar: string + - name: fieldsV1 + type: + namedType: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io + - name: manager + type: + scalar: string + - name: operation + type: + scalar: string + - name: subresource + type: + scalar: string + - name: time + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io +- name: NodeAddress.v1.core.api.k8s.io + map: + fields: + - name: address + type: + scalar: string + default: "" + - name: type + type: + scalar: string + default: "" +- name: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: annotations + type: + map: + elementType: + scalar: string + - name: creationTimestamp + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: deletionGracePeriodSeconds + type: + scalar: numeric + - name: deletionTimestamp + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: finalizers + type: + list: + elementType: + scalar: string + elementRelationship: associative + - name: generateName + type: + scalar: string + - name: generation + type: + scalar: numeric + - name: labels + type: + map: + elementType: + scalar: string + - name: managedFields + type: + list: + elementType: + namedType: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: atomic + - name: name + type: + scalar: string + - name: namespace + type: + scalar: string + - name: ownerReferences + type: + list: + elementType: + namedType: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - uid + - name: resourceVersion + type: + scalar: string + - name: selfLink + type: + scalar: string + - name: uid + type: + scalar: string +- name: ObjectReference.v1.core.api.k8s.io + map: + fields: + - name: apiVersion + type: + scalar: string + - name: fieldPath + type: + scalar: string + - name: kind + type: + scalar: string + - name: name + type: + scalar: string + - name: namespace + type: + scalar: string + - name: resourceVersion + type: + scalar: string + - name: uid + type: + scalar: string + elementRelationship: atomic +- name: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: apiVersion + type: + scalar: string + default: "" + - name: blockOwnerDeletion + type: + scalar: boolean + - name: controller + type: + scalar: boolean + - name: kind + type: + scalar: string + default: "" + - name: name + type: + scalar: string + default: "" + - name: uid + type: + scalar: string + default: "" + elementRelationship: atomic +- name: RawExtension.runtime.pkg.apimachinery.k8s.io + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: Taint.v1.core.api.k8s.io + map: + fields: + - name: effect + type: + scalar: string + default: "" + - name: key + type: + scalar: string + default: "" + - name: timeAdded + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: value + type: + scalar: string +- name: Time.v1.meta.apis.pkg.apimachinery.k8s.io + scalar: untyped - name: com.github.openshift.api.machine.v1.AWSFailureDomain map: fields: @@ -102,7 +355,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -123,7 +376,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: selector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: state type: @@ -144,7 +397,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: associative keys: - type @@ -319,7 +572,7 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: lastTransitionTime type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: message type: scalar: string @@ -345,7 +598,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: lastUpdated type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: state type: scalar: string @@ -393,7 +646,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -414,7 +667,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -429,16 +682,16 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: maxUnhealthy type: - namedType: io.k8s.apimachinery.pkg.util.intstr.IntOrString + namedType: IntOrString.intstr.util.pkg.apimachinery.k8s.io - name: nodeStartupTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: remediationTemplate type: - namedType: io.k8s.api.core.v1.ObjectReference + namedType: ObjectReference.v1.core.api.k8s.io - name: selector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: unhealthyConditions type: @@ -478,7 +731,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -506,7 +759,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: selector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: template type: @@ -580,7 +833,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.api.core.v1.Taint + namedType: Taint.v1.core.api.k8s.io elementRelationship: atomic - name: com.github.openshift.api.machine.v1beta1.MachineStatus map: @@ -589,7 +842,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.api.core.v1.NodeAddress + namedType: NodeAddress.v1.core.api.k8s.io elementRelationship: atomic - name: authoritativeAPI type: @@ -613,16 +866,16 @@ var schemaYAML = typed.YAMLObject(`types: namedType: com.github.openshift.api.machine.v1beta1.LastOperation - name: lastUpdated type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: nodeRef type: - namedType: io.k8s.api.core.v1.ObjectReference + namedType: ObjectReference.v1.core.api.k8s.io - name: phase type: scalar: string - name: providerStatus type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: synchronizedAPI type: scalar: string @@ -666,7 +919,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference + namedType: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: associative keys: - uid @@ -675,7 +928,7 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: value type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.machine.v1beta1.UnhealthyCondition map: fields: @@ -685,264 +938,11 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: timeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: type type: scalar: string default: "" -- name: io.k8s.api.core.v1.NodeAddress - map: - fields: - - name: address - type: - scalar: string - default: "" - - name: type - type: - scalar: string - default: "" -- name: io.k8s.api.core.v1.ObjectReference - map: - fields: - - name: apiVersion - type: - scalar: string - - name: fieldPath - type: - scalar: string - - name: kind - type: - scalar: string - - name: name - type: - scalar: string - - name: namespace - type: - scalar: string - - name: resourceVersion - type: - scalar: string - - name: uid - type: - scalar: string - elementRelationship: atomic -- name: io.k8s.api.core.v1.Taint - map: - fields: - - name: effect - type: - scalar: string - default: "" - - name: key - type: - scalar: string - default: "" - - name: timeAdded - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: value - type: - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - map: - fields: - - name: lastTransitionTime - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: message - type: - scalar: string - default: "" - - name: observedGeneration - type: - scalar: numeric - - name: reason - type: - scalar: string - default: "" - - name: status - type: - scalar: string - default: "" - - name: type - type: - scalar: string - default: "" -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Duration - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector - map: - fields: - - name: matchExpressions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement - elementRelationship: atomic - - name: matchLabels - type: - map: - elementType: - scalar: string - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement - map: - fields: - - name: key - type: - scalar: string - default: "" - - name: operator - type: - scalar: string - default: "" - - name: values - type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry - map: - fields: - - name: apiVersion - type: - scalar: string - - name: fieldsType - type: - scalar: string - - name: fieldsV1 - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 - - name: manager - type: - scalar: string - - name: operation - type: - scalar: string - - name: subresource - type: - scalar: string - - name: time - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - map: - fields: - - name: annotations - type: - map: - elementType: - scalar: string - - name: creationTimestamp - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: deletionGracePeriodSeconds - type: - scalar: numeric - - name: deletionTimestamp - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: finalizers - type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: generateName - type: - scalar: string - - name: generation - type: - scalar: numeric - - name: labels - type: - map: - elementType: - scalar: string - - name: managedFields - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry - elementRelationship: atomic - - name: name - type: - scalar: string - - name: namespace - type: - scalar: string - - name: ownerReferences - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference - elementRelationship: associative - keys: - - uid - - name: resourceVersion - type: - scalar: string - - name: selfLink - type: - scalar: string - - name: uid - type: - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference - map: - fields: - - name: apiVersion - type: - scalar: string - default: "" - - name: blockOwnerDeletion - type: - scalar: boolean - - name: controller - type: - scalar: boolean - - name: kind - type: - scalar: string - default: "" - - name: name - type: - scalar: string - default: "" - - name: uid - type: - scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Time - scalar: untyped -- name: io.k8s.apimachinery.pkg.runtime.RawExtension - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: io.k8s.apimachinery.pkg.util.intstr.IntOrString - scalar: untyped - name: __untyped_atomic_ scalar: untyped list: diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go index 13bc4fc94f..d0c1a503e2 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go @@ -23,61 +23,63 @@ func Parser() *typed.Parser { var parserOnce sync.Once var parser *typed.Parser var schemaYAML = typed.YAMLObject(`types: -- name: com.github.openshift.api.config.v1.ConfigMapFileReference +- name: Condition.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: key + - name: lastTransitionTime + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: message type: scalar: string - - name: name + default: "" + - name: observedGeneration + type: + scalar: numeric + - name: reason type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.ConfigMapNameReference - map: - fields: - - name: name + - name: status type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.CustomTLSProfile + - name: type + type: + scalar: string + default: "" +- name: Duration.v1.meta.apis.pkg.apimachinery.k8s.io + scalar: string +- name: FieldSelectorAttributes.v1.authorization.api.k8s.io map: fields: - - name: ciphers + - name: rawSelector + type: + scalar: string + - name: requirements type: list: elementType: - scalar: string + namedType: FieldSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic - - name: minTLSVersion +- name: FieldSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: key type: scalar: string default: "" -- name: com.github.openshift.api.config.v1.IntermediateTLSProfile - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.ModernTLSProfile - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: com.github.openshift.api.config.v1.OldTLSProfile + - name: operator + type: + scalar: string + default: "" + - name: values + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io map: elementType: scalar: untyped @@ -89,191 +91,484 @@ var schemaYAML = typed.YAMLObject(`types: elementType: namedType: __untyped_deduced_ elementRelationship: separable -- name: com.github.openshift.api.config.v1.SecretNameReference - map: - fields: - - name: name - type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.TLSProfileSpec +- name: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: ciphers + - name: matchExpressions type: list: elementType: - scalar: string + namedType: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic - - name: minTLSVersion + - name: matchLabels type: - scalar: string - default: "" -- name: com.github.openshift.api.config.v1.TLSSecurityProfile + map: + elementType: + scalar: string + elementRelationship: atomic +- name: LabelSelectorAttributes.v1.authorization.api.k8s.io map: fields: - - name: custom - type: - namedType: com.github.openshift.api.config.v1.CustomTLSProfile - - name: intermediate - type: - namedType: com.github.openshift.api.config.v1.IntermediateTLSProfile - - name: modern - type: - namedType: com.github.openshift.api.config.v1.ModernTLSProfile - - name: old - type: - namedType: com.github.openshift.api.config.v1.OldTLSProfile - - name: type + - name: rawSelector type: scalar: string - default: "" - unions: - - discriminator: type - fields: - - fieldName: custom - discriminatorValue: Custom - - fieldName: intermediate - discriminatorValue: Intermediate - - fieldName: modern - discriminatorValue: Modern - - fieldName: old - discriminatorValue: Old -- name: com.github.openshift.api.operator.v1.AWSCSIDriverConfigSpec + - name: requirements + type: + list: + elementType: + namedType: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: atomic +- name: LabelSelectorRequirement.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: efsVolumeMetrics - type: - namedType: com.github.openshift.api.operator.v1.AWSEFSVolumeMetrics - - name: kmsKeyARN + - name: key type: scalar: string -- name: com.github.openshift.api.operator.v1.AWSClassicLoadBalancerParameters - map: - fields: - - name: connectionIdleTimeout + default: "" + - name: operator type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration - - name: subnets + scalar: string + default: "" + - name: values type: - namedType: com.github.openshift.api.operator.v1.AWSSubnets -- name: com.github.openshift.api.operator.v1.AWSEFSVolumeMetrics + list: + elementType: + scalar: string + elementRelationship: atomic +- name: LocalObjectReference.v1.core.api.k8s.io map: fields: - - name: recursiveWalk - type: - namedType: com.github.openshift.api.operator.v1.AWSEFSVolumeMetricsRecursiveWalkConfig - - name: state + - name: name type: scalar: string default: "" - unions: - - discriminator: state - fields: - - fieldName: recursiveWalk - discriminatorValue: RecursiveWalk -- name: com.github.openshift.api.operator.v1.AWSEFSVolumeMetricsRecursiveWalkConfig + elementRelationship: atomic +- name: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: fsRateLimit + - name: apiVersion type: - scalar: numeric - - name: refreshPeriodMinutes + scalar: string + - name: fieldsType type: - scalar: numeric -- name: com.github.openshift.api.operator.v1.AWSLoadBalancerParameters - map: - fields: - - name: classicLoadBalancer + scalar: string + - name: fieldsV1 type: - namedType: com.github.openshift.api.operator.v1.AWSClassicLoadBalancerParameters - - name: networkLoadBalancer + namedType: FieldsV1.v1.meta.apis.pkg.apimachinery.k8s.io + - name: manager type: - namedType: com.github.openshift.api.operator.v1.AWSNetworkLoadBalancerParameters - - name: type + scalar: string + - name: operation type: scalar: string - default: "" - unions: - - discriminator: type - fields: - - fieldName: classicLoadBalancer - discriminatorValue: ClassicLoadBalancerParameters - - fieldName: networkLoadBalancer - discriminatorValue: NetworkLoadBalancerParameters -- name: com.github.openshift.api.operator.v1.AWSNetworkLoadBalancerParameters + - name: subresource + type: + scalar: string + - name: time + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io +- name: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io map: fields: - - name: eipAllocations + - name: annotations type: - list: + map: elementType: scalar: string - elementRelationship: atomic - - name: subnets + - name: creationTimestamp type: - namedType: com.github.openshift.api.operator.v1.AWSSubnets -- name: com.github.openshift.api.operator.v1.AWSSubnets - map: - fields: - - name: ids + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: deletionGracePeriodSeconds + type: + scalar: numeric + - name: deletionTimestamp + type: + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io + - name: finalizers type: list: elementType: scalar: string - elementRelationship: atomic - - name: names + elementRelationship: associative + - name: generateName type: - list: + scalar: string + - name: generation + type: + scalar: numeric + - name: labels + type: + map: elementType: scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.operator.v1.AccessLogging - map: - fields: - - name: destination - type: - namedType: com.github.openshift.api.operator.v1.LoggingDestination - default: {} - - name: httpCaptureCookies + - name: managedFields type: list: elementType: - namedType: com.github.openshift.api.operator.v1.IngressControllerCaptureHTTPCookie + namedType: ManagedFieldsEntry.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic - - name: httpCaptureHeaders - type: - namedType: com.github.openshift.api.operator.v1.IngressControllerCaptureHTTPHeaders - default: {} - - name: httpLogFormat + - name: name type: scalar: string - - name: logEmptyRequests + - name: namespace type: scalar: string -- name: com.github.openshift.api.operator.v1.AddPage - map: - fields: - - name: disabledActions + - name: ownerReferences type: list: elementType: - scalar: string - elementRelationship: atomic -- name: com.github.openshift.api.operator.v1.AdditionalNetworkDefinition - map: - fields: - - name: name + namedType: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - uid + - name: resourceVersion type: scalar: string - default: "" - - name: namespace + - name: selfLink type: scalar: string - - name: rawCNIConfig + - name: uid type: scalar: string - - name: simpleMacvlanConfig +- name: OwnerReference.v1.meta.apis.pkg.apimachinery.k8s.io + map: + fields: + - name: apiVersion + type: + scalar: string + default: "" + - name: blockOwnerDeletion + type: + scalar: boolean + - name: controller + type: + scalar: boolean + - name: kind + type: + scalar: string + default: "" + - name: name + type: + scalar: string + default: "" + - name: uid + type: + scalar: string + default: "" + elementRelationship: atomic +- name: RawExtension.runtime.pkg.apimachinery.k8s.io + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: ResourceAttributes.v1.authorization.api.k8s.io + map: + fields: + - name: fieldSelector + type: + namedType: FieldSelectorAttributes.v1.authorization.api.k8s.io + - name: group + type: + scalar: string + - name: labelSelector + type: + namedType: LabelSelectorAttributes.v1.authorization.api.k8s.io + - name: name + type: + scalar: string + - name: namespace + type: + scalar: string + - name: resource + type: + scalar: string + - name: subresource + type: + scalar: string + - name: verb + type: + scalar: string + - name: version + type: + scalar: string +- name: Time.v1.meta.apis.pkg.apimachinery.k8s.io + scalar: untyped +- name: Toleration.v1.core.api.k8s.io + map: + fields: + - name: effect + type: + scalar: string + - name: key + type: + scalar: string + - name: operator + type: + scalar: string + - name: tolerationSeconds + type: + scalar: numeric + - name: value + type: + scalar: string +- name: com.github.openshift.api.config.v1.ConfigMapFileReference + map: + fields: + - name: key + type: + scalar: string + - name: name + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.ConfigMapNameReference + map: + fields: + - name: name + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.CustomTLSProfile + map: + fields: + - name: ciphers + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: minTLSVersion + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.IntermediateTLSProfile + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.ModernTLSProfile + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.OldTLSProfile + map: + elementType: + scalar: untyped + list: + elementType: + namedType: __untyped_atomic_ + elementRelationship: atomic + map: + elementType: + namedType: __untyped_deduced_ + elementRelationship: separable +- name: com.github.openshift.api.config.v1.SecretNameReference + map: + fields: + - name: name + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.TLSProfileSpec + map: + fields: + - name: ciphers + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: minTLSVersion + type: + scalar: string + default: "" +- name: com.github.openshift.api.config.v1.TLSSecurityProfile + map: + fields: + - name: custom + type: + namedType: com.github.openshift.api.config.v1.CustomTLSProfile + - name: intermediate + type: + namedType: com.github.openshift.api.config.v1.IntermediateTLSProfile + - name: modern + type: + namedType: com.github.openshift.api.config.v1.ModernTLSProfile + - name: old + type: + namedType: com.github.openshift.api.config.v1.OldTLSProfile + - name: type + type: + scalar: string + default: "" + unions: + - discriminator: type + fields: + - fieldName: custom + discriminatorValue: Custom + - fieldName: intermediate + discriminatorValue: Intermediate + - fieldName: modern + discriminatorValue: Modern + - fieldName: old + discriminatorValue: Old +- name: com.github.openshift.api.operator.v1.AWSCSIDriverConfigSpec + map: + fields: + - name: efsVolumeMetrics + type: + namedType: com.github.openshift.api.operator.v1.AWSEFSVolumeMetrics + - name: kmsKeyARN + type: + scalar: string +- name: com.github.openshift.api.operator.v1.AWSClassicLoadBalancerParameters + map: + fields: + - name: connectionIdleTimeout + type: + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io + - name: subnets + type: + namedType: com.github.openshift.api.operator.v1.AWSSubnets +- name: com.github.openshift.api.operator.v1.AWSEFSVolumeMetrics + map: + fields: + - name: recursiveWalk + type: + namedType: com.github.openshift.api.operator.v1.AWSEFSVolumeMetricsRecursiveWalkConfig + - name: state + type: + scalar: string + default: "" + unions: + - discriminator: state + fields: + - fieldName: recursiveWalk + discriminatorValue: RecursiveWalk +- name: com.github.openshift.api.operator.v1.AWSEFSVolumeMetricsRecursiveWalkConfig + map: + fields: + - name: fsRateLimit + type: + scalar: numeric + - name: refreshPeriodMinutes + type: + scalar: numeric +- name: com.github.openshift.api.operator.v1.AWSLoadBalancerParameters + map: + fields: + - name: classicLoadBalancer + type: + namedType: com.github.openshift.api.operator.v1.AWSClassicLoadBalancerParameters + - name: networkLoadBalancer + type: + namedType: com.github.openshift.api.operator.v1.AWSNetworkLoadBalancerParameters + - name: type + type: + scalar: string + default: "" + unions: + - discriminator: type + fields: + - fieldName: classicLoadBalancer + discriminatorValue: ClassicLoadBalancerParameters + - fieldName: networkLoadBalancer + discriminatorValue: NetworkLoadBalancerParameters +- name: com.github.openshift.api.operator.v1.AWSNetworkLoadBalancerParameters + map: + fields: + - name: eipAllocations + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: subnets + type: + namedType: com.github.openshift.api.operator.v1.AWSSubnets +- name: com.github.openshift.api.operator.v1.AWSSubnets + map: + fields: + - name: ids + type: + list: + elementType: + scalar: string + elementRelationship: atomic + - name: names + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.operator.v1.AccessLogging + map: + fields: + - name: destination + type: + namedType: com.github.openshift.api.operator.v1.LoggingDestination + default: {} + - name: httpCaptureCookies + type: + list: + elementType: + namedType: com.github.openshift.api.operator.v1.IngressControllerCaptureHTTPCookie + elementRelationship: atomic + - name: httpCaptureHeaders + type: + namedType: com.github.openshift.api.operator.v1.IngressControllerCaptureHTTPHeaders + default: {} + - name: httpLogFormat + type: + scalar: string + - name: logEmptyRequests + type: + scalar: string +- name: com.github.openshift.api.operator.v1.AddPage + map: + fields: + - name: disabledActions + type: + list: + elementType: + scalar: string + elementRelationship: atomic +- name: com.github.openshift.api.operator.v1.AdditionalNetworkDefinition + map: + fields: + - name: name + type: + scalar: string + default: "" + - name: namespace + type: + scalar: string + - name: rawCNIConfig + type: + scalar: string + - name: simpleMacvlanConfig type: namedType: com.github.openshift.api.operator.v1.SimpleMacvlanConfig - name: type @@ -300,7 +595,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -322,13 +617,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.AuthenticationStatus map: fields: @@ -389,6 +684,16 @@ var schemaYAML = typed.YAMLObject(`types: type: scalar: string default: "" +- name: com.github.openshift.api.operator.v1.BGPManagedConfig + map: + fields: + - name: asNumber + type: + scalar: numeric + default: 64512 + - name: bgpTopology + type: + scalar: string - name: com.github.openshift.api.operator.v1.BootImageSkewEnforcementConfig map: fields: @@ -471,7 +776,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -493,13 +798,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.CSISnapshotControllerStatus map: fields: @@ -583,7 +888,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -608,13 +913,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.CloudCredentialStatus map: fields: @@ -689,7 +994,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -715,7 +1020,7 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -724,7 +1029,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.ClusterCSIDriverStatus map: fields: @@ -781,7 +1086,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -814,13 +1119,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.ConfigStatus map: fields: @@ -867,7 +1172,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -970,7 +1275,7 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -990,7 +1295,7 @@ var schemaYAML = typed.YAMLObject(`types: default: {} - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.ConsoleStatus map: fields: @@ -1043,7 +1348,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -1058,10 +1363,10 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: negativeTTL type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: positiveTTL type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.DNSNodePlacement map: fields: @@ -1074,7 +1379,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + namedType: Toleration.v1.core.api.k8s.io elementRelationship: atomic - name: com.github.openshift.api.operator.v1.DNSOverTLSConfig map: @@ -1289,7 +1594,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -1326,7 +1631,7 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -1335,7 +1640,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.EtcdStatus map: fields: @@ -1498,10 +1803,10 @@ var schemaYAML = typed.YAMLObject(`types: elementRelationship: atomic - name: lastGatherDuration type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: lastGatherTime type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.GathererStatus map: fields: @@ -1509,11 +1814,11 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: atomic - name: lastGatherDuration type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: name type: scalar: string @@ -1704,7 +2009,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -1866,7 +2171,7 @@ var schemaYAML = typed.YAMLObject(`types: default: Continue - name: defaultCertificate type: - namedType: io.k8s.api.core.v1.LocalObjectReference + namedType: LocalObjectReference.v1.core.api.k8s.io - name: domain type: scalar: string @@ -1896,7 +2201,7 @@ var schemaYAML = typed.YAMLObject(`types: namedType: com.github.openshift.api.operator.v1.IngressControllerLogging - name: namespaceSelector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io - name: nodePlacement type: namedType: com.github.openshift.api.operator.v1.NodePlacement @@ -1908,7 +2213,7 @@ var schemaYAML = typed.YAMLObject(`types: namedType: com.github.openshift.api.operator.v1.RouteAdmissionPolicy - name: routeSelector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io - name: tlsSecurityProfile type: namedType: com.github.openshift.api.config.v1.TLSSecurityProfile @@ -1918,7 +2223,7 @@ var schemaYAML = typed.YAMLObject(`types: default: {} - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.IngressControllerStatus map: fields: @@ -1943,13 +2248,13 @@ var schemaYAML = typed.YAMLObject(`types: namedType: com.github.openshift.api.operator.v1.EndpointPublishingStrategy - name: namespaceSelector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io - name: observedGeneration type: scalar: numeric - name: routeSelector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io - name: selector type: scalar: string @@ -1962,13 +2267,16 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: clientFinTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: clientTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io + - name: configurationManagement + type: + scalar: string - name: connectTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: headerBufferBytes type: scalar: numeric @@ -1977,31 +2285,31 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: healthCheckInterval type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: httpKeepAliveTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: maxConnections type: scalar: numeric - name: reloadInterval type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: serverFinTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: serverTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: threadCount type: scalar: numeric - name: tlsInspectDelay type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: tunnelTimeout type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration + namedType: Duration.v1.meta.apis.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.InsightsOperator map: fields: @@ -2013,7 +2321,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2035,13 +2343,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.InsightsOperatorStatus map: fields: @@ -2090,7 +2398,7 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: downloadedAt type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: healthChecks type: list: @@ -2117,7 +2425,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2149,7 +2457,7 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -2158,7 +2466,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.KubeAPIServerStatus map: fields: @@ -2222,7 +2530,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2251,7 +2559,7 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -2260,7 +2568,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: useMoreSecureServiceCA type: scalar: boolean @@ -2322,7 +2630,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2351,7 +2659,7 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -2360,7 +2668,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.KubeSchedulerStatus map: fields: @@ -2418,7 +2726,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2440,13 +2748,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.KubeStorageVersionMigratorStatus map: fields: @@ -2566,7 +2874,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2611,7 +2919,7 @@ var schemaYAML = typed.YAMLObject(`types: default: {} - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -2620,7 +2928,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: numeric - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.MachineConfigurationStatus map: fields: @@ -2632,7 +2940,7 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io elementRelationship: associative keys: - type @@ -2709,7 +3017,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -2786,7 +3094,7 @@ var schemaYAML = typed.YAMLObject(`types: namedType: com.github.openshift.api.operator.v1.NetworkMigration - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string @@ -2798,7 +3106,7 @@ var schemaYAML = typed.YAMLObject(`types: elementRelationship: atomic - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: useMultiNetworkPolicy type: scalar: boolean @@ -2837,6 +3145,15 @@ var schemaYAML = typed.YAMLObject(`types: - name: version type: scalar: string +- name: com.github.openshift.api.operator.v1.NoOverlayConfig + map: + fields: + - name: outboundSNAT + type: + scalar: string + - name: routing + type: + scalar: string - name: com.github.openshift.api.operator.v1.NodeDisruptionPolicyClusterStatus map: fields: @@ -3005,12 +3322,12 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: nodeSelector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io - name: tolerations type: list: elementType: - namedType: io.k8s.api.core.v1.Toleration + namedType: Toleration.v1.core.api.k8s.io elementRelationship: atomic - name: com.github.openshift.api.operator.v1.NodePortStrategy map: @@ -3041,7 +3358,7 @@ var schemaYAML = typed.YAMLObject(`types: elementRelationship: atomic - name: lastFailedTime type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: lastFallbackCount type: scalar: numeric @@ -3069,7 +3386,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3091,13 +3408,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.OLMStatus map: fields: @@ -3136,6 +3453,10 @@ var schemaYAML = typed.YAMLObject(`types: - name: com.github.openshift.api.operator.v1.OVNKubernetesConfig map: fields: + - name: bgpManagedConfig + type: + namedType: com.github.openshift.api.operator.v1.BGPManagedConfig + default: {} - name: egressIPConfig type: namedType: com.github.openshift.api.operator.v1.EgressIPConfig @@ -3163,12 +3484,19 @@ var schemaYAML = typed.YAMLObject(`types: - name: mtu type: scalar: numeric + - name: noOverlayConfig + type: + namedType: com.github.openshift.api.operator.v1.NoOverlayConfig + default: {} - name: policyAuditConfig type: namedType: com.github.openshift.api.operator.v1.PolicyAuditConfig - name: routeAdvertisements type: scalar: string + - name: transport + type: + scalar: string - name: v4InternalSubnet type: scalar: string @@ -3186,7 +3514,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3208,13 +3536,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.OpenShiftAPIServerStatus map: fields: @@ -3261,7 +3589,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3283,13 +3611,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.OpenShiftControllerManagerStatus map: fields: @@ -3355,7 +3683,7 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: lastTransitionTime type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: message type: scalar: string @@ -3375,7 +3703,7 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: machineResourceSelector type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector + namedType: LabelSelector.v1.meta.apis.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.Perspective map: fields: @@ -3526,13 +3854,13 @@ var schemaYAML = typed.YAMLObject(`types: type: list: elementType: - namedType: io.k8s.api.authorization.v1.ResourceAttributes + namedType: ResourceAttributes.v1.authorization.api.k8s.io elementRelationship: atomic - name: required type: list: elementType: - namedType: io.k8s.api.authorization.v1.ResourceAttributes + namedType: ResourceAttributes.v1.authorization.api.k8s.io elementRelationship: atomic - name: com.github.openshift.api.operator.v1.RestartService map: @@ -3581,7 +3909,7 @@ var schemaYAML = typed.YAMLObject(`types: fields: - name: expirationTime type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time + namedType: Time.v1.meta.apis.pkg.apimachinery.k8s.io - name: name type: scalar: string @@ -3597,7 +3925,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3619,13 +3947,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.ServiceCAStatus map: fields: @@ -3672,7 +4000,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3694,13 +4022,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.ServiceCatalogAPIServerStatus map: fields: @@ -3747,7 +4075,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3769,13 +4097,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: com.github.openshift.api.operator.v1.ServiceCatalogControllerManagerStatus map: fields: @@ -3900,7 +4228,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -3922,13 +4250,13 @@ var schemaYAML = typed.YAMLObject(`types: default: "" - name: observedConfig type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: operatorLogLevel type: scalar: string - name: unsupportedConfigOverrides type: - namedType: __untyped_atomic_ + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io - name: vsphereStorageDriver type: scalar: string @@ -4072,7 +4400,7 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string - name: metadata type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io default: {} - name: spec type: @@ -4088,6 +4416,9 @@ var schemaYAML = typed.YAMLObject(`types: type: namedType: com.github.openshift.api.operator.v1alpha1.ClusterAPIInstallerComponentImage default: {} + - name: name + type: + scalar: string - name: type type: scalar: string @@ -4117,6 +4448,12 @@ var schemaYAML = typed.YAMLObject(`types: - name: contentID type: scalar: string + - name: manifestSubstitutions + type: + list: + elementType: + namedType: com.github.openshift.api.operator.v1alpha1.ClusterAPIInstallerRevisionManifestSubstitution + elementRelationship: atomic - name: name type: scalar: string @@ -4130,514 +4467,231 @@ var schemaYAML = typed.YAMLObject(`types: scalar: string elementRelationship: atomic elementRelationship: atomic -- name: com.github.openshift.api.operator.v1alpha1.ClusterAPISpec - map: - fields: - - name: unmanagedCustomResourceDefinitions - type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.operator.v1alpha1.ClusterAPIStatus - map: - fields: - - name: currentRevision - type: - scalar: string - - name: desiredRevision - type: - scalar: string - - name: revisions - type: - list: - elementType: - namedType: com.github.openshift.api.operator.v1alpha1.ClusterAPIInstallerRevision - elementRelationship: atomic -- name: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperator - map: - fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorSpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorStatus - default: {} -- name: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorSpec - map: - fields: - - name: operatorLogLevel - type: - scalar: string -- name: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorStatus - map: - fields: - - name: observedGeneration - type: - scalar: numeric -- name: com.github.openshift.api.operator.v1alpha1.EtcdBackup - map: - fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.operator.v1alpha1.EtcdBackupSpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.operator.v1alpha1.EtcdBackupStatus - default: {} -- name: com.github.openshift.api.operator.v1alpha1.EtcdBackupSpec - map: - fields: - - name: pvcName - type: - scalar: string - default: "" -- name: com.github.openshift.api.operator.v1alpha1.EtcdBackupStatus - map: - fields: - - name: backupJob - type: - namedType: com.github.openshift.api.operator.v1alpha1.BackupJobReference - - name: conditions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type -- name: com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicy - map: - fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicySpec - default: {} -- name: com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicySpec +- name: com.github.openshift.api.operator.v1alpha1.ClusterAPIInstallerRevisionManifestSubstitution map: fields: - - name: repositoryDigestMirrors - type: - list: - elementType: - namedType: com.github.openshift.api.operator.v1alpha1.RepositoryDigestMirrors - elementRelationship: atomic -- name: com.github.openshift.api.operator.v1alpha1.OLM - map: - fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.operator.v1alpha1.OLMSpec - default: {} - - name: status - type: - namedType: com.github.openshift.api.operator.v1alpha1.OLMStatus - default: {} -- name: com.github.openshift.api.operator.v1alpha1.OLMSpec - map: - fields: - - name: logLevel - type: - scalar: string - - name: managementState - type: - scalar: string - default: "" - - name: observedConfig - type: - namedType: __untyped_atomic_ - - name: operatorLogLevel + - name: key type: scalar: string - - name: unsupportedConfigOverrides - type: - namedType: __untyped_atomic_ -- name: com.github.openshift.api.operator.v1alpha1.OLMStatus - map: - fields: - - name: conditions - type: - list: - elementType: - namedType: com.github.openshift.api.operator.v1.OperatorCondition - elementRelationship: associative - keys: - - type - - name: generations - type: - list: - elementType: - namedType: com.github.openshift.api.operator.v1.GenerationStatus - elementRelationship: associative - keys: - - group - - resource - - namespace - - name - - name: latestAvailableRevision - type: - scalar: numeric - - name: observedGeneration - type: - scalar: numeric - - name: readyReplicas - type: - scalar: numeric - default: 0 - - name: version + - name: value type: scalar: string -- name: com.github.openshift.api.operator.v1alpha1.RepositoryDigestMirrors +- name: com.github.openshift.api.operator.v1alpha1.ClusterAPISpec map: fields: - - name: mirrors + - name: unmanagedCustomResourceDefinitions type: list: elementType: scalar: string - elementRelationship: atomic - - name: source - type: - scalar: string - default: "" -- name: io.k8s.api.authorization.v1.FieldSelectorAttributes - map: - fields: - - name: rawSelector - type: - scalar: string - - name: requirements - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldSelectorRequirement - elementRelationship: atomic -- name: io.k8s.api.authorization.v1.LabelSelectorAttributes - map: - fields: - - name: rawSelector - type: - scalar: string - - name: requirements - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement - elementRelationship: atomic -- name: io.k8s.api.authorization.v1.ResourceAttributes + elementRelationship: associative +- name: com.github.openshift.api.operator.v1alpha1.ClusterAPIStatus map: fields: - - name: fieldSelector - type: - namedType: io.k8s.api.authorization.v1.FieldSelectorAttributes - - name: group - type: - scalar: string - - name: labelSelector - type: - namedType: io.k8s.api.authorization.v1.LabelSelectorAttributes - - name: name - type: - scalar: string - - name: namespace - type: - scalar: string - - name: resource - type: - scalar: string - - name: subresource - type: - scalar: string - - name: verb + - name: currentRevision type: scalar: string - - name: version + - name: desiredRevision type: scalar: string -- name: io.k8s.api.core.v1.LocalObjectReference - map: - fields: - - name: name + - name: observedRevisionGeneration type: - scalar: string - default: "" - elementRelationship: atomic -- name: io.k8s.api.core.v1.Toleration + scalar: numeric + - name: revisions + type: + list: + elementType: + namedType: com.github.openshift.api.operator.v1alpha1.ClusterAPIInstallerRevision + elementRelationship: atomic +- name: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperator map: fields: - - name: effect + - name: apiVersion type: scalar: string - - name: key + - name: kind type: scalar: string - - name: operator + - name: metadata type: - scalar: string - - name: tolerationSeconds + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - scalar: numeric - - name: value + namedType: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorSpec + default: {} + - name: status type: - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + namedType: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorStatus + default: {} +- name: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorSpec map: fields: - - name: lastTransitionTime - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: message + - name: operatorLogLevel type: scalar: string - default: "" +- name: com.github.openshift.api.operator.v1alpha1.ClusterVersionOperatorStatus + map: + fields: - name: observedGeneration type: scalar: numeric - - name: reason +- name: com.github.openshift.api.operator.v1alpha1.EtcdBackup + map: + fields: + - name: apiVersion type: scalar: string - default: "" - - name: status + - name: kind type: scalar: string - default: "" - - name: type + - name: metadata type: - scalar: string - default: "" -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Duration - scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldSelectorRequirement + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.operator.v1alpha1.EtcdBackupSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.operator.v1alpha1.EtcdBackupStatus + default: {} +- name: com.github.openshift.api.operator.v1alpha1.EtcdBackupSpec map: fields: - - name: key - type: - scalar: string - default: "" - - name: operator + - name: pvcName type: scalar: string default: "" - - name: values - type: - list: - elementType: - scalar: string - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector +- name: com.github.openshift.api.operator.v1alpha1.EtcdBackupStatus map: fields: - - name: matchExpressions + - name: backupJob type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement - elementRelationship: atomic - - name: matchLabels + namedType: com.github.openshift.api.operator.v1alpha1.BackupJobReference + - name: conditions type: - map: + list: elementType: - scalar: string - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement + namedType: Condition.v1.meta.apis.pkg.apimachinery.k8s.io + elementRelationship: associative + keys: + - type +- name: com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicy map: fields: - - name: key + - name: apiVersion type: scalar: string - default: "" - - name: operator + - name: kind type: scalar: string - default: "" - - name: values + - name: metadata + type: + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec + type: + namedType: com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicySpec + default: {} +- name: com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicySpec + map: + fields: + - name: repositoryDigestMirrors type: list: elementType: - scalar: string + namedType: com.github.openshift.api.operator.v1alpha1.RepositoryDigestMirrors elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry +- name: com.github.openshift.api.operator.v1alpha1.OLM map: fields: - name: apiVersion type: scalar: string - - name: fieldsType - type: - scalar: string - - name: fieldsV1 - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1 - - name: manager + - name: kind type: scalar: string - - name: operation + - name: metadata type: - scalar: string - - name: subresource + namedType: ObjectMeta.v1.meta.apis.pkg.apimachinery.k8s.io + default: {} + - name: spec type: - scalar: string - - name: time + namedType: com.github.openshift.api.operator.v1alpha1.OLMSpec + default: {} + - name: status type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time -- name: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + namedType: com.github.openshift.api.operator.v1alpha1.OLMStatus + default: {} +- name: com.github.openshift.api.operator.v1alpha1.OLMSpec map: fields: - - name: annotations - type: - map: - elementType: - scalar: string - - name: creationTimestamp - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: deletionGracePeriodSeconds + - name: logLevel type: - scalar: numeric - - name: deletionTimestamp + scalar: string + - name: managementState type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time - - name: finalizers + scalar: string + default: "" + - name: observedConfig type: - list: - elementType: - scalar: string - elementRelationship: associative - - name: generateName + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io + - name: operatorLogLevel type: scalar: string - - name: generation - type: - scalar: numeric - - name: labels + - name: unsupportedConfigOverrides type: - map: - elementType: - scalar: string - - name: managedFields + namedType: RawExtension.runtime.pkg.apimachinery.k8s.io +- name: com.github.openshift.api.operator.v1alpha1.OLMStatus + map: + fields: + - name: conditions type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry - elementRelationship: atomic - - name: name - type: - scalar: string - - name: namespace - type: - scalar: string - - name: ownerReferences + namedType: com.github.openshift.api.operator.v1.OperatorCondition + elementRelationship: associative + keys: + - type + - name: generations type: list: elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference + namedType: com.github.openshift.api.operator.v1.GenerationStatus elementRelationship: associative keys: - - uid - - name: resourceVersion + - group + - resource + - namespace + - name + - name: latestAvailableRevision type: - scalar: string - - name: selfLink + scalar: numeric + - name: observedGeneration type: - scalar: string - - name: uid + scalar: numeric + - name: readyReplicas + type: + scalar: numeric + default: 0 + - name: version type: scalar: string -- name: io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference +- name: com.github.openshift.api.operator.v1alpha1.RepositoryDigestMirrors map: fields: - - name: apiVersion - type: - scalar: string - default: "" - - name: blockOwnerDeletion - type: - scalar: boolean - - name: controller - type: - scalar: boolean - - name: kind - type: - scalar: string - default: "" - - name: name + - name: mirrors type: - scalar: string - default: "" - - name: uid + list: + elementType: + scalar: string + elementRelationship: atomic + - name: source type: scalar: string default: "" - elementRelationship: atomic -- name: io.k8s.apimachinery.pkg.apis.meta.v1.Time - scalar: untyped -- name: io.k8s.apimachinery.pkg.runtime.RawExtension - map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable - name: __untyped_atomic_ scalar: untyped list: diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.go index 9274b84ad6..f527a9312a 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awscsidriverconfigspec.go @@ -10,6 +10,12 @@ type AWSCSIDriverConfigSpecApplyConfiguration struct { // kmsKeyARN sets the cluster default storage class to encrypt volumes with a user-defined KMS key, // rather than the default KMS key used by AWS. // The value may be either the ARN or Alias ARN of a KMS key. + // + // The ARN must follow the format: arn::kms:::(key|alias)/, where: + // is the AWS partition (aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f, or aws-eusc), + // is the AWS region, + // is a 12-digit numeric identifier for the AWS account, + // is the KMS key ID or alias name. KMSKeyARN *string `json:"kmsKeyARN,omitempty"` // efsVolumeMetrics sets the configuration for collecting metrics from EFS volumes used by the EFS CSI Driver. EFSVolumeMetrics *AWSEFSVolumeMetricsApplyConfiguration `json:"efsVolumeMetrics,omitempty"` diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/bgpmanagedconfig.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/bgpmanagedconfig.go new file mode 100644 index 0000000000..071ac3fc23 --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/bgpmanagedconfig.go @@ -0,0 +1,46 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + operatorv1 "github.com/openshift/api/operator/v1" +) + +// BGPManagedConfigApplyConfiguration represents a declarative configuration of the BGPManagedConfig type for use +// with apply. +// +// BGPManagedConfig contains configuration options for BGP when routing is "Managed". +type BGPManagedConfigApplyConfiguration struct { + // asNumber is the 2-byte or 4-byte Autonomous System Number (ASN) + // to be used in the generated FRR configuration. + // Valid values are 1 to 4294967295. + // When omitted, this defaults to 64512. + ASNumber *int64 `json:"asNumber,omitempty"` + // bgpTopology defines the BGP topology to be used. + // Allowed values are "FullMesh". + // When set to "FullMesh", every node peers directly with every other node via BGP. + // This field is required when BGPManagedConfig is specified. + BGPTopology *operatorv1.BGPTopology `json:"bgpTopology,omitempty"` +} + +// BGPManagedConfigApplyConfiguration constructs a declarative configuration of the BGPManagedConfig type for use with +// apply. +func BGPManagedConfig() *BGPManagedConfigApplyConfiguration { + return &BGPManagedConfigApplyConfiguration{} +} + +// WithASNumber sets the ASNumber field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ASNumber field is set to the value of the last call. +func (b *BGPManagedConfigApplyConfiguration) WithASNumber(value int64) *BGPManagedConfigApplyConfiguration { + b.ASNumber = &value + return b +} + +// WithBGPTopology sets the BGPTopology field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BGPTopology field is set to the value of the last call. +func (b *BGPManagedConfigApplyConfiguration) WithBGPTopology(value operatorv1.BGPTopology) *BGPManagedConfigApplyConfiguration { + b.BGPTopology = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.go index 831ef5130e..d62c99282a 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollertuningoptions.go @@ -3,6 +3,7 @@ package v1 import ( + operatorv1 "github.com/openshift/api/operator/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) @@ -209,6 +210,32 @@ type IngressControllerTuningOptionsApplyConfiguration struct { // be reloaded less frequently, and newly created routes will not be served until the // subsequent reload. ReloadInterval *metav1.Duration `json:"reloadInterval,omitempty"` + // configurationManagement specifies how OpenShift router should update + // the HAProxy configuration. The following values are valid for this + // field: + // + // * "ForkAndReload". + // * "Dynamic". + // + // Omitting this field means that the user has no opinion and the + // platform may choose a reasonable default. This default is subject to + // change over time. The current default is "ForkAndReload". + // + // "ForkAndReload" means that OpenShift router should rewrite the + // HAProxy configuration file and instruct HAProxy to fork and reload. + // This is OpenShift router's traditional approach. + // + // "Dynamic" means that OpenShift router may use HAProxy's control + // socket for some configuration updates and fall back to fork and + // reload for other configuration updates. This is a newer approach, + // which may be less mature than ForkAndReload. This setting can + // improve load-balancing fairness and metrics accuracy and reduce CPU + // and memory usage if HAProxy has frequent configuration updates for + // route and endpoints updates. + // + // Note: The "Dynamic" option is currently experimental and should not + // be enabled on production clusters. + ConfigurationManagement *operatorv1.IngressControllerConfigurationManagement `json:"configurationManagement,omitempty"` } // IngressControllerTuningOptionsApplyConfiguration constructs a declarative configuration of the IngressControllerTuningOptions type for use with @@ -328,3 +355,11 @@ func (b *IngressControllerTuningOptionsApplyConfiguration) WithReloadInterval(va b.ReloadInterval = &value return b } + +// WithConfigurationManagement sets the ConfigurationManagement field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ConfigurationManagement field is set to the value of the last call. +func (b *IngressControllerTuningOptionsApplyConfiguration) WithConfigurationManagement(value operatorv1.IngressControllerConfigurationManagement) *IngressControllerTuningOptionsApplyConfiguration { + b.ConfigurationManagement = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/nooverlayconfig.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/nooverlayconfig.go new file mode 100644 index 0000000000..0feb3009ea --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/nooverlayconfig.go @@ -0,0 +1,50 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + operatorv1 "github.com/openshift/api/operator/v1" +) + +// NoOverlayConfigApplyConfiguration represents a declarative configuration of the NoOverlayConfig type for use +// with apply. +// +// NoOverlayConfig contains configuration options for networks operating in no-overlay mode. +type NoOverlayConfigApplyConfiguration struct { + // outboundSNAT defines the SNAT behavior for outbound traffic from pods. + // Allowed values are "Enabled" and "Disabled". + // When set to "Enabled", SNAT is performed on outbound traffic from pods. + // When set to "Disabled", SNAT is not performed and pod IPs are preserved in outbound traffic. + // This field is required when the network operates in no-overlay mode. + // This field can be set to any value at installation time and can be changed afterwards. + OutboundSNAT *operatorv1.SNATOption `json:"outboundSNAT,omitempty"` + // routing specifies whether the pod network routing is managed by OVN-Kubernetes or users. + // Allowed values are "Managed" and "Unmanaged". + // When set to "Managed", OVN-Kubernetes manages the pod network routing configuration through BGP. + // When set to "Unmanaged", users are responsible for configuring the pod network routing. + // This field is required when the network operates in no-overlay mode. + // This field is immutable once set. + Routing *operatorv1.RoutingOption `json:"routing,omitempty"` +} + +// NoOverlayConfigApplyConfiguration constructs a declarative configuration of the NoOverlayConfig type for use with +// apply. +func NoOverlayConfig() *NoOverlayConfigApplyConfiguration { + return &NoOverlayConfigApplyConfiguration{} +} + +// WithOutboundSNAT sets the OutboundSNAT field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the OutboundSNAT field is set to the value of the last call. +func (b *NoOverlayConfigApplyConfiguration) WithOutboundSNAT(value operatorv1.SNATOption) *NoOverlayConfigApplyConfiguration { + b.OutboundSNAT = &value + return b +} + +// WithRouting sets the Routing field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Routing field is set to the value of the last call. +func (b *NoOverlayConfigApplyConfiguration) WithRouting(value operatorv1.RoutingOption) *NoOverlayConfigApplyConfiguration { + b.Routing = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ovnkubernetesconfig.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ovnkubernetesconfig.go index 6a2d864421..ead45f83b5 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ovnkubernetesconfig.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ovnkubernetesconfig.go @@ -62,6 +62,27 @@ type OVNKubernetesConfigApplyConfiguration struct { // reasonable defaults. These defaults are subject to change over time. The // current default is "Disabled". RouteAdvertisements *operatorv1.RouteAdvertisementsEnablement `json:"routeAdvertisements,omitempty"` + // transport sets the transport mode for pods on the default network. + // Allowed values are "NoOverlay" and "Geneve". + // "NoOverlay" avoids tunnel encapsulation, routing pod traffic directly between nodes. + // "Geneve" encapsulates pod traffic using Geneve tunnels between nodes. + // When omitted, this means the user has no opinion and the platform chooses + // a reasonable default which is subject to change over time. + // The current default is "Geneve". + // "NoOverlay" can only be set at installation time and cannot be changed afterwards. + // "Geneve" may be set explicitly at any time to lock in the current default. + Transport *operatorv1.TransportOption `json:"transport,omitempty"` + // noOverlayConfig contains configuration for no-overlay mode. + // This configuration applies to the default network only. + // It is required when transport is "NoOverlay". + // When omitted, this means the user does not configure no-overlay mode options. + NoOverlayConfig *NoOverlayConfigApplyConfiguration `json:"noOverlayConfig,omitempty"` + // bgpManagedConfig configures the BGP properties for networks (default network or CUDNs) + // in no-overlay mode that specify routing="Managed" in their noOverlayConfig. + // It is required when noOverlayConfig.routing is set to "Managed". + // When omitted, this means the user does not configure BGP for managed routing. + // This field can be set at installation time or on day 2, and can be modified at any time. + BGPManagedConfig *BGPManagedConfigApplyConfiguration `json:"bgpManagedConfig,omitempty"` } // OVNKubernetesConfigApplyConfiguration constructs a declarative configuration of the OVNKubernetesConfig type for use with @@ -165,3 +186,27 @@ func (b *OVNKubernetesConfigApplyConfiguration) WithRouteAdvertisements(value op b.RouteAdvertisements = &value return b } + +// WithTransport sets the Transport field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Transport field is set to the value of the last call. +func (b *OVNKubernetesConfigApplyConfiguration) WithTransport(value operatorv1.TransportOption) *OVNKubernetesConfigApplyConfiguration { + b.Transport = &value + return b +} + +// WithNoOverlayConfig sets the NoOverlayConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the NoOverlayConfig field is set to the value of the last call. +func (b *OVNKubernetesConfigApplyConfiguration) WithNoOverlayConfig(value *NoOverlayConfigApplyConfiguration) *OVNKubernetesConfigApplyConfiguration { + b.NoOverlayConfig = value + return b +} + +// WithBGPManagedConfig sets the BGPManagedConfig field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the BGPManagedConfig field is set to the value of the last call. +func (b *OVNKubernetesConfigApplyConfiguration) WithBGPManagedConfig(value *BGPManagedConfigApplyConfiguration) *OVNKubernetesConfigApplyConfiguration { + b.BGPManagedConfig = value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponent.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponent.go index 1de725d88e..17044ff5cf 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponent.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponent.go @@ -11,13 +11,12 @@ import ( // // ClusterAPIInstallerComponent defines a component which will be installed by this revision. type ClusterAPIInstallerComponentApplyConfiguration struct { - // type is the source type of the component. - // The only valid value is Image. - // When set to Image, the image field must be set and will define an image source for the component. - Type *operatorv1alpha1.InstallerComponentType `json:"type,omitempty"` - // image defines an image source for a component. The image must contain a - // /capi-operator-installer directory containing the component manifests. - Image *ClusterAPIInstallerComponentImageApplyConfiguration `json:"image,omitempty"` + // name is the human-readable name of the component. The value has no + // effect, and will not be set if the component does not define a name in + // its manifests. If set it must consist of alphanumeric characters, or + // '-', and may not exceed 255 characters. + Name *string `json:"name,omitempty"` + ClusterAPIInstallerComponentSourceApplyConfiguration `json:",inline"` } // ClusterAPIInstallerComponentApplyConfiguration constructs a declarative configuration of the ClusterAPIInstallerComponent type for use with @@ -26,11 +25,19 @@ func ClusterAPIInstallerComponent() *ClusterAPIInstallerComponentApplyConfigurat return &ClusterAPIInstallerComponentApplyConfiguration{} } +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *ClusterAPIInstallerComponentApplyConfiguration) WithName(value string) *ClusterAPIInstallerComponentApplyConfiguration { + b.Name = &value + return b +} + // WithType sets the Type field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Type field is set to the value of the last call. func (b *ClusterAPIInstallerComponentApplyConfiguration) WithType(value operatorv1alpha1.InstallerComponentType) *ClusterAPIInstallerComponentApplyConfiguration { - b.Type = &value + b.ClusterAPIInstallerComponentSourceApplyConfiguration.Type = &value return b } @@ -38,6 +45,6 @@ func (b *ClusterAPIInstallerComponentApplyConfiguration) WithType(value operator // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Image field is set to the value of the last call. func (b *ClusterAPIInstallerComponentApplyConfiguration) WithImage(value *ClusterAPIInstallerComponentImageApplyConfiguration) *ClusterAPIInstallerComponentApplyConfiguration { - b.Image = value + b.ClusterAPIInstallerComponentSourceApplyConfiguration.Image = value return b } diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponentsource.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponentsource.go new file mode 100644 index 0000000000..03f0ac94ee --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallercomponentsource.go @@ -0,0 +1,43 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + operatorv1alpha1 "github.com/openshift/api/operator/v1alpha1" +) + +// ClusterAPIInstallerComponentSourceApplyConfiguration represents a declarative configuration of the ClusterAPIInstallerComponentSource type for use +// with apply. +// +// ClusterAPIInstallerComponentSource defines the source of a component which will be installed by this revision. +type ClusterAPIInstallerComponentSourceApplyConfiguration struct { + // type is the source type of the component. + // The only valid value is Image. + // When set to Image, the image field must be set and will define an image source for the component. + Type *operatorv1alpha1.InstallerComponentType `json:"type,omitempty"` + // image defines an image source for a component. The image must contain a + // /capi-operator-installer directory containing the component manifests. + Image *ClusterAPIInstallerComponentImageApplyConfiguration `json:"image,omitempty"` +} + +// ClusterAPIInstallerComponentSourceApplyConfiguration constructs a declarative configuration of the ClusterAPIInstallerComponentSource type for use with +// apply. +func ClusterAPIInstallerComponentSource() *ClusterAPIInstallerComponentSourceApplyConfiguration { + return &ClusterAPIInstallerComponentSourceApplyConfiguration{} +} + +// WithType sets the Type field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Type field is set to the value of the last call. +func (b *ClusterAPIInstallerComponentSourceApplyConfiguration) WithType(value operatorv1alpha1.InstallerComponentType) *ClusterAPIInstallerComponentSourceApplyConfiguration { + b.Type = &value + return b +} + +// WithImage sets the Image field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Image field is set to the value of the last call. +func (b *ClusterAPIInstallerComponentSourceApplyConfiguration) WithImage(value *ClusterAPIInstallerComponentImageApplyConfiguration) *ClusterAPIInstallerComponentSourceApplyConfiguration { + b.Image = value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevision.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevision.go index fbd3687f68..1206e0825c 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevision.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevision.go @@ -21,6 +21,11 @@ type ClusterAPIInstallerRevisionApplyConfiguration struct { // revision, but which should not be installed or updated. If not set, all // CRDs in the revision will be managed by the CAPI operator. UnmanagedCustomResourceDefinitions []string `json:"unmanagedCustomResourceDefinitions,omitempty"` + // manifestSubstitutions is a list of envsubst style substitutions which + // will be applied to manifests in the revision during rendering. If + // defined it must not be empty, and may not contain more than 32 items. + // Each manifest substitution must have a unique key. + ManifestSubstitutions []ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration `json:"manifestSubstitutions,omitempty"` // components is a list of components which will be installed by this // revision. Components will be installed in the order they are listed. If // omitted no components will be installed. @@ -69,6 +74,19 @@ func (b *ClusterAPIInstallerRevisionApplyConfiguration) WithUnmanagedCustomResou return b } +// WithManifestSubstitutions adds the given value to the ManifestSubstitutions field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the ManifestSubstitutions field. +func (b *ClusterAPIInstallerRevisionApplyConfiguration) WithManifestSubstitutions(values ...*ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration) *ClusterAPIInstallerRevisionApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithManifestSubstitutions") + } + b.ManifestSubstitutions = append(b.ManifestSubstitutions, *values[i]) + } + return b +} + // WithComponents adds the given value to the Components field in the declarative configuration // and returns the receiver, so that objects can be build by chaining "With" function invocations. // If called multiple times, values provided by each call will be appended to the Components field. diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevisionmanifestsubstitution.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevisionmanifestsubstitution.go new file mode 100644 index 0000000000..1731b5cb3b --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapiinstallerrevisionmanifestsubstitution.go @@ -0,0 +1,43 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +// ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration represents a declarative configuration of the ClusterAPIInstallerRevisionManifestSubstitution type for use +// with apply. +// +// ClusterAPIInstallerRevisionManifestSubstitution defines an envsubst style +// substitution which will be applied to manifests in a revision during +// rendering. +type ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration struct { + // key is the name of the envsubst variable to substitute. It must be a + // valid envsubst variable name, consisting of letters, digits, and + // underscores, and must start with a letter or underscore. The key must + // not be empty, and must not exceed 255 characters. + Key *string `json:"key,omitempty"` + // value is the value to substitute for the envsubst variable. It may be + // empty, in which case the variable will be substituted with an empty + // string. The value must not exceed 4096 characters. + Value *string `json:"value,omitempty"` +} + +// ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration constructs a declarative configuration of the ClusterAPIInstallerRevisionManifestSubstitution type for use with +// apply. +func ClusterAPIInstallerRevisionManifestSubstitution() *ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration { + return &ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration{} +} + +// WithKey sets the Key field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Key field is set to the value of the last call. +func (b *ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration) WithKey(value string) *ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration { + b.Key = &value + return b +} + +// WithValue sets the Value field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Value field is set to the value of the last call. +func (b *ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration) WithValue(value string) *ClusterAPIInstallerRevisionManifestSubstitutionApplyConfiguration { + b.Value = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapistatus.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapistatus.go index a684c0a6ce..300921f5bd 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapistatus.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1alpha1/clusterapistatus.go @@ -30,6 +30,9 @@ type ClusterAPIStatusApplyConfiguration struct { // When adding a revision, the revision number must be greater than the highest revision number in the list. // Revisions are immutable, although they can be deleted. Revisions []ClusterAPIInstallerRevisionApplyConfiguration `json:"revisions,omitempty"` + // observedRevisionGeneration is the generation of the ClusterAPI object that was last observed by the revision controller. + // If specified it must be greater than or equal to 1, and less than 2^53. It may not decrease or be unset once set. + ObservedRevisionGeneration *int64 `json:"observedRevisionGeneration,omitempty"` } // ClusterAPIStatusApplyConfiguration constructs a declarative configuration of the ClusterAPIStatus type for use with @@ -66,3 +69,11 @@ func (b *ClusterAPIStatusApplyConfiguration) WithRevisions(values ...*ClusterAPI } return b } + +// WithObservedRevisionGeneration sets the ObservedRevisionGeneration field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ObservedRevisionGeneration field is set to the value of the last call. +func (b *ClusterAPIStatusApplyConfiguration) WithObservedRevisionGeneration(value int64) *ClusterAPIStatusApplyConfiguration { + b.ObservedRevisionGeneration = &value + return b +} diff --git a/vendor/github.com/openshift/controller-runtime-common/LICENSE b/vendor/github.com/openshift/controller-runtime-common/LICENSE new file mode 100644 index 0000000000..261eeb9e9f --- /dev/null +++ b/vendor/github.com/openshift/controller-runtime-common/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/vendor/github.com/openshift/controller-runtime-common/pkg/tls/controller.go b/vendor/github.com/openshift/controller-runtime-common/pkg/tls/controller.go new file mode 100644 index 0000000000..788634fa9a --- /dev/null +++ b/vendor/github.com/openshift/controller-runtime-common/pkg/tls/controller.go @@ -0,0 +1,161 @@ +/* +Copyright 2026 Red Hat, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package tls + +import ( + "context" + "fmt" + "reflect" + + "github.com/go-logr/logr" + configv1 "github.com/openshift/api/config/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/builder" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/event" + "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/predicate" + "sigs.k8s.io/controller-runtime/pkg/reconcile" +) + +// SecurityProfileWatcher watches the APIServer object for TLS profile changes +// and triggers a graceful shutdown when the profile changes. +type SecurityProfileWatcher struct { + client.Client + + // InitialTLSProfileSpec is the TLS profile spec that was configured when the operator started. + InitialTLSProfileSpec configv1.TLSProfileSpec + + // InitialTLSAdherencePolicy is the TLS adherence policy that was configured when the operator started. + InitialTLSAdherencePolicy configv1.TLSAdherencePolicy + + // OnProfileChange is a function that will be called when the TLS profile changes. + // It receives the reconcile context, old and new TLS profile specs. + // This allows the caller to make decisions based on the actual profile changes. + // + // The most common use case for this callback is + // to trigger a graceful shutdown of the operator + // to make it pick up the new configuration. + // + // Example: + // + // // Create a context that can be cancelled when there is a need to shut down the manager. + // ctx, cancel := context.WithCancel(ctrl.SetupSignalHandler()) + // defer cancel() + // + // watcher := &SecurityProfileWatcher{ + // OnProfileChange: func(ctx context.Context, old, new configv1.TLSProfileSpec) { + // logger.Infof("TLS profile has changed, initiating a shutdown to reload it. %q: %+v, %q: %+v", + // "old profile", old, + // "new profile", new, + // ) + // // Cancel the outer context to trigger a graceful shutdown of the manager. + // cancel() + // }, + // } + OnProfileChange func(ctx context.Context, oldTLSProfileSpec, newTLSProfileSpec configv1.TLSProfileSpec) + + // OnAdherencePolicyChange is a function that will be called when the TLS adherence policy changes. + OnAdherencePolicyChange func(ctx context.Context, oldTLSAdherencePolicy, newTLSAdherencePolicy configv1.TLSAdherencePolicy) +} + +// SetupWithManager sets up the controller with the Manager. +func (r *SecurityProfileWatcher) SetupWithManager(mgr ctrl.Manager) error { + if err := ctrl.NewControllerManagedBy(mgr). + Named("tlssecurityprofilewatcher"). + For(&configv1.APIServer{}, builder.WithPredicates( + predicate.Funcs{ + // Only watch the "cluster" APIServer object. + CreateFunc: func(e event.CreateEvent) bool { + return e.Object.GetName() == APIServerName + }, + UpdateFunc: func(e event.UpdateEvent) bool { + return e.ObjectNew.GetName() == APIServerName + }, + DeleteFunc: func(e event.DeleteEvent) bool { + return e.Object.GetName() == APIServerName + }, + GenericFunc: func(e event.GenericEvent) bool { + return e.Object.GetName() == APIServerName + }, + }, + )). + // Override the default log constructor as it makes the logs very chatty. + WithLogConstructor(func(_ *reconcile.Request) logr.Logger { + return mgr.GetLogger().WithValues( + "controller", "tlssecurityprofilewatcher", + ) + }). + Complete(r); err != nil { + return fmt.Errorf("could not set up controller for TLS security profile watcher: %w", err) + } + + return nil +} + +// Reconcile watches for changes to the APIServer TLS profile and triggers a shutdown +// when the profile changes from the initial configuration. +func (r *SecurityProfileWatcher) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { + logger := log.FromContext(ctx, "name", req.Name) + + logger.V(1).Info("Reconciling APIServer TLS profile") + defer logger.V(1).Info("Finished reconciling APIServer TLS profile") + + // Fetch the APIServer object. + apiServer := &configv1.APIServer{} + if err := r.Get(ctx, req.NamespacedName, apiServer); err != nil { + if apierrors.IsNotFound(err) { + // If the APIServer object is not found, we don't need to do anything. + // This could happen if the object was deleted. + return ctrl.Result{}, nil + } + + return ctrl.Result{}, fmt.Errorf("failed to get APIServer %s: %w", req.NamespacedName.String(), err) + } + + // Get the current TLS profile spec. + currentTLSProfileSpec, err := GetTLSProfileSpec(apiServer.Spec.TLSSecurityProfile) + if err != nil { + return ctrl.Result{}, fmt.Errorf("failed to get TLS profile from APIServer %s: %w", req.NamespacedName.String(), err) + } + + // Compare the current TLS profile spec with the initial one. + if tlsProfileChanged := !reflect.DeepEqual(r.InitialTLSProfileSpec, currentTLSProfileSpec); tlsProfileChanged { + // TLS profile has changed, invoke the callback if it is set. + if r.OnProfileChange != nil { + r.OnProfileChange(ctx, r.InitialTLSProfileSpec, currentTLSProfileSpec) + } + + // Persist the new profile for future change detection. + r.InitialTLSProfileSpec = currentTLSProfileSpec + } + + // Compare the current TLS adherence policy with the initial one. + if tlsAdherencePolicyChanged := r.InitialTLSAdherencePolicy != apiServer.Spec.TLSAdherence; tlsAdherencePolicyChanged { + // TLS adherence policy has changed, invoke the callback if it is set. + if r.OnAdherencePolicyChange != nil { + r.OnAdherencePolicyChange(ctx, r.InitialTLSAdherencePolicy, apiServer.Spec.TLSAdherence) + } + + // Persist the new adherence policy for future change detection. + r.InitialTLSAdherencePolicy = apiServer.Spec.TLSAdherence + } + + // No need to requeue, as the callback will handle further actions. + return ctrl.Result{}, nil +} diff --git a/vendor/github.com/openshift/controller-runtime-common/pkg/tls/tls.go b/vendor/github.com/openshift/controller-runtime-common/pkg/tls/tls.go new file mode 100644 index 0000000000..ce1e8c7d9f --- /dev/null +++ b/vendor/github.com/openshift/controller-runtime-common/pkg/tls/tls.go @@ -0,0 +1,168 @@ +/* +Copyright 2026 Red Hat, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package tls provides utilities for working with OpenShift TLS profiles. +package tls + +import ( + "context" + "crypto/tls" + "errors" + "fmt" + + configv1 "github.com/openshift/api/config/v1" + libgocrypto "github.com/openshift/library-go/pkg/crypto" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +const ( + // APIServerName is the name of the APIServer resource in the cluster. + APIServerName = "cluster" +) + +var ( + // ErrCustomProfileNil is returned when a custom TLS profile is specified but the Custom field is nil. + ErrCustomProfileNil = errors.New("custom TLS profile specified but Custom field is nil") + + // DefaultTLSCiphers are the default TLS ciphers for API servers. + DefaultTLSCiphers = configv1.TLSProfiles[configv1.TLSProfileIntermediateType].Ciphers //nolint:gochecknoglobals + // DefaultMinTLSVersion is the default minimum TLS version for API servers. + DefaultMinTLSVersion = configv1.TLSProfiles[configv1.TLSProfileIntermediateType].MinTLSVersion //nolint:gochecknoglobals +) + +// FetchAPIServerTLSProfile fetches the TLS profile spec configured in APIServer. +// If no profile is configured, the default profile is returned. +func FetchAPIServerTLSProfile(ctx context.Context, k8sClient client.Client) (configv1.TLSProfileSpec, error) { + apiServer := &configv1.APIServer{} + key := client.ObjectKey{Name: APIServerName} + + if err := k8sClient.Get(ctx, key, apiServer); err != nil { + return configv1.TLSProfileSpec{}, fmt.Errorf("failed to get APIServer %q: %w", key.String(), err) + } + + profile, err := GetTLSProfileSpec(apiServer.Spec.TLSSecurityProfile) + if err != nil { + return configv1.TLSProfileSpec{}, fmt.Errorf("failed to get TLS profile from APIServer %q: %w", key.String(), err) + } + + return profile, nil +} + +// FetchAPIServerTLSAdherencePolicy fetches the TLS adherence policy configured in APIServer. +// If no policy is configured, the default policy is returned. +func FetchAPIServerTLSAdherencePolicy(ctx context.Context, k8sClient client.Client) (configv1.TLSAdherencePolicy, error) { + apiServer := &configv1.APIServer{} + key := client.ObjectKey{Name: APIServerName} + + if err := k8sClient.Get(ctx, key, apiServer); err != nil { + return configv1.TLSAdherencePolicyNoOpinion, fmt.Errorf("failed to get APIServer %q: %w", key.String(), err) + } + + return apiServer.Spec.TLSAdherence, nil +} + +// GetTLSProfileSpec returns TLSProfileSpec for the given profile. +// If no profile is configured, the default profile is returned. +func GetTLSProfileSpec(profile *configv1.TLSSecurityProfile) (configv1.TLSProfileSpec, error) { + // Define the default profile (at the time of writing, this is the intermediate profile). + defaultProfile := *configv1.TLSProfiles[configv1.TLSProfileIntermediateType] + // If the profile is nil or the type is empty, return the default profile. + if profile == nil || profile.Type == "" { + return defaultProfile, nil + } + + // Get the profile type. + profileType := profile.Type + + // If the profile type is not custom, return the profile from the map. + if profileType != configv1.TLSProfileCustomType { + if tlsConfig, ok := configv1.TLSProfiles[profileType]; ok { + return *tlsConfig, nil + } + + // If the profile type is not found, return the default profile. + return defaultProfile, nil + } + + if profile.Custom == nil { + // If the custom profile is nil, return an error. + return configv1.TLSProfileSpec{}, ErrCustomProfileNil + } + + // Return the custom profile spec. + return profile.Custom.TLSProfileSpec, nil +} + +// NewTLSConfigFromProfile returns a function that configures a tls.Config based on the provided TLSProfileSpec, +// along with any cipher names from the profile that are not supported by the library-go crypto package. +// The returned function is intended to be used with controller-runtime's TLSOpts. +// +// Note: CipherSuites are only set when MinVersion is below TLS 1.3, as Go's TLS 1.3 implementation +// does not allow configuring cipher suites - all TLS 1.3 ciphers are always enabled. +// See: https://github.com/golang/go/issues/29349 +func NewTLSConfigFromProfile(profile configv1.TLSProfileSpec) (tlsConfig func(*tls.Config), unsupportedCiphers []string) { + minVersion := libgocrypto.TLSVersionOrDie(string(profile.MinTLSVersion)) + cipherSuites, unsupportedCiphers := cipherCodes(profile.Ciphers) + + return func(tlsConf *tls.Config) { + tlsConf.MinVersion = minVersion + // TODO: add curve preferences from profile once https://github.com/openshift/api/pull/2583 merges. + // tlsConf.CurvePreferences <<<<<< profile.Curves + + // TLS 1.3 cipher suites are not configurable in Go (https://github.com/golang/go/issues/29349), so only set CipherSuites accordingly. + // TODO: revisit this once we get an answer on the best way to handle this here: + // https://docs.google.com/document/d/1cMc9E8psHfnoK06ntR8kHSWB8d3rMtmldhnmM4nImjs/edit?disco=AAABu_nPcYg + if minVersion != tls.VersionTLS13 { + tlsConf.CipherSuites = cipherSuites + } + }, unsupportedCiphers +} + +// cipherCode returns the TLS cipher code for an OpenSSL or IANA cipher name. +// Returns 0 if the cipher is not supported. +func cipherCode(cipher string) uint16 { + // First try as IANA name directly. + if code, err := libgocrypto.CipherSuite(cipher); err == nil { + return code + } + + // Try converting from OpenSSL name to IANA name. + ianaCiphers := libgocrypto.OpenSSLToIANACipherSuites([]string{cipher}) + if len(ianaCiphers) == 1 { + if code, err := libgocrypto.CipherSuite(ianaCiphers[0]); err == nil { + return code + } + } + + // Return 0 if the cipher is not supported. + return 0 +} + +// cipherCodes converts a list of cipher names (OpenSSL or IANA format) to their uint16 codes. +// Returns the converted codes and a list of any unsupported cipher names. +func cipherCodes(ciphers []string) (codes []uint16, unsupportedCiphers []string) { + for _, cipher := range ciphers { + code := cipherCode(cipher) + if code == 0 { + unsupportedCiphers = append(unsupportedCiphers, cipher) + continue + } + + codes = append(codes, code) + } + + return codes, unsupportedCiphers +} diff --git a/vendor/github.com/openshift/library-go/pkg/crypto/cert_config.go b/vendor/github.com/openshift/library-go/pkg/crypto/cert_config.go new file mode 100644 index 0000000000..76d71da2ab --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/crypto/cert_config.go @@ -0,0 +1,225 @@ +package crypto + +import ( + "crypto" + "crypto/x509" + "crypto/x509/pkix" + "fmt" + "time" + + "k8s.io/apimachinery/pkg/util/sets" + "k8s.io/apiserver/pkg/authentication/user" +) + +// KeyPairGenerator generates a cryptographic key pair. +type KeyPairGenerator interface { + GenerateKeyPair() (crypto.PublicKey, crypto.PrivateKey, error) +} + +// NewSigningCertificate creates a CA certificate. +// By default it creates a self-signed root CA. Use WithSigner to create an +// intermediate CA signed by a parent CA. +// The name parameter is used as the CommonName unless overridden with WithSubject. +// Optional: WithSigner, WithSubject, WithLifetime (defaults to DefaultCACertificateLifetimeDuration). +func NewSigningCertificate(name string, keyGen KeyPairGenerator, opts ...CertificateOption) (*TLSCertificateConfig, error) { + o := &CertificateOptions{ + lifetime: DefaultCACertificateLifetimeDuration, + } + for _, opt := range opts { + opt(o) + } + + subject := pkix.Name{CommonName: name} + if o.subject != nil { + subject = *o.subject + } + + publicKey, privateKey, err := keyGen.GenerateKeyPair() + if err != nil { + return nil, fmt.Errorf("failed to generate key pair: %w", err) + } + subjectKeyId, err := SubjectKeyIDFromPublicKey(publicKey) + if err != nil { + return nil, fmt.Errorf("failed to compute subject key ID: %w", err) + } + + if o.signer != nil { + // Intermediate CA signed by the provided signer. + authorityKeyId := o.signer.Config.Certs[0].SubjectKeyId + template := newSigningCertificateTemplateForDuration(subject, o.lifetime, time.Now, authorityKeyId, subjectKeyId) + template.SignatureAlgorithm = 0 + template.KeyUsage = KeyUsageForPublicKey(publicKey) | x509.KeyUsageCertSign + + cert, err := o.signer.SignCertificate(template, publicKey) + if err != nil { + return nil, fmt.Errorf("failed to sign certificate: %w", err) + } + + return &TLSCertificateConfig{ + Certs: append([]*x509.Certificate{cert}, o.signer.Config.Certs...), + Key: privateKey, + }, nil + } + + // Self-signed root CA. AuthorityKeyId and SubjectKeyId match. + template := newSigningCertificateTemplateForDuration(subject, o.lifetime, time.Now, subjectKeyId, subjectKeyId) + template.SignatureAlgorithm = 0 + template.KeyUsage = KeyUsageForPublicKey(publicKey) | x509.KeyUsageCertSign + + cert, err := signCertificate(template, publicKey, template, privateKey) + if err != nil { + return nil, fmt.Errorf("failed to sign certificate: %w", err) + } + + return &TLSCertificateConfig{ + Certs: []*x509.Certificate{cert}, + Key: privateKey, + }, nil +} + +// NewServerCertificate creates a server/serving certificate signed by this CA. +// Optional: WithLifetime (defaults to DefaultCertificateLifetimeDuration), WithExtensions. +func (ca *CA) NewServerCertificate(hostnames sets.Set[string], keyGen KeyPairGenerator, opts ...CertificateOption) (*TLSCertificateConfig, error) { + o := &CertificateOptions{ + lifetime: DefaultCertificateLifetimeDuration, + } + for _, opt := range opts { + opt(o) + } + + publicKey, privateKey, err := keyGen.GenerateKeyPair() + if err != nil { + return nil, fmt.Errorf("failed to generate key pair: %w", err) + } + subjectKeyId, err := SubjectKeyIDFromPublicKey(publicKey) + if err != nil { + return nil, fmt.Errorf("failed to compute subject key ID: %w", err) + } + + sortedHostnames := sets.List(hostnames) + authorityKeyId := ca.Config.Certs[0].SubjectKeyId + template := newServerCertificateTemplateForDuration( + pkix.Name{CommonName: sortedHostnames[0]}, + sortedHostnames, + o.lifetime, + time.Now, + authorityKeyId, + subjectKeyId, + ) + // Let x509.CreateCertificate auto-detect the signature algorithm from the CA's key. + template.SignatureAlgorithm = 0 + template.KeyUsage = KeyUsageForPublicKey(publicKey) + + for _, fn := range o.extensionFns { + if err := fn(template); err != nil { + return nil, fmt.Errorf("failed to apply certificate extension: %w", err) + } + } + + cert, err := ca.SignCertificate(template, publicKey) + if err != nil { + return nil, fmt.Errorf("failed to sign certificate: %w", err) + } + + return &TLSCertificateConfig{ + Certs: append([]*x509.Certificate{cert}, ca.Config.Certs...), + Key: privateKey, + }, nil +} + +// NewClientCertificate creates a client certificate signed by this CA. +// Optional: WithLifetime (defaults to DefaultCertificateLifetimeDuration). +func (ca *CA) NewClientCertificate(u user.Info, keyGen KeyPairGenerator, opts ...CertificateOption) (*TLSCertificateConfig, error) { + o := &CertificateOptions{ + lifetime: DefaultCertificateLifetimeDuration, + } + for _, opt := range opts { + opt(o) + } + + publicKey, privateKey, err := keyGen.GenerateKeyPair() + if err != nil { + return nil, fmt.Errorf("failed to generate key pair: %w", err) + } + subjectKeyId, err := SubjectKeyIDFromPublicKey(publicKey) + if err != nil { + return nil, fmt.Errorf("failed to compute subject key ID: %w", err) + } + + authorityKeyId := ca.Config.Certs[0].SubjectKeyId + template := NewClientCertificateTemplateForDuration(UserToSubject(u), o.lifetime, time.Now) + template.AuthorityKeyId = authorityKeyId + template.SubjectKeyId = subjectKeyId + // Let x509.CreateCertificate auto-detect the signature algorithm from the CA's key. + template.SignatureAlgorithm = 0 + template.KeyUsage = KeyUsageForPublicKey(publicKey) + + cert, err := ca.SignCertificate(template, publicKey) + if err != nil { + return nil, fmt.Errorf("failed to sign certificate: %w", err) + } + + return &TLSCertificateConfig{ + Certs: append([]*x509.Certificate{cert}, ca.Config.Certs...), + Key: privateKey, + }, nil +} + +// NewPeerCertificate creates a peer certificate (both server and client auth) +// signed by this CA. +// Optional: WithLifetime (defaults to DefaultCertificateLifetimeDuration), WithExtensions. +func (ca *CA) NewPeerCertificate(hostnames sets.Set[string], u user.Info, keyGen KeyPairGenerator, opts ...CertificateOption) (*TLSCertificateConfig, error) { + o := &CertificateOptions{ + lifetime: DefaultCertificateLifetimeDuration, + } + for _, opt := range opts { + opt(o) + } + + publicKey, privateKey, err := keyGen.GenerateKeyPair() + if err != nil { + return nil, fmt.Errorf("failed to generate key pair: %w", err) + } + subjectKeyId, err := SubjectKeyIDFromPublicKey(publicKey) + if err != nil { + return nil, fmt.Errorf("failed to compute subject key ID: %w", err) + } + + sortedHostnames := sets.List(hostnames) + authorityKeyId := ca.Config.Certs[0].SubjectKeyId + + // Start from a server certificate template for the hostnames. + template := newServerCertificateTemplateForDuration( + pkix.Name{CommonName: sortedHostnames[0]}, + sortedHostnames, + o.lifetime, + time.Now, + authorityKeyId, + subjectKeyId, + ) + // Let x509.CreateCertificate auto-detect the signature algorithm from the CA's key. + template.SignatureAlgorithm = 0 + template.KeyUsage = KeyUsageForPublicKey(publicKey) + + // Set subject from user info for client authentication. + template.Subject = UserToSubject(u) + + // Enable both server and client authentication. + template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth} + + for _, fn := range o.extensionFns { + if err := fn(template); err != nil { + return nil, fmt.Errorf("failed to apply certificate extension: %w", err) + } + } + + cert, err := ca.SignCertificate(template, publicKey) + if err != nil { + return nil, fmt.Errorf("failed to sign certificate: %w", err) + } + + return &TLSCertificateConfig{ + Certs: append([]*x509.Certificate{cert}, ca.Config.Certs...), + Key: privateKey, + }, nil +} diff --git a/vendor/github.com/openshift/library-go/pkg/crypto/keygen.go b/vendor/github.com/openshift/library-go/pkg/crypto/keygen.go new file mode 100644 index 0000000000..96b7559468 --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/crypto/keygen.go @@ -0,0 +1,118 @@ +package crypto + +import ( + "crypto" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "crypto/rsa" + "crypto/sha256" + "crypto/x509" + "fmt" +) + +// KeyAlgorithm identifies the key generation algorithm. +type KeyAlgorithm string + +const ( + // RSAKeyAlgorithm specifies RSA key generation. + RSAKeyAlgorithm KeyAlgorithm = "RSA" + // ECDSAKeyAlgorithm specifies ECDSA key generation. + ECDSAKeyAlgorithm KeyAlgorithm = "ECDSA" +) + +// ECDSACurve identifies a named ECDSA curve. +type ECDSACurve string + +const ( + // P256 specifies the NIST P-256 curve (secp256r1), providing 128-bit security. + P256 ECDSACurve = "P256" + // P384 specifies the NIST P-384 curve (secp384r1), providing 192-bit security. + P384 ECDSACurve = "P384" + // P521 specifies the NIST P-521 curve (secp521r1), providing 256-bit security. + P521 ECDSACurve = "P521" +) + +// RSAKeyPairGenerator generates RSA key pairs. +type RSAKeyPairGenerator struct { + // Bits is the RSA key size in bits. Must be >= 2048. + Bits int +} + +func (g RSAKeyPairGenerator) GenerateKeyPair() (crypto.PublicKey, crypto.PrivateKey, error) { + bits := g.Bits + if bits == 0 { + bits = keyBits + } + privateKey, err := rsa.GenerateKey(rand.Reader, bits) + if err != nil { + return nil, nil, err + } + return &privateKey.PublicKey, privateKey, nil +} + +// ECDSAKeyPairGenerator generates ECDSA key pairs. +type ECDSAKeyPairGenerator struct { + // Curve is the named ECDSA curve. + Curve ECDSACurve +} + +func (g ECDSAKeyPairGenerator) GenerateKeyPair() (crypto.PublicKey, crypto.PrivateKey, error) { + curve, err := g.ellipticCurve() + if err != nil { + return nil, nil, err + } + privateKey, err := ecdsa.GenerateKey(curve, rand.Reader) + if err != nil { + return nil, nil, err + } + return &privateKey.PublicKey, privateKey, nil +} + +func (g ECDSAKeyPairGenerator) ellipticCurve() (elliptic.Curve, error) { + switch g.Curve { + case P256: + return elliptic.P256(), nil + case P384: + return elliptic.P384(), nil + case P521: + return elliptic.P521(), nil + default: + return nil, fmt.Errorf("unsupported ECDSA curve: %q", g.Curve) + } +} + +// KeyUsageForPublicKey returns the x509.KeyUsage flags appropriate for the +// given public key type. ECDSA keys use DigitalSignature only; RSA keys also +// include KeyEncipherment. +func KeyUsageForPublicKey(pub crypto.PublicKey) x509.KeyUsage { + switch pub.(type) { + case *ecdsa.PublicKey: + return x509.KeyUsageDigitalSignature + default: + return x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature + } +} + +// SubjectKeyIDFromPublicKey computes a truncated SHA-256 hash suitable for +// use as a certificate SubjectKeyId from any supported public key type. +// This uses the first 160 bits of the SHA-256 hash per RFC 7093, consistent +// with the Go standard library since Go 1.25 (go.dev/issue/71746) and +// Let's Encrypt. Prior Go versions used SHA-1 which is not FIPS-compatible. +func SubjectKeyIDFromPublicKey(pub crypto.PublicKey) ([]byte, error) { + var rawBytes []byte + switch pub := pub.(type) { + case *rsa.PublicKey: + rawBytes = pub.N.Bytes() + case *ecdsa.PublicKey: + ecdhKey, err := pub.ECDH() + if err != nil { + return nil, fmt.Errorf("failed to convert ECDSA public key: %w", err) + } + rawBytes = ecdhKey.Bytes() + default: + return nil, fmt.Errorf("unsupported public key type: %T", pub) + } + hash := sha256.Sum256(rawBytes) + return hash[:20], nil +} diff --git a/vendor/github.com/openshift/library-go/pkg/crypto/options.go b/vendor/github.com/openshift/library-go/pkg/crypto/options.go new file mode 100644 index 0000000000..983b115d22 --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/crypto/options.go @@ -0,0 +1,49 @@ +package crypto + +import ( + "crypto/x509/pkix" + "time" +) + +// CertificateOptions holds optional configuration collected from functional options. +type CertificateOptions struct { + lifetime time.Duration + subject *pkix.Name + extensionFns []CertificateExtensionFunc + signer *CA +} + +// CertificateOption is a functional option for certificate creation. +type CertificateOption func(*CertificateOptions) + +// WithLifetime sets the certificate lifetime duration. +func WithLifetime(d time.Duration) CertificateOption { + return func(o *CertificateOptions) { + o.lifetime = d + } +} + +// WithSubject overrides the certificate subject. For signing certificates, +// this overrides the default subject derived from the name parameter. +func WithSubject(s pkix.Name) CertificateOption { + return func(o *CertificateOptions) { + o.subject = &s + } +} + +// WithSigner specifies a CA to sign the certificate. When used with +// NewSigningCertificate, this creates an intermediate CA signed by the +// given CA instead of a self-signed root CA. +func WithSigner(ca *CA) CertificateOption { + return func(o *CertificateOptions) { + o.signer = ca + } +} + +// WithExtensions adds certificate extension functions that are called +// to modify the certificate template before signing. +func WithExtensions(fns ...CertificateExtensionFunc) CertificateOption { + return func(o *CertificateOptions) { + o.extensionFns = append(o.extensionFns, fns...) + } +} diff --git a/vendor/github.com/openshift/library-go/pkg/crypto/tls_adherence.go b/vendor/github.com/openshift/library-go/pkg/crypto/tls_adherence.go new file mode 100644 index 0000000000..ef0e1af51a --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/crypto/tls_adherence.go @@ -0,0 +1,23 @@ +package crypto + +import ( + configv1 "github.com/openshift/api/config/v1" +) + +// ShouldHonorClusterTLSProfile returns true if the component should honor the +// cluster-wide TLS security profile settings from apiserver.config.openshift.io/cluster. +// +// When this returns true (StrictAllComponents mode), components must honor the +// cluster-wide TLS profile unless they have a component-specific TLS configuration +// that overrides it. +// +// Unknown enum values are treated as StrictAllComponents for forward compatibility +// and to default to the more secure behavior. +func ShouldHonorClusterTLSProfile(tlsAdherence configv1.TLSAdherencePolicy) bool { + switch tlsAdherence { + case configv1.TLSAdherencePolicyNoOpinion, configv1.TLSAdherencePolicyLegacyAdheringComponentsOnly: + return false + default: + return true + } +} diff --git a/vendor/github.com/openshift/library-go/pkg/operator/certrotation/client_cert_rotation_controller.go b/vendor/github.com/openshift/library-go/pkg/operator/certrotation/client_cert_rotation_controller.go index f9ad1fc14b..dbacb066e9 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/certrotation/client_cert_rotation_controller.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/certrotation/client_cert_rotation_controller.go @@ -6,13 +6,12 @@ import ( "time" operatorv1 "github.com/openshift/api/operator/v1" - corev1 "k8s.io/api/core/v1" - "k8s.io/apimachinery/pkg/util/wait" - "github.com/openshift/library-go/pkg/controller/factory" "github.com/openshift/library-go/pkg/operator/condition" "github.com/openshift/library-go/pkg/operator/events" "github.com/openshift/library-go/pkg/operator/v1helpers" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/util/wait" ) const ( @@ -80,6 +79,7 @@ func NewCertRotationController( RotatedSelfSignedCertKeySecret: rotatedSelfSignedCertKeySecret, StatusReporter: reporter, } + return factory.New(). ResyncEvery(time.Minute). WithSync(c.Sync). diff --git a/vendor/github.com/openshift/library-go/pkg/operator/certrotation/signer.go b/vendor/github.com/openshift/library-go/pkg/operator/certrotation/signer.go index c2c8b8368f..019cce7d5a 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/certrotation/signer.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/certrotation/signer.go @@ -9,6 +9,7 @@ import ( "github.com/openshift/library-go/pkg/crypto" "github.com/openshift/library-go/pkg/operator/events" "github.com/openshift/library-go/pkg/operator/resource/resourcehelper" + "github.com/openshift/library-go/pkg/pki" corev1 "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -48,6 +49,13 @@ type RotatedSigningCASecret struct { // AdditionalAnnotations is a collection of annotations set for the secret AdditionalAnnotations AdditionalAnnotations + // CertificateName is the logical name of this certificate for PKI profile resolution. + CertificateName string + + // PKIProfileProvider, when non-nil, enables ConfigurablePKI certificate + // key algorithm resolution. When nil, legacy certificate generation is used. + PKIProfileProvider pki.PKIProfileProvider + // Plumbing: Informer corev1informers.SecretInformer Lister corev1listers.SecretLister @@ -87,12 +95,12 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (* // run Update if signer content needs changing signerUpdated := false - if needed, reason := needNewSigningCertKeyPair(signingCertKeyPairSecret, c.Refresh, c.RefreshOnlyWhenExpired); needed || creationRequired { + if needed, reason := c.needNewSigningCertKeyPair(signingCertKeyPairSecret); needed || creationRequired { if creationRequired { reason = "secret doesn't exist" } c.EventRecorder.Eventf("SignerUpdateRequired", "%q in %q requires a new signing cert/key pair: %v", c.Name, c.Namespace, reason) - if err = setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret, c.Validity, c.Refresh, c.AdditionalAnnotations); err != nil { + if err = c.setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret); err != nil { return nil, false, err } @@ -149,7 +157,7 @@ func ensureOwnerReference(meta *metav1.ObjectMeta, owner *metav1.OwnerReference) return false } -func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, refreshOnlyWhenExpired bool) (bool, string) { +func (c RotatedSigningCASecret) needNewSigningCertKeyPair(secret *corev1.Secret) (bool, string) { annotations := secret.Annotations notBefore, notAfter, reason := getValidityFromAnnotations(annotations) if len(reason) > 0 { @@ -160,7 +168,7 @@ func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, ref return true, "already expired" } - if refreshOnlyWhenExpired { + if c.RefreshOnlyWhenExpired { return false, "" } @@ -170,7 +178,7 @@ func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, ref return true, fmt.Sprintf("past refresh time (80%% of validity): %v", at80Percent) } - developerSpecifiedRefresh := notBefore.Add(refresh) + developerSpecifiedRefresh := notBefore.Add(c.Refresh) if time.Now().After(developerSpecifiedRefresh) { return true, fmt.Sprintf("past its refresh time %v", developerSpecifiedRefresh) } @@ -199,22 +207,67 @@ func getValidityFromAnnotations(annotations map[string]string) (notBefore time.T return notBefore, notAfter, "" } +func (c RotatedSigningCASecret) resolveKeyPairGenerator() (crypto.KeyPairGenerator, error) { + return resolveKeyPairGeneratorWithFallback(c.PKIProfileProvider, pki.CertificateTypeSigner, c.CertificateName) +} + +// resolveKeyPairGeneratorWithFallback resolves the key pair generator from the +// PKI profile provider. Returns nil for Unmanaged mode (no key override). +// +// TODO(sanchezl): Remove the fallback to DefaultPKIProfile() once installer +// support for the PKI resource is in place. Until then, the PKI resource may +// not exist in TechPreview clusters. Once removed, callers can use +// pki.ResolveCertificateConfig directly. +func resolveKeyPairGeneratorWithFallback(provider pki.PKIProfileProvider, certType pki.CertificateType, name string) (crypto.KeyPairGenerator, error) { + cfg, err := pki.ResolveCertificateConfig(provider, certType, name) + if err != nil { + klog.Warningf("Failed to resolve PKI config for %s %q, falling back to default profile: %v", certType, name, err) + defaultProfile := pki.DefaultPKIProfile() + cfg, err = pki.ResolveCertificateConfig(pki.NewStaticPKIProfileProvider(&defaultProfile), certType, name) + if err != nil { + return nil, err + } + } + if cfg == nil { + return nil, nil + } + return cfg.Key, nil +} + // setSigningCertKeyPairSecretAndTLSAnnotations generates a new signing certificate and key pair, // stores them in the specified secret, and adds predefined TLS annotations to that secret. -func setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, tlsAnnotations AdditionalAnnotations) error { - ca, err := setSigningCertKeyPairSecret(signingCertKeyPairSecret, validity) +func (c RotatedSigningCASecret) setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret *corev1.Secret) error { + ca, err := c.setSigningCertKeyPairSecret(signingCertKeyPairSecret) if err != nil { return err } - setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret, ca, refresh, tlsAnnotations) + c.setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret, ca) return nil } -// setSigningCertKeyPairSecret creates a new signing cert/key pair and sets them in the secret -func setSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, validity time.Duration) (*crypto.TLSCertificateConfig, error) { +// setSigningCertKeyPairSecret creates a new signing cert/key pair and sets them in the secret. +func (c RotatedSigningCASecret) setSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret) (*crypto.TLSCertificateConfig, error) { signerName := fmt.Sprintf("%s_%s@%d", signingCertKeyPairSecret.Namespace, signingCertKeyPairSecret.Name, time.Now().Unix()) - ca, err := crypto.MakeSelfSignedCAConfigForDuration(signerName, validity) + + var ca *crypto.TLSCertificateConfig + var err error + if c.PKIProfileProvider != nil { + keyGen, err := c.resolveKeyPairGenerator() + if err != nil { + return nil, err + } + if keyGen != nil { + ca, err = crypto.NewSigningCertificate(signerName, keyGen, crypto.WithLifetime(c.Validity)) + if err != nil { + return nil, err + } + } + // nil keyGen means Unmanaged: fall through to legacy cert generation + } + if ca == nil { + ca, err = crypto.MakeSelfSignedCAConfigForDuration(signerName, c.Validity) + } if err != nil { return nil, err } @@ -243,11 +296,12 @@ func setSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, validi // // These assumptions are safe because this function is only called after the secret // has been initialized in setSigningCertKeyPairSecret. -func setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, ca *crypto.TLSCertificateConfig, refresh time.Duration, tlsAnnotations AdditionalAnnotations) { +func (c RotatedSigningCASecret) setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, ca *crypto.TLSCertificateConfig) { signingCertKeyPairSecret.Annotations[CertificateIssuer] = ca.Certs[0].Issuer.CommonName + tlsAnnotations := c.AdditionalAnnotations tlsAnnotations.NotBefore = ca.Certs[0].NotBefore.Format(time.RFC3339) tlsAnnotations.NotAfter = ca.Certs[0].NotAfter.Format(time.RFC3339) - tlsAnnotations.RefreshPeriod = refresh.String() + tlsAnnotations.RefreshPeriod = c.Refresh.String() _ = tlsAnnotations.EnsureTLSMetadataUpdate(&signingCertKeyPairSecret.ObjectMeta) } diff --git a/vendor/github.com/openshift/library-go/pkg/operator/certrotation/target.go b/vendor/github.com/openshift/library-go/pkg/operator/certrotation/target.go index 88cd41189e..b76c494402 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/certrotation/target.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/certrotation/target.go @@ -18,6 +18,7 @@ import ( "github.com/openshift/library-go/pkg/crypto" "github.com/openshift/library-go/pkg/operator/events" "github.com/openshift/library-go/pkg/operator/resource/resourcehelper" + "github.com/openshift/library-go/pkg/pki" corev1informers "k8s.io/client-go/informers/core/v1" corev1client "k8s.io/client-go/kubernetes/typed/core/v1" corev1listers "k8s.io/client-go/listers/core/v1" @@ -64,6 +65,13 @@ type RotatedSelfSignedCertKeySecret struct { // CertCreator does the actual cert generation. CertCreator TargetCertCreator + // CertificateName is the logical name of this certificate for PKI profile resolution. + CertificateName string + + // PKIProfileProvider, when non-nil, enables ConfigurablePKI certificate + // key algorithm resolution. When nil, legacy certificate generation is used. + PKIProfileProvider pki.PKIProfileProvider + // Plumbing: Informer corev1informers.SecretInformer Lister corev1listers.SecretLister @@ -72,12 +80,15 @@ type RotatedSelfSignedCertKeySecret struct { } type TargetCertCreator interface { - // NewCertificate creates a new key-cert pair with the given signer. - NewCertificate(signer *crypto.CA, validity time.Duration) (*crypto.TLSCertificateConfig, error) + // NewCertificate creates a new key-cert pair with the given signer. If keyGen + // is non-nil, it is used to generate the key pair; otherwise legacy defaults are used. + NewCertificate(signer *crypto.CA, validity time.Duration, keyGen crypto.KeyPairGenerator) (*crypto.TLSCertificateConfig, error) // NeedNewTargetCertKeyPair decides whether a new cert-key pair is needed. It returns a non-empty reason if it is the case. NeedNewTargetCertKeyPair(currentCertSecret *corev1.Secret, signer *crypto.CA, caBundleCerts []*x509.Certificate, refresh time.Duration, refreshOnlyWhenExpired, creationRequired bool) string // SetAnnotations gives an option to override or set additional annotations SetAnnotations(cert *crypto.TLSCertificateConfig, annotations map[string]string) map[string]string + // CertificateType returns the category of certificate this creator produces. + CertificateType() pki.CertificateType } // TargetCertRechecker is an optional interface to be implemented by the TargetCertCreator to enforce @@ -121,7 +132,7 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont if reason := c.CertCreator.NeedNewTargetCertKeyPair(targetCertKeyPairSecret, signingCertKeyPair, caBundleCerts, c.Refresh, c.RefreshOnlyWhenExpired, creationRequired); len(reason) > 0 { c.EventRecorder.Eventf("TargetUpdateRequired", "%q in %q requires a new target cert/key pair: %v", c.Name, c.Namespace, reason) - if err = setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret, c.Validity, c.Refresh, signingCertKeyPair, c.CertCreator, c.AdditionalAnnotations); err != nil { + if err = c.setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret, signingCertKeyPair); err != nil { return nil, err } @@ -239,19 +250,19 @@ func needNewTargetCertKeyPairForTime(annotations map[string]string, signer *cryp // setTargetCertKeyPairSecretAndTLSAnnotations generates a new cert/key pair, // stores them in the specified secret, and adds predefined TLS annotations to that secret. -func setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, signer *crypto.CA, certCreator TargetCertCreator, tlsAnnotations AdditionalAnnotations) error { - certKeyPair, err := setTargetCertKeyPairSecret(targetCertKeyPairSecret, validity, signer, certCreator) +func (c RotatedSelfSignedCertKeySecret) setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret *corev1.Secret, signer *crypto.CA) error { + certKeyPair, err := c.setTargetCertKeyPairSecret(targetCertKeyPairSecret, signer) if err != nil { return err } - setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret, certKeyPair, certCreator, refresh, tlsAnnotations) + c.setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret, certKeyPair) return nil } // setTargetCertKeyPairSecret creates a new cert/key pair and sets them in the secret. Only one of client, serving, or signer rotation may be specified. // TODO refactor with an interface for actually signing and move the one-of check higher in the stack. -func setTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, validity time.Duration, signer *crypto.CA, certCreator TargetCertCreator) (*crypto.TLSCertificateConfig, error) { +func (c RotatedSelfSignedCertKeySecret) setTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, signer *crypto.CA) (*crypto.TLSCertificateConfig, error) { if targetCertKeyPairSecret.Annotations == nil { targetCertKeyPairSecret.Annotations = map[string]string{} } @@ -260,13 +271,22 @@ func setTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, validity } // our annotation is based on our cert validity, so we want to make sure that we don't specify something past our signer - targetValidity := validity + targetValidity := c.Validity remainingSignerValidity := signer.Config.Certs[0].NotAfter.Sub(time.Now()) - if remainingSignerValidity < validity { + if remainingSignerValidity < targetValidity { targetValidity = remainingSignerValidity } - certKeyPair, err := certCreator.NewCertificate(signer, targetValidity) + var keyGen crypto.KeyPairGenerator + if c.PKIProfileProvider != nil { + var err error + keyGen, err = c.resolveKeyPairGenerator() + if err != nil { + return nil, err + } + } + + certKeyPair, err := c.CertCreator.NewCertificate(signer, targetValidity, keyGen) if err != nil { return nil, err } @@ -282,22 +302,34 @@ func setTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, validity // // These assumptions are safe because this function is only called after the secret // has been initialized in setTargetCertKeyPairSecret. -func setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, certKeyPair *crypto.TLSCertificateConfig, certCreator TargetCertCreator, refresh time.Duration, tlsAnnotations AdditionalAnnotations) { +func (c RotatedSelfSignedCertKeySecret) setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, certKeyPair *crypto.TLSCertificateConfig) { targetCertKeyPairSecret.Annotations[CertificateIssuer] = certKeyPair.Certs[0].Issuer.CommonName + tlsAnnotations := c.AdditionalAnnotations tlsAnnotations.NotBefore = certKeyPair.Certs[0].NotBefore.Format(time.RFC3339) tlsAnnotations.NotAfter = certKeyPair.Certs[0].NotAfter.Format(time.RFC3339) - tlsAnnotations.RefreshPeriod = refresh.String() + tlsAnnotations.RefreshPeriod = c.Refresh.String() _ = tlsAnnotations.EnsureTLSMetadataUpdate(&targetCertKeyPairSecret.ObjectMeta) - certCreator.SetAnnotations(certKeyPair, targetCertKeyPairSecret.Annotations) + c.CertCreator.SetAnnotations(certKeyPair, targetCertKeyPairSecret.Annotations) +} + +func (c RotatedSelfSignedCertKeySecret) resolveKeyPairGenerator() (crypto.KeyPairGenerator, error) { + return resolveKeyPairGeneratorWithFallback(c.PKIProfileProvider, c.CertCreator.CertificateType(), c.CertificateName) } type ClientRotation struct { UserInfo user.Info } -func (r *ClientRotation) NewCertificate(signer *crypto.CA, validity time.Duration) (*crypto.TLSCertificateConfig, error) { +func (r *ClientRotation) CertificateType() pki.CertificateType { + return pki.CertificateTypeClient +} + +func (r *ClientRotation) NewCertificate(signer *crypto.CA, validity time.Duration, keyGen crypto.KeyPairGenerator) (*crypto.TLSCertificateConfig, error) { + if keyGen != nil { + return signer.NewClientCertificate(r.UserInfo, keyGen, crypto.WithLifetime(validity)) + } return signer.MakeClientCertificateForDuration(r.UserInfo, validity) } @@ -315,11 +347,23 @@ type ServingRotation struct { HostnamesChanged <-chan struct{} } -func (r *ServingRotation) NewCertificate(signer *crypto.CA, validity time.Duration) (*crypto.TLSCertificateConfig, error) { - if len(r.Hostnames()) == 0 { +func (r *ServingRotation) CertificateType() pki.CertificateType { + return pki.CertificateTypeServing +} + +func (r *ServingRotation) NewCertificate(signer *crypto.CA, validity time.Duration, keyGen crypto.KeyPairGenerator) (*crypto.TLSCertificateConfig, error) { + hostnames := r.Hostnames() + if len(hostnames) == 0 { return nil, fmt.Errorf("no hostnames set") } - return signer.MakeServerCertForDuration(sets.New(r.Hostnames()...), validity, r.CertificateExtensionFn...) + if keyGen != nil { + return signer.NewServerCertificate( + sets.New(hostnames...), keyGen, + crypto.WithLifetime(validity), + crypto.WithExtensions(r.CertificateExtensionFn...), + ) + } + return signer.MakeServerCertForDuration(sets.New(hostnames...), validity, r.CertificateExtensionFn...) } func (r *ServingRotation) RecheckChannel() <-chan struct{} { @@ -336,18 +380,25 @@ func (r *ServingRotation) NeedNewTargetCertKeyPair(currentCertSecret *corev1.Sec } func (r *ServingRotation) missingHostnames(annotations map[string]string) string { + return missingHostnames(annotations, r.Hostnames()) +} + +func (r *ServingRotation) SetAnnotations(cert *crypto.TLSCertificateConfig, annotations map[string]string) map[string]string { + return setHostnameAnnotations(cert, annotations) +} + +func missingHostnames(annotations map[string]string, hostnames []string) string { existingHostnames := sets.New(strings.Split(annotations[CertificateHostnames], ",")...) - requiredHostnames := sets.New(r.Hostnames()...) + requiredHostnames := sets.New(hostnames...) if !existingHostnames.Equal(requiredHostnames) { existingNotRequired := existingHostnames.Difference(requiredHostnames) requiredNotExisting := requiredHostnames.Difference(existingHostnames) return fmt.Sprintf("%q are existing and not required, %q are required and not existing", strings.Join(sets.List(existingNotRequired), ","), strings.Join(sets.List(requiredNotExisting), ",")) } - return "" } -func (r *ServingRotation) SetAnnotations(cert *crypto.TLSCertificateConfig, annotations map[string]string) map[string]string { +func setHostnameAnnotations(cert *crypto.TLSCertificateConfig, annotations map[string]string) map[string]string { hostnames := sets.Set[string]{} for _, ip := range cert.Certs[0].IPAddresses { hostnames.Insert(ip.String()) @@ -355,7 +406,6 @@ func (r *ServingRotation) SetAnnotations(cert *crypto.TLSCertificateConfig, anno for _, dnsName := range cert.Certs[0].DNSNames { hostnames.Insert(dnsName) } - // List does a sort so that we have a consistent representation annotations[CertificateHostnames] = strings.Join(sets.List(hostnames), ",") return annotations @@ -367,11 +417,81 @@ type SignerRotation struct { SignerName string } -func (r *SignerRotation) NewCertificate(signer *crypto.CA, validity time.Duration) (*crypto.TLSCertificateConfig, error) { +func (r *SignerRotation) CertificateType() pki.CertificateType { + return pki.CertificateTypeSigner +} + +func (r *SignerRotation) NewCertificate(signer *crypto.CA, validity time.Duration, keyGen crypto.KeyPairGenerator) (*crypto.TLSCertificateConfig, error) { signerName := fmt.Sprintf("%s_@%d", r.SignerName, time.Now().Unix()) + if keyGen != nil { + return crypto.NewSigningCertificate(signerName, keyGen, + crypto.WithSigner(signer), + crypto.WithLifetime(validity), + ) + } return crypto.MakeCAConfigForDuration(signerName, validity, signer) } +// PeerRotation creates certificates used for both server and client authentication +// (e.g., etcd peer certificates). It uses CertificateTypePeer for PKI profile +// resolution, which selects the stronger of the serving and client key configurations. +// +// When keyGen is non-nil (ConfigurablePKI enabled), it calls NewPeerCertificate +// which requires UserInfo for the client identity. When keyGen is nil (legacy), +// it falls back to MakeServerCertForDuration with an extension function that +// sets both ClientAuth and ServerAuth ExtKeyUsages. +type PeerRotation struct { + Hostnames ServingHostnameFunc + UserInfo user.Info + CertificateExtensionFn []crypto.CertificateExtensionFunc + HostnamesChanged <-chan struct{} +} + +func (r *PeerRotation) CertificateType() pki.CertificateType { + return pki.CertificateTypePeer +} + +func (r *PeerRotation) NewCertificate(signer *crypto.CA, validity time.Duration, keyGen crypto.KeyPairGenerator) (*crypto.TLSCertificateConfig, error) { + hostnames := r.Hostnames() + if len(hostnames) == 0 { + return nil, fmt.Errorf("no hostnames set") + } + if keyGen != nil { + if r.UserInfo == nil { + return nil, fmt.Errorf("PeerRotation requires UserInfo for configurable PKI certificates") + } + return signer.NewPeerCertificate( + sets.New(hostnames...), r.UserInfo, keyGen, + crypto.WithLifetime(validity), + crypto.WithExtensions(r.CertificateExtensionFn...), + ) + } + // Legacy path: use server cert template with extension fn to add both ExtKeyUsages. + // The subject CN comes from the first hostname (preserves current behavior). + peerExtFn := func(cert *x509.Certificate) error { + cert.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth} + return nil + } + extensions := append(append([]crypto.CertificateExtensionFunc{}, r.CertificateExtensionFn...), peerExtFn) + return signer.MakeServerCertForDuration(sets.New(hostnames...), validity, extensions...) +} + +func (r *PeerRotation) RecheckChannel() <-chan struct{} { + return r.HostnamesChanged +} + +func (r *PeerRotation) NeedNewTargetCertKeyPair(currentCertSecret *corev1.Secret, signer *crypto.CA, caBundleCerts []*x509.Certificate, refresh time.Duration, refreshOnlyWhenExpired, creationRequired bool) string { + reason := needNewTargetCertKeyPair(currentCertSecret, signer, caBundleCerts, refresh, refreshOnlyWhenExpired, creationRequired) + if len(reason) > 0 { + return reason + } + return missingHostnames(currentCertSecret.Annotations, r.Hostnames()) +} + +func (r *PeerRotation) SetAnnotations(cert *crypto.TLSCertificateConfig, annotations map[string]string) map[string]string { + return setHostnameAnnotations(cert, annotations) +} + func (r *SignerRotation) NeedNewTargetCertKeyPair(currentCertSecret *corev1.Secret, signer *crypto.CA, caBundleCerts []*x509.Certificate, refresh time.Duration, refreshOnlyWhenExpired, exists bool) string { return needNewTargetCertKeyPair(currentCertSecret, signer, caBundleCerts, refresh, refreshOnlyWhenExpired, exists) } diff --git a/vendor/github.com/openshift/library-go/pkg/operator/v1helpers/helpers.go b/vendor/github.com/openshift/library-go/pkg/operator/v1helpers/helpers.go index fd34ec6201..f4a0943e51 100644 --- a/vendor/github.com/openshift/library-go/pkg/operator/v1helpers/helpers.go +++ b/vendor/github.com/openshift/library-go/pkg/operator/v1helpers/helpers.go @@ -123,11 +123,22 @@ type UpdateOperatorSpecFunc func(spec *operatorv1.OperatorSpec) error func UpdateSpec(ctx context.Context, client OperatorClient, updateFuncs ...UpdateOperatorSpecFunc) (*operatorv1.OperatorSpec, bool, error) { updated := false var operatorSpec *operatorv1.OperatorSpec + previousResourceVersion := "" err := retry.RetryOnConflict(retry.DefaultBackoff, func() error { oldSpec, _, resourceVersion, err := client.GetOperatorState() if err != nil { return err } + if resourceVersion == previousResourceVersion { + // Lister is stale (e.g. after a conflict or restart); do a live GET to get the current resourceVersion. + listerResourceVersion := resourceVersion + oldSpec, _, resourceVersion, err = client.GetOperatorStateWithQuorum(ctx) + if err != nil { + return err + } + klog.V(2).Infof("lister was stale at resourceVersion=%v, live get showed resourceVersion=%v", listerResourceVersion, resourceVersion) + } + previousResourceVersion = resourceVersion newSpec := oldSpec.DeepCopy() for _, update := range updateFuncs { diff --git a/vendor/github.com/openshift/library-go/pkg/pki/profile.go b/vendor/github.com/openshift/library-go/pkg/pki/profile.go new file mode 100644 index 0000000000..6f534c94f0 --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/pki/profile.go @@ -0,0 +1,114 @@ +package pki + +import ( + "fmt" + + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + "github.com/openshift/library-go/pkg/crypto" +) + +// DefaultPKIProfile returns the default PKIProfile for OpenShift. +func DefaultPKIProfile() configv1alpha1.PKIProfile { + return configv1alpha1.PKIProfile{ + Defaults: configv1alpha1.DefaultCertificateConfig{ + Key: configv1alpha1.KeyConfig{ + Algorithm: configv1alpha1.KeyAlgorithmECDSA, + ECDSA: configv1alpha1.ECDSAKeyConfig{Curve: configv1alpha1.ECDSACurveP256}, + }, + }, + SignerCertificates: configv1alpha1.CertificateConfig{ + Key: configv1alpha1.KeyConfig{ + Algorithm: configv1alpha1.KeyAlgorithmECDSA, + ECDSA: configv1alpha1.ECDSAKeyConfig{Curve: configv1alpha1.ECDSACurveP384}, + }, + }, + } +} + +// KeyPairGeneratorFromAPI converts a configv1alpha1.KeyConfig to a +// crypto.KeyPairGenerator. +func KeyPairGeneratorFromAPI(apiKey configv1alpha1.KeyConfig) (crypto.KeyPairGenerator, error) { + switch apiKey.Algorithm { + case configv1alpha1.KeyAlgorithmRSA: + return crypto.RSAKeyPairGenerator{ + Bits: int(apiKey.RSA.KeySize), + }, nil + case configv1alpha1.KeyAlgorithmECDSA: + curve, err := ecdsaCurveFromAPI(apiKey.ECDSA.Curve) + if err != nil { + return nil, err + } + return crypto.ECDSAKeyPairGenerator{ + Curve: curve, + }, nil + default: + return nil, fmt.Errorf("unknown key algorithm: %q", apiKey.Algorithm) + } +} + +// ecdsaCurveFromAPI converts an API ECDSA curve name to the crypto package's ECDSACurve. +func ecdsaCurveFromAPI(c configv1alpha1.ECDSACurve) (crypto.ECDSACurve, error) { + switch c { + case configv1alpha1.ECDSACurveP256: + return crypto.P256, nil + case configv1alpha1.ECDSACurveP384: + return crypto.P384, nil + case configv1alpha1.ECDSACurveP521: + return crypto.P521, nil + default: + return "", fmt.Errorf("unknown ECDSA curve: %q", c) + } +} + +// securityBits returns the NIST security strength in bits for a given +// KeyPairGenerator. For RSA, values come from the rsaSecurityStrength table. +// For ECDSA, security strength is half the key size (fixed per curve). +func securityBits(g crypto.KeyPairGenerator) int { + switch g := g.(type) { + case crypto.RSAKeyPairGenerator: + return rsaSecurityStrength[g.Bits] + case crypto.ECDSAKeyPairGenerator: + switch g.Curve { + case crypto.P256: + return 128 + case crypto.P384: + return 192 + case crypto.P521: + return 256 + } + } + return 0 +} + +// rsaSecurityStrength maps RSA key sizes (2048-8192 in 1024-bit increments) +// to their security strengths from NIST SP 800-56B Rev 2 Table 2 or +// pre-calculated from the GNFS complexity estimate. +var rsaSecurityStrength = map[int]int{ + 2048: 112, + 3072: 128, + 4096: 152, + 5120: 168, + 6144: 176, + 7168: 192, + 8192: 200, +} + +// strongerKeyPairGenerator returns whichever of a or b provides higher NIST +// security strength. In case of a tie, ECDSA is preferred over RSA. +func strongerKeyPairGenerator(a, b crypto.KeyPairGenerator) crypto.KeyPairGenerator { + sa, sb := securityBits(a), securityBits(b) + if sb > sa { + return b + } + if sa > sb { + return a + } + // Equal strength: prefer ECDSA over RSA. + if _, ok := a.(crypto.ECDSAKeyPairGenerator); ok { + return a + } + if _, ok := b.(crypto.ECDSAKeyPairGenerator); ok { + return b + } + return a +} diff --git a/vendor/github.com/openshift/library-go/pkg/pki/provider.go b/vendor/github.com/openshift/library-go/pkg/pki/provider.go new file mode 100644 index 0000000000..2007aa890e --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/pki/provider.go @@ -0,0 +1,75 @@ +package pki + +import ( + "fmt" + + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + configv1alpha1listers "github.com/openshift/client-go/config/listers/config/v1alpha1" +) + +// PKIProfileProvider provides the PKIProfile that determines certificate key +// configuration. A nil profile indicates Unmanaged mode where the caller +// should use its own defaults. +type PKIProfileProvider interface { + PKIProfile() (*configv1alpha1.PKIProfile, error) +} + +// StaticPKIProfileProvider is a PKIProfileProvider backed by a fixed PKIProfile. +type StaticPKIProfileProvider struct { + profile *configv1alpha1.PKIProfile +} + +// NewStaticPKIProfileProvider returns a PKIProfileProvider backed by the given +// profile. A nil profile signals Unmanaged mode. +func NewStaticPKIProfileProvider(profile *configv1alpha1.PKIProfile) *StaticPKIProfileProvider { + return &StaticPKIProfileProvider{profile: profile} +} + +// PKIProfile returns the static PKIProfile. +func (s *StaticPKIProfileProvider) PKIProfile() (*configv1alpha1.PKIProfile, error) { + return s.profile, nil +} + +// ListerPKIProfileProvider is a PKIProfileProvider that reads a named +// cluster-scoped PKI resource via a lister. +type ListerPKIProfileProvider struct { + lister configv1alpha1listers.PKILister + resourceName string +} + +// NewClusterPKIProfileProvider creates a PKIProfileProvider that resolves the +// PKIProfile from the OpenShift cluster configuration PKI resource. +func NewClusterPKIProfileProvider(lister configv1alpha1listers.PKILister) *ListerPKIProfileProvider { + return NewListerPKIProfileProvider(lister, "cluster") +} + +// NewListerPKIProfileProvider returns a PKIProfileProvider that reads the +// named cluster-scoped PKI resource via a lister. +func NewListerPKIProfileProvider(lister configv1alpha1listers.PKILister, resourceName string) *ListerPKIProfileProvider { + return &ListerPKIProfileProvider{ + lister: lister, + resourceName: resourceName, + } +} + +// PKIProfile reads the PKI resource and returns the profile based on its +// certificate management mode. Returns nil for Unmanaged mode. +func (l *ListerPKIProfileProvider) PKIProfile() (*configv1alpha1.PKIProfile, error) { + pki, err := l.lister.Get(l.resourceName) + if err != nil { + return nil, fmt.Errorf("failed to get PKI resource %q: %w", l.resourceName, err) + } + + switch pki.Spec.CertificateManagement.Mode { + case configv1alpha1.PKICertificateManagementModeUnmanaged: + return nil, nil + case configv1alpha1.PKICertificateManagementModeDefault: + profile := DefaultPKIProfile() + return &profile, nil + case configv1alpha1.PKICertificateManagementModeCustom: + profile := pki.Spec.CertificateManagement.Custom.PKIProfile + return &profile, nil + default: + return nil, fmt.Errorf("unknown PKI certificate management mode: %q", pki.Spec.CertificateManagement.Mode) + } +} diff --git a/vendor/github.com/openshift/library-go/pkg/pki/resolve.go b/vendor/github.com/openshift/library-go/pkg/pki/resolve.go new file mode 100644 index 0000000000..1154fd48ea --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/pki/resolve.go @@ -0,0 +1,77 @@ +package pki + +import ( + "fmt" + + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + "github.com/openshift/library-go/pkg/crypto" +) + +// CertificateConfig holds the resolved configuration for a specific certificate. +// Currently contains key configuration; will grow as the PKI API expands to +// include additional certificate properties. +type CertificateConfig struct { + // Key is the resolved key pair generator. + Key crypto.KeyPairGenerator +} + +// ResolveCertificateConfig resolves the effective certificate configuration +// for a given certificate type and name from the PKI profile. +// +// Returns nil if the provider returns a nil profile (Unmanaged mode), +// indicating that the caller should use its own default behavior. +// +// The name parameter is reserved for future per-certificate overrides and +// can be used for metrics and logging. +func ResolveCertificateConfig(provider PKIProfileProvider, certType CertificateType, name string) (*CertificateConfig, error) { + profile, err := provider.PKIProfile() + if err != nil { + return nil, fmt.Errorf("resolving PKI profile for %s certificate %q: %w", certType, name, err) + } + if profile == nil { + return nil, nil + } + + switch certType { + case CertificateTypeSigner: + return resolveKeyConfig(profile.Defaults, profile.SignerCertificates) + case CertificateTypeServing: + return resolveKeyConfig(profile.Defaults, profile.ServingCertificates) + case CertificateTypeClient: + return resolveKeyConfig(profile.Defaults, profile.ClientCertificates) + case CertificateTypePeer: + return resolvePeerKeyConfig(profile) + default: + return nil, fmt.Errorf("unknown certificate type: %q", certType) + } +} + +// resolveKeyConfig returns the override KeyConfig if its Algorithm is set, +// otherwise falls back to the default. +func resolveKeyConfig(defaults configv1alpha1.DefaultCertificateConfig, override configv1alpha1.CertificateConfig) (*CertificateConfig, error) { + apiKey := defaults.Key + if override.Key.Algorithm != "" { + apiKey = override.Key + } + g, err := KeyPairGeneratorFromAPI(apiKey) + if err != nil { + return nil, err + } + return &CertificateConfig{Key: g}, nil +} + +// resolvePeerKeyConfig resolves both the serving and client configs and +// returns whichever has higher NIST security strength. +func resolvePeerKeyConfig(profile *configv1alpha1.PKIProfile) (*CertificateConfig, error) { + servingCfg, err := resolveKeyConfig(profile.Defaults, profile.ServingCertificates) + if err != nil { + return nil, fmt.Errorf("resolving serving config for peer: %w", err) + } + clientCfg, err := resolveKeyConfig(profile.Defaults, profile.ClientCertificates) + if err != nil { + return nil, fmt.Errorf("resolving client config for peer: %w", err) + } + return &CertificateConfig{ + Key: strongerKeyPairGenerator(servingCfg.Key, clientCfg.Key), + }, nil +} diff --git a/vendor/github.com/openshift/library-go/pkg/pki/types.go b/vendor/github.com/openshift/library-go/pkg/pki/types.go new file mode 100644 index 0000000000..2cf8282255 --- /dev/null +++ b/vendor/github.com/openshift/library-go/pkg/pki/types.go @@ -0,0 +1,23 @@ +package pki + +// CertificateType identifies the category of a certificate for profile resolution. +type CertificateType string + +const ( + // CertificateTypeSigner identifies certificate authority (CA) certificates + // that sign other certificates. + CertificateTypeSigner CertificateType = "signer" + + // CertificateTypeServing identifies TLS server certificates used to serve + // HTTPS endpoints. + CertificateTypeServing CertificateType = "serving" + + // CertificateTypeClient identifies client authentication certificates used + // to authenticate to servers. + CertificateTypeClient CertificateType = "client" + + // CertificateTypePeer identifies certificates used for both server and client + // authentication. The resolved key configuration is the stronger of the + // serving and client configurations. + CertificateTypePeer CertificateType = "peer" +) diff --git a/vendor/modules.txt b/vendor/modules.txt index 076274b503..34cb214d3f 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1184,7 +1184,7 @@ github.com/opencontainers/go-digest ## explicit; go 1.18 github.com/opencontainers/image-spec/specs-go github.com/opencontainers/image-spec/specs-go/v1 -# github.com/openshift/api v0.0.0-20260306141135-f595753a3e66 +# github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 ## explicit; go 1.25.0 github.com/openshift/api github.com/openshift/api/annotations @@ -1209,6 +1209,7 @@ github.com/openshift/api/config/v1alpha2 github.com/openshift/api/console github.com/openshift/api/console/v1 github.com/openshift/api/etcd +github.com/openshift/api/etcd/v1 github.com/openshift/api/etcd/v1alpha1 github.com/openshift/api/features github.com/openshift/api/helm @@ -1267,7 +1268,7 @@ github.com/openshift/api/template github.com/openshift/api/template/v1 github.com/openshift/api/user github.com/openshift/api/user/v1 -# github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d +# github.com/openshift/client-go v0.0.0-20260416131737-a19e91702ab5 ## explicit; go 1.25.0 github.com/openshift/client-go/apiextensions/applyconfigurations/apiextensions/v1alpha1 github.com/openshift/client-go/apiextensions/applyconfigurations/internal @@ -1319,7 +1320,10 @@ github.com/openshift/cluster-api-provider-baremetal/pkg/apis/baremetal/v1alpha1 github.com/openshift/cluster-autoscaler-operator/pkg/apis/autoscaling/v1 # github.com/openshift/cluster-capi-operator/manifests-gen v0.0.0-00010101000000-000000000000 => ./manifests-gen ## explicit; go 1.25.0 -# github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6 +# github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2 +## explicit; go 1.25.0 +github.com/openshift/controller-runtime-common/pkg/tls +# github.com/openshift/library-go v0.0.0-20260413093329-d2db42c961e1 ## explicit; go 1.25.0 github.com/openshift/library-go/pkg/apiserver/jsonpatch github.com/openshift/library-go/pkg/certs @@ -1338,6 +1342,7 @@ github.com/openshift/library-go/pkg/operator/resource/resourcemerge github.com/openshift/library-go/pkg/operator/resource/resourceread github.com/openshift/library-go/pkg/operator/resourcesynccontroller github.com/openshift/library-go/pkg/operator/v1helpers +github.com/openshift/library-go/pkg/pki # github.com/openshift/machine-api-operator v0.2.1-0.20260226113419-88465550a74b ## explicit; go 1.24.0 github.com/openshift/machine-api-operator/pkg/util/lifecyclehooks @@ -3048,7 +3053,7 @@ k8s.io/kubernetes/pkg/capabilities k8s.io/kubernetes/pkg/features k8s.io/kubernetes/pkg/fieldpath k8s.io/kubernetes/pkg/util/parsers -# k8s.io/utils v0.0.0-20260108192941-914a6e750570 +# k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 ## explicit; go 1.23 k8s.io/utils/buffer k8s.io/utils/clock